resources
Video retention requirements by industry and state
How long you must keep surveillance video is set by whoever licenses or audits you, and the honest answer runs from 3 days to more than a year. Cannabis boards sit between 30 and 180 days, casino regulators between 3 and 30, PCI DSS asks merchants for three months, and some of the numbers everyone quotes do not exist in any rule at all. Every row below carries its citation and a link to the text it came from.
92 entries across 10 industries, last verified August 3, 2026. Retention baselines are floors, not purge schedules: nearly every regulator requires footage to be held past the baseline once an incident or investigation is in play.
No match. Absence from this table does not mean absence of a requirement: it means we have not verified one. Check your license conditions and any contract that references a security standard, and send corrections with a source to [email protected].
Cannabis
State cannabis control boards and commissions
Every licensing state writes video surveillance into its cannabis rules, and most set an explicit retention floor. The floors run from 14 days for Maine's medical dispensaries to 180 in Pennsylvania and West Virginia, several changed inside the last two years, and nearly every state adds an indefinite hold once an investigation is pending.
-
Alabama
All licensed facility types, medical program
primary source60 days
Recordings of actual or attempted diversion at least 2 years or until the incident resolves.
The rules are in force but dispensary operations were delayed by licensing litigation into 2025.
Ala. Admin. Code r. 538-X-8-.05 and parallel chapters / size 60 days of storage
-
Alaska
Marijuana establishments, adult use
secondary text40 days
Recordings may be deleted after 40 days unless the licensee knows of a pending investigation.
-
Arizona
Medical dispensaries and adult-use establishments
primary source30 days
The 30 calendar day storage language appears verbatim in both the medical and adult-use chapters.
A.A.C. R9-17-318; Title 9, ch. 18 mirrors it / size 30 days of storage
-
Arkansas
Dispensaries and processors, medical program
primary source90 days
Cultivation facilities carry the same 90 day rule per secondary sources.
-
California
All licensees except premises used exclusively for cultivation
secondary text90 days
Continuous recording at 15 frames per second minimum, with point-of-sale areas capturing facial features.
-
Colorado
Regulated marijuana businesses, medical and adult use
secondary text30 days
Most compliance guides still say 40 days. The current rule text says 30; the reduction came in a recent annual rulemaking cycle. Destruction is barred once the licensee knows or should know of an investigation.
-
Connecticut
All cannabis establishments
primary source30 days
An unaltered copy must be kept until any known investigation closes. The 2025 regulation revision keeps the 30 day figure in draft.
Conn. Agencies Regs. § 21a-421j-7(a)(3) / size 30 days of storage
-
Delaware
Adult-use marijuana establishments
primary source90 days
Footage containing information of significance up to 36 months.
Rules finalized September 2024 with retail sales from August 2025. Medical compassion centers are reported to mirror the same periods, unverified.
5 Del. Admin. Code 5001, § 6.3.2.4.2.5 / size 90 days of storage
-
Florida
Medical marijuana treatment centers
primary source45 days
Longer on request of a law enforcement agency.
One of the few states where the day count sits in the statute itself rather than agency rules.
-
Georgia
Low-THC oil production and dispensing
primary source45 days
Georgia's program is low-THC oil rather than full cannabis.
Ga. Comp. R. & Regs. r. 351-4-.03; r. 351-6-.03 / size 45 days of storage
-
Hawaii
Dispensary licensees, cultivation and retail
primary source50 days
An unusual number that is nonetheless exactly what the interim rules effective April 2024 say. Do not round it to 45 or 60.
-
Illinois
Adult-use dispensing organizations
primary source60 days, dispensaries
Longer where theft or loss is known or an investigation is pending.
Reduced from 90 days by an amendment effective June 2026, so most published guides are stale. Cultivation centers and medical dispensaries sit under separate provisions commonly cited at 90 days, not verified here.
-
Iowa
Medical cannabidiol manufacturers and dispensaries
primary source60 days
Held longer on notice of an investigation.
-
Kentucky
All medical cannabis license types
primary source60 days
A new program with rules finalized across 2024 and 2025 and sales from 2025.
915 KAR 1:070, Section 11, and parallel chapters / size 60 days of storage
-
Louisiana
Health department permitted production and processing facilities
secondary text30 days
Dispensing runs through pharmacy board licensed marijuana pharmacies whose rules were not verified, and the health department finalized a rule revision in January 2026 worth checking.
