Skip to main content
TrackLayer
Start free
Menu
Language
Theme
Currency
Start free
TrackLayer
Menu
Language
Theme
Currency
← /security overview
TRACKLAYER · COMPLIANCE

Right-to-be-forgotten —
cross-platform. Server-side.

When a merchant gets a GDPR deletion request, TrackLayer deletes the user's events from the warehouse AND propagates the deletion to Meta CAPI delete, Google offline-conversion delete, TikTok PII removal, and Klaviyo profile suppress. Major compliance differentiator.
THE PROBLEM
  • ▸ GDPR Art. 17 gives individuals the right to erasure of their personal data without undue delay
  • ▸ Deleting from your warehouse is only half the story — the user's data lives in ad platforms too
  • ▸ Manual platform-by-platform deletion is brittle: missed endpoints, broken tokens, incomplete suppression
  • ▸ Enterprise customers demand a verifiable RTBF cascade — not just a warehouse delete

Most server-side tracking tools don't touch RTBF. They delete from the warehouse and call it done. TrackLayer completes the loop — warehouse deletion plus platform-side erasure, all tracked in a single job.

$ tracklayer rtbf delete
// rtbf_jobs · cross-platform deletion cascade
rtbf_8f3a2c1
user_id: cust_abc123
request_type: GDPR Art. 17
status: IN_PROGRESS
platform_cascade:
✓ meta_capi_delete // 200 OK
✓ google_offline_delete // 200 OK
✓ tiktok_pii_remove // 200 OK
✓ klaviyo_profile_suppress // 200 OK
▸ All platforms processed. Job marked COMPLETE at 2026-04-23T14:02:11Z. SLA: 30 days from request (GDPR).
§ 01

How TrackLayer solves cross-platform RTBF.

Per-merchant RTBF queue, worker, and jobs table. Deletion fans out to 4 platforms with full audit trail.
§ 01
Ingest RTBF request
POST /v1/rtbf/create stores request in rtbf_jobs with user identifiers, request_type (GDPR/CCPA), and request_date.
§ 02
Queue for worker
tracklayer-rtbf queue routes to tracklayer-rtbf-consumer worker.
§ 03
Platform cascade
Worker fans out deletion to Meta CAPI delete, Google Customer Match suppression, TikTok PII removal, Klaviyo profile suppress.
§ 04
Audit trail emission
Every RTBF action emits to audit_events with hash chain (Phase 6.4 + 9.3). Full end-to-end auditability.
§ 05
SLA tracking
30-day SLA (GDPR) tracked per-job. rtbf_jobs.completed_at marks completion time.
// rtbf_jobs · queue table schema
job_id   | merchant_id | user_id            | request_type | status    | requested_at       | completed_at       | platform_status
----------+------------+--------------------+--------------+-------------+-----------+-------------------+-------------------+------------------
rtbf_8f3 | m_abc123    | cust_abc123         | GDPR Art. 17 | COMPLETE  | 2026-04-23 14:01  | 2026-04-23 14:45  | {meta:ok,google:ok,tiktok:ok,klaviyo:ok}
§ 02

Platform deletion endpoints.

TrackLayer calls platform-specific APIs to enforce user erasure. Each platform has its own deletion flow — TrackLayer maps identifiers correctly.
META CAPI DELETE
POST /{graph_api_version}/{graph_id}/events

event: DELETE_FB_ADVANCED_EVENT matching user email/phone. Returns event ID for proof.

PHASE 5.9
Requires system user token. Batch deletes up to 1000 user IDs per request.
GOOGLE OFFLINE CONVERSIONS
Customer Match API · suppress

flow: Upload suppression list (hashed email/phone). Remove from Customer Match. Customer Match API removes from Google Ads automatically.

PHASE 5.9
24-hour processing delay. Upload via OAuth2 service account.
TIKTOK PII REMOVAL
POST /pixel/v1/track/identify/remove_pii

flow: Remove PII from TikTok user profiles using email or phone. Accepts hashed identifiers.

