How would you handle a user ceasing their account and asking you to remove data you no longer need to provide them with service?

Under GDPR you'd be required to really delete that. Obviously GDPR laws don't hold everywhere but are you saying you'd just hold the user's data forever or that you'd have a later clean up process or something?

You wouldn't. GDPR didn't exist. That was my point. We've been doing this for ages and only recently had to worry about actually deleting stuff.

This is why I've never advocated "deleting" Facebook accounts etc. If you "delete" it you're just giving them another piece of information about you. Namely that you want your account to be deleted.

The GDPR has not yet been shown to have any teeth, so I assume nothing has really changed in this respect.

And, yes, holding users' data forever is normal. Storage cost has only decreased relative to the size of these databases. I've worked in places with customer data going back decades.