Doesn't GDPR require them to really delete?
"When the person visiting a website featuring Facebook’s tools is not a registered Facebook user, Facebook does not have information identifying that individual, and it does not create profiles for this individual.
...
We do not create profiles for non-Facebook users, nor do we use browser and app logs for non-Facebook users to show targeted ads from our advertisers to them or otherwise seek to personalize the content they see. However, we may take the opportunity to show a general ad that is unrelated to the attributes of the person or an ad encouraging the non-user to sign up for Facebook."
https://www.judiciary.senate.gov/meetings/facebook-social-me...
It's conceivable that Facebook could deanonymize users/aggregate the data they get from like buttons etc, but they claim that they don't use that data for ad targeting and it's only used for security.
> We do not create profiles for non-Facebook users
What is a "profile"? Is a shadow profile a profile? Not "creating a profile" may be very different from not tracking someone.
I'm extremely skeptical of that. When I downloaded my Facebook data, there was a "contacts.html" file that contained data scraped from my phone's contact list aggregated with other contact information that I'd never seen before for people I'd never been Facebook friends with. Some people on that list have never had Facebook accounts. While I don't know if they had extra data aggregated into their entry, the fact that their data was scraped from my phone shows Facebook has the data to create a profile for them.
I'm guessing their statements are only true if you read them very narrowly in a misleadingly specific way. For instance, by understanding "profile" to mean a "the Facebook Profile that comes with a Facebook account," rather than a more generic "collection of data about a person."