-
Maine
Adult-use establishments; registered medical dispensaries
primary source45 days adult use, 14 days medical dispensaries
The 14 day medical figure applies to registered dispensaries only, caregivers carry no camera mandate, and a medical rule overhaul was still pending as of 2025. Maine also bars facial surveillance software.
18-691 C.M.R. ch. 1, § 3.9.2; ch. 2 / size 45 days of storage
-
Maryland
Licensed dispensaries, growers, and processors
primary source90 days
Carried over unchanged from the medical-era rules.
-
Massachusetts
Adult-use establishments and medical treatment centers
secondary text90 days
Or the duration of a Commission preservation request, whichever is longer.
-
Michigan
All licensees, medical and adult use
primary source30 days
Held until released when an agency investigation or inspection is open.
The agency's recent rules overhaul kept the 30 day standard and dropped a drafted live remote feed access mandate.
-
Minnesota
All cannabis businesses
primary source90 days
New Office of Cannabis Management rules effective 2025; the legacy medical program used the same 90 day figure.
-
Mississippi
Medical program
unverifiedNo general minimum verified
The health department's adopted rules were searched in full and contain no general retention floor, only a 90 day floor for batch sampling video. Secondary sources conflict between 90 and 120 days for revenue department licensed dispensaries, so no dispensary number is printed here.
-
Missouri
All licensed facilities, medical and adult use
primary source60 days
Recordings are stored securely and encrypted, with department approved copies on request.
-
Montana
All licensees, medical and adult use
primary source60 days
A proposed 90 day period was cut to 60 at adoption, visible in the rulemaking redline.
ARM Title 42, ch. 39; Mont. Code Ann. § 16-12-207 / size 60 days of storage
-
Nebraska
Medical program
unverified90 days commonly cited, rules too new to verify
The commission's final regulations landed in mid 2026 with license applications opening that August, and the primary text was not yet verifiable when this table was compiled.
-
Nevada
All licensees, adult use and medical
primary source30 days
The pre-board medical rule said 45 days and was superseded, so vendor guides citing 45 are outdated. On-site, off-site, or cloud storage all qualify.
-
New Hampshire
Alternative treatment centers, medical program
primary source90 days
Readopted 2023. Guides still saying 30 days are wrong against the current text.
-
New Jersey
Adult-use cannabis businesses
secondary text30 days
Medical alternative treatment centers sit under parallel security rules not separately verified.
-
New Mexico
All licensees, adult use and medical
primary source30 days
12 months minimum for recordings of theft or reportable security incidents.
A two-tier rule, and the 12 month incident tier is the part most operators miss.
-
New York
All adult-use licensees storing or handling cannabis
secondary text60 days
Never less than 60 days even under investigation holds, with unaltered copies to the Office of Cannabis Management on request.
The medical program's registered organizations sit under a separate part where the same 60 day figure is commonly cited, not separately verified.
-
North Dakota
Medical program compassion centers
primary source90 days in the first year, then 60 with department approval
An unusual two-tier structure where the step down to 60 days is not automatic.
-
Ohio
All license types, adult use and medical
primary source45 days
The 2024 consolidated rules replaced the medical era's 6 month requirement, so older guides overstate it by four months. The dispensary and processor chapters were verified directly; the cultivator chapter carries the same language per the rule structure.
-
Oklahoma
Medical marijuana businesses
primary sourceNo video retention mandate
The full permanent rules effective July 2026 were reviewed and require only general security measures. Any claim that Oklahoma requires a specific number of days has no state rule behind it, though local ordinances can differ.
-
Oregon
All licensees under the liquor and cannabis commission
secondary text90 days
Off-site backups at 30 days.
Amended effective May 2025 with the retention figure unchanged.
-
Pennsylvania
Medical program dispensaries; grower-processor chapter reported parallel
primary source180 days
A 4 year hold applies to recordings tied to an investigation.
The permanent regulations replaced temporary rules that said 2 years, which is the figure still circulating in older guides.
-
Rhode Island
Every licensed cannabis establishment
primary source60 days
The number moved into the new Cannabis Control Commission regulations effective May 2025, so citations to the old department rules are stale.
