I thought GDPR was my shield. I was wrong.
It started with a simple request: I wanted to delete years of Discord messages. I’d left the server, but my data was still there, and I wanted it gone. So I filed a GDPR Article 17 erasure request. That’s the one that says you have the right to be forgotten, right?
What followed was a bureaucratic nightmare. After a long email battle, Discord offered to delete my messages—but only if I provided them with the exact message IDs. From my data export. You know, the export they give you to “comply” with transparency requirements.
I stared at the 1.5 GB zip file. Somewhere in there were millions of messages. I was supposed to manually find the ones I wanted deleted, copy their IDs, and send them back. That’s not deletion. That’s a scavenger hunt.
I realized I was being played. The system was designed to make deletion so tedious that only the most stubborn (or technically capable) would actually follow through. The law gives you the right to delete. The platform gives you the runaround.
So I wrote a script. I called it discord-delete. It takes your Discord data export, unpacks it, and bulk-deletes all your messages using the API. It’s open source, it’s free, and it works. I built it because I had to—the official process was a dead end.
But here’s the thing: I’m a developer. I can write a Python script in an afternoon. Most people can’t. And that’s the real scandal. If you can’t run a Python script, your data is effectively eternal.
GDPR was supposed to empower everyone. Instead, it’s become a tax on technical literacy. The platforms comply on paper—they offer a deletion mechanism—but make it so painful that only the privileged few can actually exercise their rights. The rest are left with the illusion of control.
I shared my tool on Hacker News, and the response was immediate. People told me they’d been stuck in the same loop. Emails, denials, workarounds. One user said, “I spent two months going back and forth with Discord. I finally gave up.” He didn’t give up because he didn’t care. He gave up because the system is rigged.
This isn’t just about Discord. It’s the same story with Google, Facebook, Twitter—every platform that hoards your data. They’ll give you a data export, sure. But try to delete everything. See how far you get.
We need to stop pretending that privacy laws are working. They’re not. They’re a smokescreen designed to make us feel protected while the platforms keep the real power. Your data is yours only if you’re willing to fight for it. Or code for it.
So I built a tool. But I’m not the solution. The solution is a law that actually works—one that doesn’t require a GitHub account to exercise your rights. Until then, if you want your data deleted, you have two options: learn to code, or find someone who can. That’s not privacy. That’s a privilege.
FAQ
Q: Doesn't GDPR already force companies to delete your data on request?
A: In theory, yes. In practice, companies like Discord comply by offering a process that is so burdensome it effectively blocks most users. They'll ask for message IDs, make you jump through hoops, or just ignore the request. The law is only as strong as its enforcement.
Q: So what's the practical takeaway for someone who wants their data deleted?
A: Don't rely on the official process. Use tools like discord-delete or similar scripts that automate the deletion via the platform's own API. Be prepared to invest some technical effort, or find a developer who can help. The system is not designed to help you.
Q: Is this an argument against privacy laws?
A: No—it's an argument for better enforcement. GDPR is a good start, but it fails because companies are allowed to define what 'reasonable effort' means. Until regulators require that deletion be as easy as sign-up, the burden will always fall on the user. The contrarian take: maybe the real solution is to stop trusting platforms altogether and self-host.