There are a bunch of exceptions to the requirement to delete user data in the law (full text: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...), the exception for data that is collected "to enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business" would probably apply in the cases you cite.