-
South Dakota
Medical program
unverified90 days commonly cited
The rules portal resisted verification when this table was compiled, and the figure rests on agreeing secondary sources.
-
Utah
Cultivation, processing, and testing under the agriculture department
primary source45 days, production facilities
The pharmacy side is a genuine gap: the old health department retention rule was repealed at the end of 2022 and a successor requirement was not located.
Utah Admin. Code R68-27-5; R68-28-6; R68-30-5 / size 45 days of storage
-
Vermont
All establishments, adult use and medical
primary source30 days
Subsection lettering shifts between rule versions, so cite the section rather than the letter.
Vermont CCB Rule 2, §§ 2.4.2, 2.8.2 / size 30 days of storage
-
Virginia
Medical program pharmaceutical processors
primary source30 days
Amended effective February 2025. Adult-use retail is not yet licensed, so medical is the whole program.
-
Washington
All licensees, adult use with medical endorsements
primary source45 days
Amended effective October 2024 with the retention figure unchanged.
-
West Virginia
Medical program dispensaries; grower-processor series reported parallel
secondary text180 days
A 2 year investigation hold sits on top.
Modeled on Pennsylvania's scheme.
-
District of Columbia
Cultivation centers and dispensaries
secondary text30 days
The regulator's current facilities checklist confirms the 30 day minimum is still enforced, and the title has been actively amended since 2023, so check compilation currency.
Gaming and casinos
State gaming commissions; NIGC minimum internal control standards for tribal gaming
Casino surveillance retention is usually short but layered: a floor for routine coverage, a longer period for money-flow areas, and a longer one again for detentions and suspected crimes. States not listed here either delegate retention to board-approved internal controls or have not yet been verified against primary text.
-
Tribal casinos (NIGC MICS)
All recordings the surveillance section requires
primary source7 days
Suspected crimes, suspicious activity, or detentions discovered inside the window are copied and kept at least 1 year under current Part 543; compacts still referencing legacy Part 542 use 30 days under § 542.43.
Part 543 formally governs Class II gaming. Class III retention follows the tribal-state compact's internal control standards, which typically incorporate Part 543 or legacy Part 542.
25 CFR § 543.21(e); legacy 25 CFR § 542.43(w) / size 7 days of storage
-
Nevada
Nonrestricted licensees
primary source3 to 7 days by coverage area
Detentions, formal security interviews, and medical events at least 30 days; gaming salon coverage at least 45 days.
The day counts sit in board-adopted surveillance standards issued under Regulation 5.160, not in the regulation body, and vary by license category. Because the standards are reissued by the board, re-verify against the current issuance.
NGC Reg. 5.160; NGCB Surveillance Standards (Rev. 10/23) / size 7 days of storage
-
New Jersey
Casino CCTV recordings
secondary text7 days
Gross revenue count recordings at least 30 days; recordings of evidentiary value kept as the Division of Gaming Enforcement directs.
A March 2025 rule proposal did not change the retention day counts in its proposal text; check whether it was adopted with changes.
-
Pennsylvania
Slot machine and table game facilities
primary source7 days floor, 30 days for money-flow areas
Cage and floor transactions, count room, armored car, bill redemption and jackpot and ATM units, entrances and exits, main bank, and vault all carry the 30 day period.
-
Mississippi
All video recordings
primary source14 days
No fixed longer period; suspected criminal violations go to the Gaming Commission immediately.
13 Miss. Admin. Code Pt. 3, R. 6.10(e) / size 14 days of storage
-
Louisiana
Casino surveillance recordings
secondary text7 days floor, 15 to 30 days for cash handling
Count rooms, vault, and cage at 15 days; check cashing and credit card advance activity at 30 days; suspected illegal activity preserved until the Division releases it.
The separate video poker rule uses 14 days; it applies to a different license class.
-
Michigan
Routine activity recordings, Detroit casinos
primary source14 days
Detention, questioning, and violation recordings are made available to the Board immediately; no fixed longer period.
Verified in the consolidated rule set effective April 27, 2026; the retention rule is unchanged since 2019.
-
Indiana
Riverboat and casino surveillance
secondary text7 days
Detentions, questioning, procedural errors, regulatory violations, and criminal activity at least 60 days; nothing held past 7 days may be destroyed without executive director approval.
