Account deletion requirements on the web
What the web expects when a user wants their account and data gone, and the page most submissions forget.
What is actually required
On the web the rule is simply the law: a person can ask you to delete their data, and you have to be able to do it and to say what survives and why.
What the page has to say
- Which account the request is about and how someone starts it.
- What gets deleted, and how quickly.
- What is kept anyway, and the reason: invoices for tax law, logs for security, backups until they rotate.
- How long that retention lasts, in a number rather than "as required".
- An address for someone who cannot use the route for any reason.
Keeping it true after launch
A legal page stops being true the moment the product moves past it, usually by adding a payment provider, an analytics SDK or a sign-in. No store re-checks your pages against your build, so the drift is yours to notice.
- Re-read it whenever you add a dependency that sees user data.
- Re-check what loads on the page after any change: the cookie notice and the policy have to agree.
- Keep the URL stable. Changing where a policy lives breaks every listing that points at it.
Common questions
Can I keep anything after a deletion request?
Yes, where another law requires it. Invoices are the usual example. What you cannot do is keep it quietly: the page has to name what survives, why, and for how long.
Does an email address count as a deletion route?
It can, on the web, as long as someone who writes to it actually gets their data deleted and is told when it is done.