It's safe to assume Microsoft is GDPR compliant. There's no sense in risking the fines GDPR could potentially levy for the sake of ... what exactly? There's no upside even if this data was somehow de-anonymized. The sensible thing to do is to delete everything within 90 days. Even if the developers behind VS Code didn't agree with that, legal and privacy at MS would make sure they would.
All this talk about how this data can be used to target people seems far fetched. Microsoft doesn’t have a serious ads business. What they do have are various products and services to sell to developers - Github and Azure among them. That’s the whole point of VSCode - give it away for free so they can understand developer practices and also upsell paid products. And if anyone doesn’t like that, they can simply … not pay Microsoft any money.