Its not. Especially when using US Cloud services. And people do that. Hell even government run schools us GDRP-violating software and force the students to BUY them. The law is nice, the reality is different...

It doesn't need to. Those recordings are "radioactive" and can't be used in any legitimate fashion except by intelligence agencies.