-
Iowa
Gambling structure surveillance
secondary text7 days floor, 21 days for entrances and check-cashing cages
Detention-area recordings 30 days after the recorded event; the DCI, commission, or a court order can require longer.
This is a Department of Public Safety rule implementing Iowa Code chapter 99F, not a Racing and Gaming Commission rule.
-
Colorado
Limited gaming licensees
primary source10 days floor, 15 days for critical gaming areas
Critical-area footage is held 15 days or until accounting reconciliations complete, whichever is longer; slot drop and count footage until variances are resolved.
Widely circulated 30 day figures for Colorado do not match the current ICMP text. Retention lives in the ICMP, which is reissued regularly, not in the gaming regulations.
CLGCC ICMP, Section 13 (effective Apr. 1, 2026) / size 15 days of storage
-
Missouri
Excursion gambling boat surveillance
primary source14 days floor, 30 days for cages, banks, count rooms, turnstiles
Security office and detention recordings at least 30 days after the recorded event; the commission can require longer.
-
Illinois
Casino surveillance recordings
primary sourceSet by Board retention schedule
Illegal and suspected illegal activity recordings are removed, marked, transferred to read-only media, and released to the Board on demand.
The day count lives in the Gaming Board's records retention schedule, which is not published in the administrative code. Confirm it with the IGB directly.
-
Ohio
All images and video and audio recordings
primary source30 days
Detentions and questioning at least 90 days; unusual or suspected criminal activity and commission-requested recordings at least 90 days.
-
Maryland
Video lottery facility surveillance
secondary text7 or 14 days by coverage area
VLTs, cage, redemption and jackpot units, ATMs, count room, cash movement, entrances and exits, and restricted areas carry the 14 day period; the Commission or law enforcement can direct longer.
The split is based on coverage area, not incidents.
-
Massachusetts
Gaming establishment CCTV
secondary text30 days
Longer on Commission notice; shorter for specific areas only with Commission approval.
-
New York (commercial casinos)
Commercial casino surveillance
secondary text14 days routine, 21 days cage and count room
Violation and criminal activity originals go to the commission immediately with copies kept at least 90 days; detention recordings at least 14 days after the original is provided.
-
West Virginia
Racetrack table games surveillance
secondary text14 days
Violation and criminal originals go to the Commission immediately; copies kept at least 14 days.
Pharmacy
State boards of pharmacy
Only a minority of states require pharmacies to run video at all, and fewer still set a retention period. Where a requirement exists it usually attaches to controlled substance security or to unstaffed dispensing.
-
Federal (DEA)
All DEA registrants
primary sourceNo video requirement
The rule requires effective controls against theft and diversion and lists factors DEA may consider. Cameras and retention days appear nowhere in it. The common belief that DEA requires 45, 60, or 90 days of pharmacy video is vendor marketing.
-
Massachusetts
All licensed pharmacies, controlled substance security
primary source14 days
At least 2 years where theft or diversion is known or suspected.
Automated pharmacy system locations separately require continuous recordable video under 247 CMR 9.10, with no stated retention.
-
Oklahoma
Every pharmacy
primary sourceVideo required, no retention period set
Effective September 1, 2023. The board mandates an electronic alarm and video recording system but names no retention days.
-
Idaho
Drug outlets dispensing without an onsite pharmacist or prescriber
primary source30 days
The widely cited 90 day figure for Idaho reflects an older version of this rule, and further rulemaking was pending as of 2024, so re-verify before relying on it. Ordinary pharmacies with a pharmacist on site carry no video mandate.
-
Maine
Closed-shop pharmacies: filling, dispensing, compounding, controlled storage, and shipping areas
secondary text30 days
Point-of-care dispensing machines separately require 24/7 video with no retention period.
-
Texas
Remote automated dispensing and delivery systems
primary source2 years, kiosk access images
The 2 year period attaches to the digital image of the person picking up a prescription from a kiosk. Community pharmacies may run cameras; nothing requires it.
-
Missouri
Class O automated dispensing system sites
primary sourceVideo required, no retention period set
Waived when a pharmacist is on site.
-
Most other states
Retail pharmacy
unverifiedNo video mandate found
Cannabis program camera rules are regularly misattributed to pharmacy boards. The New Mexico 30 day, Arkansas 90 day, and West Virginia 180 day rules are cannabis rules, not pharmacy rules, and New Jersey's often cited 90 day figure is a board recommendation rather than a regulation. Alabama has a new rules chapter proposed in June 2026 whose subject is unconfirmed.
