There are exceptions. For example I can't remove your name, address, IP address and other data if my tax authority requires them for VAT identification (if you bought something from me).

It seems like they could have been compliant with both by not logging in the first place.

Given the choice between not logging chats or violating either EU or US law, it seems pretty clear what the vibe is in OpenAI and the valley these days. (no expert on GDPR as applicable to this order either, though)