Library E-Books and Apps: How Long Should Reading Records Last?

A library app can make borrowing easier by remembering a checkout or reading position, but reading and search histories can reveal a person’s interests and beliefs. The American Library Association (ALA) says privacy supports intellectual freedom because people should be able to explore library materials without unwanted observation. That principle does not mean every lending record must disappear immediately. The practical question is which records a service needs to operate, which support optional personalization, who can see them, and when each should be deleted.

Different features need different records

A service may need an account and current loan status to deliver a licensed e-book. A recommendation feature might use past subjects or searches; reading across devices may save a last position. Those functions do not automatically need the same information for the same length of time. Separating essential account and loan operations from diagnostic logs and optional personalization makes it easier to avoid keeping data after its purpose has ended.

ALA’s Library Privacy Guidelines are intended to help libraries and vendors develop practices for online privacy, data management, and security while balancing privacy with data needed for services. They are professional guidance, not a command to disable every useful feature. A library can explain what a feature collects, why it is needed, and how it is protected. When personalization is optional, offering it separately from basic borrowing makes the choice clearer.

Map the record’s path and access

The borrowing history visible in an app may not show every record held by the service. Data can pass among a library account, an e-book platform, an identity or analytics tool, and a cloud provider. For each step, ask which identifiers travel, which staff or vendor roles can access them, and whether diagnostic or security logs contain more reading information than their purpose requires. Vendor terms can address subprocessors, access controls, incident notification, and return or deletion of data when a contract ends.

ALA publishes separate guidance for vendors, exchanges between networked services, library websites and discovery systems, and library management systems. A general vendor statement about security is therefore not a substitute for checking the data flow and contract for the specific feature. Readers should be able to find out which organization holds their records and how to ask a question or request deletion. Clear responsibility is part of trustworthy service design.

Explain retention and deletion limits

Whether a library can delete a record immediately after a loan, or must retain some information for account administration, a dispute, or another duty, depends on local law, library policy, contracts, and system design. There is no single retention period that can be assumed for every library. A notice should state the purpose and duration—or the rule used to set a duration—for each kind of record, whether deletion is automatic, what a reader can erase, and any exceptions with their reasons.

If deletion from logs or backups takes time, explain the schedule and restrict access during that period. Keeping operational records separate from an optional recommendation profile can prevent one retention need from becoming a reason to keep everything indefinitely. Public-records rules or other local obligations may apply, so an institution should check its own jurisdiction and records-management requirements before setting a policy.

Questions to review personalization and privacy

Compare the service screens and vendor terms against questions such as these:

• Which data item is necessary for each feature? If a feature is optional, can a reader enable or disable it separately?
• Are account identifiers separated from recommendation history? Are staff and vendor permissions limited by role and logged?
• After a loan ends, an account closes, or personalization is disabled, when and where is each record deleted? What happens to logs and backups?
• What is shared with vendors or analytics tools, for how long, with which subprocessors, and how will readers be notified about an incident?

The purpose is not to reject personalization, but to make its costs and choices understandable. ALA’s materials express professional values and practices for libraries; they do not interpret every country’s law or prove that every institution follows the guidance. Libraries should check applicable law and contracts, then test whether the actual service data flow and deletion behavior match what the policy promises.

Sources

• Privacy — American Library Association
• Library Privacy Guidelines — American Library Association