Boards checked: IN, GA, AL, MS, AR, LA, NV, NM
Childcare
State childcare licensing agencies
Almost no state actually mandates cameras in childcare, despite what vendor blogs claim. The first true mandate arrived in 2025 and takes effect mid 2026.
-
Minnesota
Public and shared areas of centers required to post a maltreatment investigation memorandum
primary source28 days
6 months for incidents reportable to the commissioner; longer while law enforcement investigates.
Enacted 2025, effective July 1, 2026, and the first real state camera mandate for childcare. It is triggered by a maltreatment finding, not universal. Bills proposing a universal mandate with 60 day retention did not pass.
-
Louisiana
Pediatric day health care facilities
primary sourceCameras required, retention set by facility policy
Applies to licensed medically fragile day health facilities, not ordinary early learning centers, which carry no camera mandate in Louisiana.
-
All other states
Licensed childcare centers
secondary textNo camera mandate
Claims that Texas, Illinois, or Indiana mandate daycare cameras all trace to bills that never passed. Indiana's 2025 bill with 90 day retention died in committee that April. Where cameras are installed voluntarily, parental access and consent rules can still apply.
Connecticut OLR Report 2024-R-0008 survey; state licensing rules
Banking and financial
Federal banking agencies; state banking departments
Federal law requires banks to maintain security devices but is quieter on video than most people expect. The one concrete day count found in state law is New York's ATM rule.
-
Federal (Bank Protection Act)
All federally insured banks and credit unions
primary sourceCameras optional, no retention period
In the OCC, Federal Reserve, and FDIC rules a camera appears only as an example of an optional procedure, and the mandatory device list is a vault, vault-area lighting, tamper-resistant locks, and an alarm. The credit union rule requires a written security program and names no devices at all. Claims of a federal six month bank video rule have no citation.
12 U.S.C. §§ 1881-1884; 12 CFR §§ 21.3, 208.61, 326.3, 748.0
-
New York ATM facilities
ATM facilities operated by banking institutions
primary source45 days
Cameras must record everyone entering an interior ATM facility or activity near a walk-up machine, with recordings preserved at least 45 days. It covers banking institutions' ATM facilities, not independently owned retail ATMs. The period was raised from 30 days in 2003.
NY Banking Law § 75-c; 3 NYCRR § 301.5 / size 45 days of storage
-
Other state ATM safety laws
ATM operators in CA, IL, NV, GA, TX
secondary textLighting and safety rules, no video retention
The California, Illinois, and Nevada acts were read in full and contain lighting standards, safety evaluations, and customer notices with no camera or recording language. Georgia and Texas follow the same model per their regulators' summaries.
Healthcare
CMS conditions of participation; state health departments
There is less federal video retention law here than commonly believed, and two of the real state rules are retention ceilings with destruction requirements, not floors.
-
Federal (HIPAA)
All covered entities
primary sourceNo video retention period
The famous 6 year clock applies to written policies, procedures, and compliance documentation. The section never mentions video or cameras. Patient-identifiable footage can still be PHI that needs safeguarding, but no retention period attaches to it.
-
Federal (CMS conditions of participation)
Medicare and Medicaid hospitals and nursing facilities
primary sourceNo camera mandate
The only video reference in the hospital patient-rights rule is live monitoring of simultaneous restraint and seclusion, with no recording or retention requirement.
-
Nursing home camera laws (TX, IL, MN, OH, and others)
Resident-initiated electronic monitoring in long-term care
primary sourceCameras must be allowed, no facility retention period
These are permission mandates: the facility must allow a camera the resident pays for, and the resident owns the recordings. The recurring statutory hook is evidentiary instead, since video must show date and time to be admissible. Illinois extends its law to assisted living and shared housing on January 1, 2027.
-
Michigan psychiatric hospitals
Psychiatric hospital surveillance
primary source30 day ceiling, not a floor
Longer only while an incident is under investigation.
Surveillance is permitted, not required, and archived footage may be kept up to 30 days. This is a privacy cap with the opposite polarity of the retention floors elsewhere in this table.
