It is still just a “trust us” deal. They say they have deleted it, and all you can do is trust them. They could possibly get into legal troubles if it was shown they were lying, but that could be easily avoided as well.
GDPR is ok, but much of it is based on good actors doing what they should.