Expiration helps very little if the valid IDs are still easily enumerable. Access control, not expiration, is what is called for here.

Edit: expiration would limit the scope of data leakage, and should also be looked into, but expiration without access controls still allows patient attackers to collect all of the data being generated and store it for future use.