The difference is that meta is providing that service world wide. Depending on where the user is located, there are a ton of considerations to be made when deleting a user. The flow should go through all these things before being deleted.
- some countries require saving "the last known address"
- others require keeping logs about "the last known connection point" (IP)
- in some countries, if the user was a paying user, you need to retain payment details / invoices / etc for years
- some countries you can receive subpoenas that mandate what data should be retained
All these things need to be checked before deleting an account. Having a "manual" deletion endpoint would be more troubling.
As an aside, early in the GDPA implementation phase, there was coverage of many companies implementing it poorly at best. There are articles detailing how you could delete a user's account by sending the "required info" (e-mail, ssn) from another e-mail and they'd delete the account / send over data. Would you be comfortable with someone being able to delete your account like that?
- some countries require saving "the last known address"
- others require keeping logs about "the last known connection point" (IP)
- in some countries, if the user was a paying user, you need to retain payment details / invoices / etc for years
- some countries you can receive subpoenas that mandate what data should be retained
All these things need to be checked before deleting an account. Having a "manual" deletion endpoint would be more troubling.
As an aside, early in the GDPA implementation phase, there was coverage of many companies implementing it poorly at best. There are articles detailing how you could delete a user's account by sending the "required info" (e-mail, ssn) from another e-mail and they'd delete the account / send over data. Would you be comfortable with someone being able to delete your account like that?