> This is not lawful under both the GDPR and the CCPA. INAL, but from my understanding that's exactly what GDPR itself suggests to do: > The controller should

> This is not lawful under both the GDPR and the CCPA. INAL, but from my understanding that's exactly what GDPR itself suggests to do: > The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. Thats mainly because [2]: > There is a very real concern of fraudulent requests from bad actors, who might use a customer’s data for nefarious purposes. While it's great to know that noone else is able to delete my account, it still feels shady af. [1] https://eur-lex.europa.eu/eli/reg/2016/679/oj#d1e1374-1-1 https://eur-lex.europa.eu/eli/reg/2016/679/oj#d1e1374-1-1 [2] https://konfirmi.com/blog/gdpr-personal-data-id-verification-compliance/ https://konfirmi.com/blog/gdpr-personal-data-id-verification...