throwaway_tech7

Pretty much exactly this, but also:

I work at a company you've heard of, and you've probably (P > .5) used at least one of our products. We're international (including EU). I personally wrote our user data deletion logic for GDPR compliance.

We delete all of your PII. It doesn't matter if you're from the EU or not, because it's too expensive to figure it out and too risky because you're going to miss some weird edge case - Legal doesn't have much of a sense of humor when it comes to wiggle room.

My experience has been that larger organizations consistently spend more effort (relative to size) to genuinely comply with privacy regulations than smaller ones. The risk:reward ratio for deliberately ignoring or subverting privacy regulations is insanely bad. There are too many surfaces along which that would leak out, and the gains would be pretty marginal. Pretty much anyone who works at a large tech company can and will confirm that this is the case (see Jeff Kaufman's posts on this thread). There is no conspiracy between the six-digit number of engineers who work at these companies to keep quiet about it.