-
California state hospital enhanced treatment programs
Department of State Hospitals enhanced treatment units
primary sourceDestroyed after 45 days
Retention past 45 days only for abuse, neglect, or protection and advocacy investigations.
Continuous monitoring is required and the recordings must then be destroyed on schedule. Another ceiling, and a very narrow scope.
Utilities and energy
NERC standards enforced through FERC; NRC for nuclear
Substation and generation fleets are sized around NERC CIP physical security requirements, and the widely quoted day count attaches to something more specific than camera footage.
-
NERC CIP-006, BES physical security
High impact and medium impact BES cyber systems
primary source90 days, access and visitor logs, not video
Compliance evidence for each requirement is retained 3 calendar years, which is proof the process worked, not raw footage.
The word video appears nowhere in the requirement text, and monitoring under Parts 1.4 through 1.7 carries no retention at all. When a utility elects video recording as its access logging method, the footage becomes the log and inherits the 90 day retention, which is why 90 days is the standard design target for substation fleets. The next revision, approved by FERC in March 2026 and mandatory July 2028, keeps identical language.
CIP-006-6, R1 Parts 1.8 and 1.9; R2 Part 2.3 / size 90 days of storage
-
NERC CIP-014, transmission substations
Transmission stations and substations in CIP-014 scope
primary sourceNo camera or retention mandate
Security plan measures are entity chosen and the standard never names cameras. The refinement drafted after the 2022 Moore County substation attack changes the risk assessment method and adds no video text either.
-
Nuclear plants (NRC)
Protected area perimeters and vehicle access points
primary sourceRecorded video required, no day count
The only regime in this table that names video in binding text, requiring real time plus playback recorded images at the perimeter. Even here the operational day count lives in each plant's NRC approved security plan.
-
State utility commissions
CA, TX, AZ, NY checked
secondary textNo video retention mandates found
California requires distribution level physical security plans with entity chosen measures. Texas restricts adversary nation equipment on critical infrastructure, which shapes camera vendor choice but sets no retention. The Arizona and New York negatives rest on searches that found nothing rather than a read of a specific rule set. Water systems under AWIA have no surveillance requirement at all.
Corrections and detention
Bureau of Prisons; state departments of corrections; jail standards commissions
Federal prison camera requirements changed recently, and where hard day counts exist at the state and county level they usually come from records retention schedules, not jail standards commissions.
-
Federal Bureau of Prisons
All BOP institutions
primary sourceCoverage and preservation mandated, no day count
Signed December 2022. Requires eliminating blind spots, replacing inoperable cameras, converting analog systems to digital, and storing recordings so they stay available to investigators and courts. BOP's own first annual report showed 12 of 121 institutions with completed digital camera systems as of February 2024, against a roughly March 2026 plan target.
-
Federal BOP use-of-force video
Calculated use-of-force recordings
primary sourceRetention per internal schedule, no public day count
Recording is mandatory and a copy goes to the Regional Director within four working days. The retention period itself sits in an internal records schedule that is not public.
-
ICE detention (PBNDS 2011)
Use-of-force audiovisual records, not general facility CCTV
primary source6 years, use-of-force recordings
At least 1 year after litigation or investigation concludes under the higher optional tier.
The 6 year figure applies to incident recordings. No general CCTV archive period was located in the standard, and facility contracts often exceed it.
-
Texas county jails
Video of prisoners in cells and holding areas
primary source30 days
The day count comes from the state records retention schedule, not the Commission on Jail Standards, whose minimum jail standards set no retention period at all, including the video monitoring update proposed in February 2026.
Texas Local Schedule PS, series PS4200-17 / size 30 days of storage
-
Washington DOC
Security video in state correctional facilities
primary source30 days
Until resolution when a recording is involved in litigation.
Driven by the state agency records retention schedule; the design standard has systems overwrite the archive after 30 days.
WA DOC Security Video System Standards / size 30 days of storage
-
California CDCR
State prisons
primary source90 days, body-worn camera footage
Longer whenever footage is held as evidence, and indefinite for use-of-force footage at one facility under court order.
The 90 day figure is verified for body-worn cameras. A distinct published day count for fixed surveillance cameras was not located.
CDCR body-worn camera and AVSS policy / size 90 days of storage
PCI DSS
PCI Security Standards Council, enforced contractually through the card brands
PCI DSS is a contractual standard, not a law, but it carries one of the clearest retention numbers in this table, and it is narrower than most people quote it.
