Depending on context (GDPR, CCPA, etc) there are legal reasons to actually delete data when your users request to rather than simply mark the data as "deleted".

Depending on context (GDPR, CCPA, etc) there are legal reasons to actually delete data when your users request to rather than simply mark the data as "deleted". I understand OP's "I would not make any assumptions about implementation details to which I have no access." approach. That said though, I wouldn't expect any sort of "investigation", so my approach would probably be the same as most: "meh, delete it, change my password, revoke tokens and move on".