Keep in mind that software doesn’t have an expiry date. If a piece of software is unmaintained and doesn’t have an active fork but it still fulfills your use case and doesn’t have any major issues, there’s no need to replace it. Some of the software I use hasn’t seen any updates in five years but I still use it because it still works.
Edit: As an example, a lot of people still use WinDirStat even though the latest release 1.1.2 is now 17 years old.
Not sure how that’s relevant, but some states do have an equivalent to GDPR. California has CCPA for example.