Hacker News Reader

It doesn’t have to be stored on a server that is publicly reachable, however.

> AFAIK (IANAL)

I see what you did there.

That makes me think that in order to obey the law in California, you'd be breaking European law (ie. GDPR)

I don't think GDPR covers people who have an actual written and signed financial contract with the service in question. How could any business function without the information needed on who to pay?

Keeping data which you are legally required to keep is certainly allowed by the GDPR.

Although it wouldn't be surprising to have two (or more) laws contradict each other.

Especially if that was a way to "accidentally" kill an objectionable industry.

GDPR has explicit provisions for "keep what you're legally required to keep".