-
PCI DSS v4.0.1, merchants and service providers
Monitoring data for sensitive areas within the cardholder data environment
primary source3 months
Entry and exit points to sensitive areas are monitored with video cameras or physical access control mechanisms, or both, and the collected data is stored at least three months. Cameras are one of two acceptable mechanisms, so badge logs alone can satisfy the requirement. A sales floor or checkout lane is not a sensitive area by the standard's definition.
PCI DSS v4.0.1, Requirement 9.2.1.1 / size 90 days of storage
-
PCI card production facilities
Card manufacturers and personalization bureaus
primary source90 days, backed up daily
Primary and backup copies must both exist for at least 90 days, with the backup stored separately. This document, which binds card production vendors rather than merchants, is the real source of the claim that PCI requires 90 days of video.
PCI Card Production Physical Security Requirements v2.0, § 3.4.6.4 / size 90 days of storage
CJIS
FBI CJIS Security Policy, applied through state CJIS systems agencies
Vendors routinely claim CJIS requires 30 or 90 days of camera footage. The policy text says something different.
-
CJIS Security Policy v6.1, video surveillance
Physically secure locations handling criminal justice information
primary sourceNo video retention period exists
Verified by full-text search of the current policy. Cameras appear as an example of physical access monitoring under PE-6, never as a mandate, and no retention period attaches to surveillance video anywhere in the document. The policy also states that a camera does not substitute for an escort.
-
CJIS audit and visitor records
System audit records and visitor access records
primary source1 year
This is the one year figure integrators quote as a video requirement. It belongs to audit logs and visitor logs, not camera footage. State CJIS systems agencies can layer their own requirements on top, so check the state addendum before assuming the policy floor is the whole answer.
This is a research reference, not legal advice and not a compliance determination. Every entry describes what a public source said as of August 3, 2026, with its confidence labeled: primary source means we read the requirement on the issuing body's own site or official PDF, secondary text means the full text was read on a legal database republication or confirmed through an authoritative source quoting the section, and unverified means a commonly cited figure we could not confirm. Rules change, license conditions and local ordinances add requirements this table cannot see, and only your regulator or counsel can tell you what your license actually demands. Corrections are welcome at [email protected], with a source.
Where retention numbers actually come from
Almost nobody's retention number lives in a statute. The pattern that actually holds across this table: a statute delegates security requirements to an agency, the agency writes rules, and the day count lands in whichever document sits at the bottom of that chain. Sometimes that is the administrative code itself. Often it is a step further down: Nevada's casino numbers sit in board-adopted surveillance standards, Colorado's in internal control minimum procedures that are reissued on their own schedule, and Illinois delegates casino retention to a Gaming Board records schedule that is not published in the administrative code at all.
Corrections is the clearest example of the pattern. Jail standards commissions, the bodies everyone checks first, mostly set no retention period. The real day counts come from state records retention schedules: Texas Local Schedule PS puts a mandatory 30 day minimum on jail video of prisoners in cells, and Washington's DOC standard implements the same figure from the state records schedule. And PCI DSS is not law at all; it reaches you through your merchant agreement.
The practical consequence: verifying a retention obligation means finding the bottom of the delegation chain for your specific license type, not searching the state code for a number. That is also why so many published numbers are wrong, which brings us to the next section.
Numbers people quote that are not in the text
The retention space is thick with figures that survive in vendor blogs long after the rules changed, or that never existed. The ones this research ran into repeatedly:
- "DEA requires 45, 60, or 90 days of pharmacy video." 21 CFR 1301.71 requires effective controls against diversion and never mentions cameras. Pharmacy camera mandates are state law, and most states do not have one.
- "CJIS requires 30 or 90 days of footage." The CJIS Security Policy contains no video retention period. The one year figure in it covers audit records and visitor logs.
- "PCI means 90 days of video for everyone." Merchants get three months of monitoring data for sensitive areas in the cardholder data environment, and badge logs can satisfy it without a single camera. The 90 day CCTV rule binds card production facilities.
- "HIPAA makes you keep footage 6 years." That clock applies to written policies and compliance documentation, not video.
- "NERC requires 90 days of video." The 90 days in CIP-006 belongs to physical access logs and visitor logs. Footage inherits it only when a utility elects video as its logging method, and CIP-014 never names cameras at all.
