@tanepiper gdpr states you can also just anonymize the data instead of deleting it. It's how every American company got around having to actually delete it. I've worked for two eLearning platforms and they both did the same thing. The EU was totally fine with it. We asked.