Spanish DPA Upholds Erasure Complaint Against ByteDance Over CapCut Account Deletion Barriers
The AEPD upheld a data subject's GDPR Article 17 complaint against ByteDance Pte. Ltd. after the company allegedly required a user to log in and accept new CapCut terms before it would process an erasure request. The decision shows that regulators will scrutinize identity verification steps that effectively block rights requests. It also shows that a controller's failure to engage with the regulator can lead to an adverse outcome by default.

