I have a client that has a data retention period of 26 months for its Google Analytics account. Ideally, I'd like to have user information that goes back for as long as possible. Before I recommend changing this setting to "do not automatically expire," what factors should I consider that might affect this decision?
Since keeping the data doesn't "cost" anything there's no harm in keeping it.
It's much worse to need the data and not have it, than it is to have the data and not need it. You're the expert, make your recommendation as you see fit.
On the other hand, they are the client. If they feel strongly about not keeping the data, then get rid of it. Anyone who chooses to ignore the advice of an expert gets what they have coming to them.
This setting has come about due to need for compliance with GDPR policies. If you're not operating in Europe, you may not even need to comply, and can confidently set your data expiration to "do not automatically expire." If you are, you will have to do more research into your industry and data retainer policies as they relate to GDPR.
It's also important to understand that this does not concern all your data. Anonymous data, like aggregate pageviews and bounce rates, will not be affected by this setting. Only personally identifiable information (PII), such as IP addresses, is affected.
For example, if you set your data retention to 26 months, and your new activity reset toggle to ON, your regularly returning users will never get wiped, while those who never come back will be wiped after 26 months. But again, you have to check the legal documentation on where you're based, or where you do business, to figure out the optimal settings. And most of your general website trend reports that you use on a daily basis shouldn't be affected either way.
More info on these settings can be found here. More info on the whole concept can be found here. Both of these are not brand new resources, but they're recent enough to guide you in the right direction.