I'm not saying that systems are not in place, I'm just saying that it's too hard for the average consumer.

- After you've requested deletion the company has 30 days to "respond" but they can extend that with two additional months. - They can go to extreme lengths to verify the identity of the user which they have the right to do so and if you don't respond to the confirmation they are not obligated to delete anything.

I've encountered both practices in the past (and I've only made 3 requests, ever).

The dream would have been an automated way to do it, something like a government service where each company would have to publish metadata about captured user data and once you request deletion through the service the company would receive an event, a webhook call...