- "New York hospitals must keep footage 30 days under 10 NYCRR 405.10." That section is the medical records rule, with a 6 year clock for charts, and it never mentions cameras.
- Stale cannabis figures. Pennsylvania's 2 year figure died with its temporary regulations, the current rule is 180 days. New Hampshire is 90 days, not 30. Ohio dropped from 6 months to 45 days in its 2024 consolidated rules. Nevada's old 45 day medical rule was superseded by the current 30 day requirement. Colorado's often quoted 40 days is now 30, and Illinois dispensaries dropped from 90 to 60 days in 2026.
- Childcare mandates that never passed. Claims that Texas, Illinois, or Indiana require daycare cameras all trace to failed bills. The first real mandate is Minnesota's 2025 law, effective July 2026, and it is conditional, not universal.
- Colorado casinos at 30 days. The current internal control minimum procedures say 15 days for critical gaming areas and 10 for the rest.
None of this means the requirements are lax. It means the citation matters more than the folklore, which is why every row above links to its text.
Floors, ceilings, and holds
Three different shapes of rule share this table, and mixing them up is expensive in both directions.
- Floors are the familiar case: keep at least this many days. Sizing storage below a floor is a violation waiting for an audit.
- Ceilings run the other way. Michigan psychiatric hospitals may keep archived surveillance at most 30 days, and California's state hospital enhanced treatment units must destroy recordings after 45. In those settings, keeping video longer is the violation.
- Holds sit on top of everything. Nearly every regulator in this table requires footage connected to an incident or investigation to be preserved past the baseline, sometimes dramatically so: New Mexico cannabis licensees keep incident footage 12 months, Pennsylvania's investigation hold runs 4 years, and tribal casinos copy incident recordings for at least a year. The baseline is a floor for routine footage, never a purge schedule you can automate blindly.
What changed recently
Enough of this table moved in the last two years that anything published before 2024 should be treated as suspect. Ohio's cannabis consolidation cut retention from 6 months to 45 days in late 2024. Rhode Island, Virginia, Oregon, and Washington all recodified or amended their cannabis rules across 2024 and 2025, and Illinois cut dispensary retention from 90 to 60 days effective June 2026. Colorado reissued its casino internal controls effective April 2026. The CJIS Security Policy moved to version 6.1 in June 2026, and FERC approved the next CIP-006 revision in March 2026 with identical 90 day log language, mandatory from mid 2028. Minnesota's childcare camera law takes effect July 2026, and Illinois extends nursing home monitoring rights to assisted living in January 2027.
The federal prison story is the one to watch. The Prison Camera Reform Act, signed at the end of 2022, ordered the Bureau of Prisons to eliminate blind spots, replace failed cameras, go digital, and store recordings so they remain available to investigators and courts. It set coverage and preservation duties rather than a day count, and implementation is far behind: the Bureau's own first annual report showed 12 of 121 institutions with completed digital camera systems as of February 2024, against a plan window that closed around March 2026. Oversight letters and inspector general reports are still landing, which makes federal detention the most likely place for new hard requirements to appear.
From days to terabytes
Retention days are half of a sizing problem. The other half is bitrate, and that depends on resolution, frame rate, codec, and how busy the scene is. Each row above with a day count links into the camera storage calculator with the retention pre-filled, so you can drop in your own camera mix and get array sizing, bandwidth, and drive counts for that requirement. The calculator's bitrate model and its assumptions are documented on the page itself.
Meeting a retention requirement across a real fleet
Every requirement in this table quietly assumes something nobody audits day to day: that the cameras were actually recording. A regulator who asks for day 27 of a 30 day window does not care that the recorder was sized correctly if the camera feeding it dropped offline for a week and nobody noticed. Retention compliance fails at the camera long before it fails at the archive.
MentatNOC watches whether every camera in the fleet is online, on time, and still recording what it was commissioned to record, and keeps the history that lets you show a gap never happened. It never stores or watches your video. See compliance and proof for the evidence side, or walk a live fleet in the interactive demo.
the other half of retention
The requirement is days of video. The risk is days of silence.
Recording gaps, dead cameras, and drifted settings are what turn a retention rule into a finding. MentatNOC catches them as they happen.