When I worked at google a few years ago, deleting user data was taken very seriously.

All user data carries a strong, first-class link to the userID, and all products/infra are required to have systems ensuring that when the user account is deleted, all linked data downstream of that is deleted from storage as well. For most products this is a works-by-default configuration -- the rows in your user table in Spanner have a tag indicating that it's a Gaia ID, and when that ID is deleted in the Gaia system, everything downstream gets automatically deleted.

There's some consideration to what happens in backups as well, but I'm hazy on the details.

It’s not worth the risk to lie about deleting in my experience.

Yes and no. Even in the GDPR there is a thin area left for cases where you have several layers of data being backed up and immediate deletion is technically difficult.

This is a problem we ran into when I worked at a regulared business a few years ago. From a GDPR point of view we had to physically delete the data but from a regluatory point of view we were obligated to retain information for 7 years.