/.well-known/delete-account
/.well-known/request-user-data
Isn't this mandated to be present and accessible by the GDPR anyway?
Ultimately, not having a clear and easy policy for cancelling the service and deleting the account only happens when the company is malicious, and attempts to exploit the user. Having this visible plain as day is something I'd love.
In fact, someone could write a browser plugin to put a screen between the user and the website that states "This website fails to implement .well-known link. Are you sure you want to continue?" like Chrome does for sites that have borked DNS. If a reasonably large number of people used that you'd see lots of sites implement this idea without needing regulations. I'd use that.
You could have that plugin have a database of sites and also provide easy links for those sites that try to hide those functions.
We are a non profit, and don't run from user donations.
It's a pretty cool spec and we use it in my day job (Okta) but it's not widely implemented. If a few major providers - like Google, Microsoft, Github, Wordpress, etc - implemented it, I think it'd explode.
And regarding more legislation, no thanks.