It's at least six months, and they don't do a very good job of anonymizing: they scrub the last two digits of the IP, but not tracking cookie logs. DataLiberation further contains no information they keep when you are not logged in, and only a fraction of what they have (and keep) when you are logged in. The "privacy dashboard" points to several chunks of data that are retained but not accessible, and there is far more that actually is kept.
A simple but perhaps inconvenient way to verify this is to be criminally prosecuted for something where your Google account is relevant. Google will hand over what they have to the prosecution, and as the defendant, you'll be entitled to see the evidence. (I've not tried this and don't recommend it, but do know someone that this happened to, and have examined the contents of the provided CD.)
DataLiberation is mostly a PR site, and it's main use is migrating what data Google feels is useful to you, not finding out what Google knows.
A simple but perhaps inconvenient way to verify this is to be criminally prosecuted for something where your Google account is relevant. Google will hand over what they have to the prosecution, and as the defendant, you'll be entitled to see the evidence. (I've not tried this and don't recommend it, but do know someone that this happened to, and have examined the contents of the provided CD.)
DataLiberation is mostly a PR site, and it's main use is migrating what data Google feels is useful to you, not finding out what Google knows.