The scary thing about this is AT&T never deletes your call data. EVER.
I used to work for MCI (and briefly Verizon Business after they bought us), and they did this as well. We had access to these archaic DB2 systems with a bazillion records going back to the 80s, with all the standard telco metadata. Our team used the recent data for calls through our IP relay (voice to text/text to voice service primarily intended for deaf people) system to help identify fraud users (the same Nigerian 419 scammers).