Actually, I'm surprised they get away with keeping that data for so short a period of time. For some reason, I thought I read somewhere that US law mandated service providers to keep that sort of data significantly longer. I can't find the reference now... so I must have been mistaken.

I guess I'm more surprised that it's only kept for 2 years, than I am that the data is kept.