This shouldn't be a discussion. I can't think of a single non-toy database that actually deletes data when you press DELETE. All the LSM databases (pretty much anything using Facebook's RocksDB) doesn't actually remove data until a compaction event - and MySql/Postgres don't actually delete data until you a VACUUM occurs. (then there's whole minefield of did the OS actually remove the data, or did the filesystem just mark the affected area as deleted, but didn't scrub the bits). Then theres the backups - FB may have a ton of backups in cold storage that may have your data that wasn't removed.
The conversation about "FB simply marks the data in their database as deleted or whether it is actually removed." is unfruitful. The answer is "no" for almost every company on the planet, not just FB.
FWIW, a large portion of cleanup happens on access. If the entire page will not be accessed until the next VACUUM that doesn't change anything, but in OLTP workloads that space will often be reclaimed much earlier.
Doesn't change anything about your larger point though.
But other than that: if technology gets in the way what people and the law demand, it's technology that needs to change, not people.
Now as for backups, this is much harder. I don't know how reasonable it is to ask them to discard backups in cold storage - seems like a compliance nightmare that would absolutely punish smaller players that can't build infrastructure to do that.
Is it really reasonable for an active site to keep backups older than a couple of months? A year?