> There should be a simple law: the mechanism for deletion of any user data must be no more complex than its creation. That's one of the nice points of GDPR, a

> There should be a simple law: the mechanism for deletion of any user data must be no more complex than its creation. That's one of the nice points of GDPR, albeit around withdrawal of consent. It must be "as easy to withdraw as to give consent". That prevents the "call or fax us to cancel consent, but give it via a single tick-box on sign-up that you can never change". Deletion is a right under GDPR; although there's no specification it must be as simple as to create (as at very least you likely want some kind of simple confirmation before losing something).