I run a pretty locked down Firefox browser and I noticed when browsing lemmy.world that the browser wants to pull stuff from a long list of other instances, which fails because they aren’t trusted. Is this normal? I thought an instance would collect the things you are subscribed to and store them locally so that you didn’t have to go talk to 20 different servers. Not true?
Sure but there is nothing stopping an instance owner from configuring the local database to not delete, or to have a copy of the database mirrored to some other database.
So while most instances will delete, it’s fair to say that if someone wants to keep a copy of all messages somewhere, it’s simple to accomplish that.
What I would do is simply to listen to the activitypub port, and send all raw incoming messages somewhere and store them forever.
Sure, it’s not hard to not comply with GDPR. I was speaking from the perspective of a small instance admin who would like to generally comply without having to think about.