People keep bitching about EU's GDPR but most of it is about sensible things like not storing sensitive data forever just because you can.

Nothing happens to these companies if there are no laws to keep them accountable, most companies I've worked with store everything forever because it's cheap and you never know what might become useful or what you might be able to sell to third parties later