Spanish DPA Upholds Erasure Complaint Against ByteDance Over CapCut Account Deletion Barriers

Key Takeaways

• The AEPD upheld a data subject's GDPR Article 17 complaint against ByteDance Pte.
• Ltd.
• after the company allegedly required a user to log in and accept new CapCut terms before it would process an erasure request.
• The decision shows that regulators will scrutinize identity verification steps that effectively block rights requests.

Deep Dive

What happened.** The complainant asked ByteDance by email to delete their CapCut data. ByteDance reportedly told the user to submit the request from within the account, or to email a screenshot of the account ID, which is visible only after logging in. Logging in would have required accepting revised terms of use, which the user refused to do. The complaint was filed on August 26, 2025 and admitted for processing on November 26, 2025. The AEPD's notifications to ByteDance were returned as undeliverable, and a resend on April 14, 2026 has no record of receipt. ByteDance therefore never responded.

**Outcome and legal basis.** Under Article 64.1 of the LOPDGDD, the six-month resolution period for rights procedures expired on May 26, 2026 without a decision, so the claim was deemed upheld through administrative silence. The AEPD then issued a confirmatory resolution under Article 24.3 of the LPACAP. ByteDance has ten working days from the date the resolution becomes final and enforceable to send the claimant a certificate either confirming erasure or denying it with reasons. It must also report its actions to the AEPD within the same period. The resolution is open to an optional reconsideration appeal (one month) or a contentious-administrative appeal before the National High Court (two months). It will be published. This resolution carries no fine, but it sets out corrective measures under Article 58.2 of the GDPR.

**Compliance implications.** Controllers must facilitate the exercise of data subject rights (Article 12 GDPR) and respond within one month. The burden of proving compliance rests with the controller. Verification mechanisms must be proportionate. Requiring account access or information obtainable only by logging in, particularly when access is conditioned on accepting new terms, can effectively obstruct a request. The case also highlights the duty to cooperate with supervisory authorities (Article 31 GDPR). Outdated registered addresses, or the absence of an effective EU contact point, can lead to default outcomes and reputational harm.

**Recommended actions.** - Review erasure and other rights request workflows for dependence on logged-in access, and provide alternative verification methods such as email confirmation or reasonable identity checks. - Make sure that rights requests can be processed independently of acceptance of updated terms or consent flows. - Confirm that EU representative and registered contact details are current, and that regulatory correspondence is monitored and escalated, with a documented response within the one-month transfer period. - Keep audit trails to demonstrate that each request was handled within deadlines and that any denial gave reasons. - Train privacy and customer support teams on Articles 12 and 17 requirements.

**Risk impact.** Direct exposure here is limited to corrective orders, but the same failures could support fines under Article 83 GDPR if repeated or found systemic. There is also reputational risk from public disclosure of the resolution. Consumer-facing digital platforms with large user bases face the highest risk.

Source: Spanish Data Protection Agency (Agencia Española de Protección de Datos)