> ## Documentation Index
> Fetch the complete documentation index at: https://docs.theauth.dev/llms.txt
> Use this file to discover all available pages before exploring further.
# GDPR data rights
> Data export, account deletion, and account anonymization endpoints that support GDPR data subject requests.
theAuth includes built-in tools for three data subject requests that commonly require custom code: exporting a user's data, deleting their account on request, and anonymizing their account. Deleting an account can also anonymize the user's audit rows.
These tools cover part of the technical layer and do not make a deployment compliant by themselves. Your privacy policy, data processing agreements, and response timelines are your responsibility.
## Setup
The `gdpr` plugin takes no options. It registers three self-service endpoints scoped to the authenticated user. The user is resolved through the same mechanism as other plugin endpoints (your configured auth adapter or session); unauthenticated requests get a 401.
```typescript title="lib/theauth.ts" theme={"dark"}
import { createTheAuth } from '@glinr/theauth';
import { gdpr } from '@glinr/theauth/auth'; // [!code highlight]
const theauth = await createTheAuth({
database: { provider: 'postgres', url: process.env.DATABASE_URL! },
agents: { enabled: true },
plugins: [
gdpr(), // [!code highlight]
],
});
```
## Export user data
`GET /auth/gdpr/export`
Returns a JSON bundle covering the authenticated user's profile, agents, sessions, audit events, delegations, organization memberships, and API keys (GDPR Article 20). It is not a dump of every table: it omits, for example, TOTP records, passkeys, OAuth tokens, approval requests, and budget policies, and each section contains a few summary fields only (API keys: id, name, createdAt; sessions: id and timestamps). Audit events and delegations are only included if the user owns at least one agent.
```typescript title="Request export (client)" theme={"dark"}
const res = await fetch('/auth/gdpr/export', {
method: 'GET',
credentials: 'include',
});
const data = await res.json();
// data.user, data.agents, data.sessions, data.auditLogs, data.delegations, data.organizations, data.apiKeys, data.exportedAt
```
## Delete account
`DELETE /auth/gdpr/delete`
Deletes the user account and associated data (GDPR Article 17). Requires an explicit confirmation string in the request body:
```typescript title="Delete account (client)" theme={"dark"}
const res = await fetch('/auth/gdpr/delete', {
method: 'DELETE',
credentials: 'include',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
confirm: 'delete my account', // literal string, required // [!code highlight]
keepAuditLogs: true, // default: true, anonymizes rather than deletes audit rows // [!code highlight]
deleteOrganizations: false, // default: false, removes memberships but leaves owned orgs // [!code highlight]
}),
});
const { success, deletedAgents, deletedSessions, deletedDelegations, deletedApiKeys, anonymizedAuditLogs } =
await res.json();
```
What the delete does, in order: revokes the user's agents; deletes sessions, delegation chains involving those agents, and API keys; anonymizes the audit rows of those agents (or deletes the rows of this user when `keepAuditLogs` is `false`); deletes approval requests, budget policies, OAuth tokens and codes, magic links, email OTPs, TOTP records, passkeys, and org memberships; optionally deletes owned organizations; then deletes the user row. Note that with `keepAuditLogs: true` the agent rows are kept with status `revoked` (so `deletedAgents` counts agents revoked, not rows removed), and they still carry their name and metadata. With `keepAuditLogs: false` the agent rows are deleted.
The module toggles `PRAGMA foreign_keys` while deleting and anonymizing audit rows. That statement is SQLite syntax, so on Postgres or MySQL the `keepAuditLogs: true` path and the final user deletion will fail with a database error unless the statement is accepted by your driver. Test deletion against your production database engine before relying on it.
Deletion is irreversible. Any app data you store outside theAuth that references the user ID will become orphaned, the plugin has no `onBeforeDelete` hook, cascade those deletes yourself before calling this endpoint.
## Anonymize account
`POST /auth/gdpr/anonymize`
Replaces the email with a deterministic anonymous value (`deleted-@anon.invalid`) and clears name, external ID, and metadata, while keeping the account row, agents, and audit history. It also deletes the user's TOTP records and passkeys. It does not revoke sessions, and it does not touch audit rows (those still reference the same user ID). Use this instead of deletion when org membership or audit referential integrity must be preserved.
```typescript title="Anonymize account (client)" theme={"dark"}
const res = await fetch('/auth/gdpr/anonymize', {
method: 'POST',
credentials: 'include',
});
const { success } = await res.json();
```
## Using the module directly
The plugin wraps `createGdprModule`, which you can also call directly (for background jobs, admin tooling, or CLI scripts) without going through the HTTP endpoints:
```typescript theme={"dark"}
import { createGdprModule } from '@glinr/theauth/auth';
const gdprModule = createGdprModule(theauth.db);
const exportData = await gdprModule.exportUserData(userId);
const result = await gdprModule.deleteUser(userId, { keepAuditLogs: true });
await gdprModule.anonymizeUser(userId);
```
## Related
Framework mapping and evidence export (JSON, CSV, verifiable credentials).
The audit log that GDPR anonymization targets.
Lifecycle hooks for authorization and agent events. There is no account deletion hook.
Session revocation that runs as part of account deletion.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.