> I can't go to my school or a credit bureau or an insurance company and say that all my past history should be forgotten. Why should we enforce such a regulation online?
GDPR makes no difference between online and offline businesses: They can keep data if they have a proper justification for it.
https://gdpr-info.eu/art-6-gdpr/ is the core list of reasons for data processing, any company needs to justify its data usage based on them. (Case a., consent, is a bit special, other articles put clear limitations on it so it isn't abused, make it revocable, ...)
GDPR makes no difference between online and offline businesses: They can keep data if they have a proper justification for it.