Account deletion confirmed with cooling-off period

Instant, irreversible account deletion with a single confirmation click is a UX failure that creates real harm — users can accidentally delete years of content, and phishing attacks can trick users into triggering deletion. GDPR Art. 17 does not require immediate deletion; a grace period is both compliant and protective. Without a cooling-off window and email confirmation, there is no mechanism to detect unauthorized deletion requests (e.g., from a stolen session token) before the damage is permanent.

Schedule deletion rather than executing it immediately. Create a deletion_requests table, send a confirmation email, and run the actual erasure only after the grace period expires. In src/app/api/account/delete/route.ts:

async function initiateAccountDeletion(userId: string, userEmail: string) {
  const scheduledFor = new Date();
  scheduledFor.setDate(scheduledFor.getDate() + 30); // 30-day grace

  const request = await db.deletionRequest.create({
    data: { userId, status: 'pending', scheduledFor, confirmationToken: generateToken() }
  });

  await sendEmail({
    to: userEmail,
    subject: 'Confirm account deletion',
    body: `Your account is scheduled for deletion on ${scheduledFor.toDateString()}. Cancel here: ${baseUrl}/account/deletion-cancel?token=${request.confirmationToken}`
  });

  return request;
}

Run a daily cron job that processes deletionRequests where scheduledFor < NOW() and status = 'confirmed', then invokes the full erasure logic.