These constraints are walked back almost immediately in practice, once companies learn that requiring a human touch for a deletion flow is not worth the hassle.
I think "legal" here meant what's the bare minimum to respect the letter of GDPR law, while not actually implementing a useful delete flow.
Appreciate the honesty here by admitting that account deletion relies on dark patterns, but it brings up two salient questions regarding how you approach product development.
1. Internally, do you at least have the equivalent of a “directly responsible individual" (DRI) for the product? It seems no one spoke up in the interests of users against legal’s overzealous decision to tack on lots of friction to the account deletion process?
2. It seems you could have also garnered some push back on the feature from your alumni Slack [0] but didn’t, perhaps due to the rush to ship quickly?
In addition to the changes you’ve pledged as part of rebuilding user trust, hopefully, you & your team will reassess your product development practices to add these checks so that such mistakes are not repeated in future.
[0] @hysan mentions that TB maintains an alumni Slack upthread: https://news.ycombinator.com/item?id=23304199