PHASE 5.9
TikTok-specific PII removal endpoint. No bulk API — processes sequentially.
KLAVIYO PROFILE SUPPRESS
POST /api/profile-suppress

flow: Suppress user profiles in Klaviyo by email or phone. Email remains in system but receives no marketing.

PHASE 5.9
Klaviyo Enterprise API. Suppress action irreversible — requires re-opt-in to restore.
§ 03

Audit trail integration.

Every RTBF action is emitted to audit_events with hash chain. Full end-to-end auditability for compliance audits.
WHY AUDIT INTEGRATION MATTERS
  • ▸ Enterprise auditors demand proof that RTBF was actually executed across platforms
  • ▸ Hash chain prevents retroactive edits to RTBF records
  • ▸ Audit trail links rtbf_jobs to audit_events — full traceability
  • ▸ Dashboard view shows RTBF timeline with platform response status
// audit_events · rtbf deletion entry
event_id     | event_type   | resource_id   | actor     | payload
-------------+--------------+---------------+------------+-----------+----------
ae_rtbf_8f3c1 | rtbf_delete | rtbf_8f3a2c1 | system_worker | {
  "merchant_id": "m_abc123",
  "user_id": "cust_abc123",
  "request_type": "GDPR Art. 17",
  "platform_cascade": {
    "meta_capi_delete": {"status": "success", "event_id": "evt_meta_123"},
    "google_offline_delete": {"status": "success"},
    "tiktok_pii_remove": {"status": "success"},
    "klaviyo_profile_suppress": {"status": "success"}
  },
  "completed_at": "2026-04-23T14:45:11Z",
  "sla_met": true
}
§ 04

30-day SLA and compliance tracking.

GDPR requires deletion within 30 days. TrackLayer tracks SLA compliance per job and surfaces SLA breaches in insights.
SLA FRAMEWORK
  • ▸ GDPR Art. 17: Response without undue delay. Court interpretation: 30 days maximum.
  • ▸ CCPA: 45-day deletion requirement (California Consumer Privacy Act).
  • ▸ Quebec Law 25: 30-day deletion requirement.
  • ▸ LGPD: 30-day deletion requirement (Brazil).
// rtbf_jobs · SLA tracking
job_id       | status      | requested_at       | completed_at       | days_elapsed | sla_met | sla_days_allowed
-------------+------------+-------------------+-------------------+--------------+-----------+-----------------
rtbf_8f3a2c | COMPLETE   | 2026-04-23 14:01 | 2026-04-23 14:45 | 0.30         | true      | 30 (GDPR)
rtbf_9b4e3d | COMPLETE   | 2026-04-15 09:23 | 2026-05-12 10:14 | 27.30        | true      | 30 (GDPR)
rtbf_1c5f8a7 | COMPLETE   | 2026-04-01 11:47 | 2026-04-28 15:32 | 26.96        | false     | 30 (GDPR)
              // sla_met false triggers insight "rtbf_sla_breach" (Phase 6.3 insights detector)
// HOW IT COMPARES

Other tools vs TrackLayer RTBF Propagation.

CAPABILITYTRACKLAYERStapeElevar
Warehouse deletion•••
Meta CAPI delete•——
Google Customer Match delete•——
TikTok PII removal•——
Klaviyo profile suppress•——
Per-job audit trail•——
30-day SLA tracking•——
SLA breach insights•——
TRACKLAYER
Warehouse deletion
•
Meta CAPI delete
•
Google Customer Match delete
•
TikTok PII removal
•
Klaviyo profile suppress
•
Per-job audit trail
•
30-day SLA tracking
•
SLA breach insights
•
Stape
Warehouse deletion
•
Meta CAPI delete
—
Google Customer Match delete
—
TikTok PII removal
—
Klaviyo profile suppress
—
Per-job audit trail
—
30-day SLA tracking
—
SLA breach insights
—
Elevar
Warehouse deletion
•
Meta CAPI delete
—
Google Customer Match delete
—
TikTok PII removal
—
Klaviyo profile suppress
—
Per-job audit trail
—
30-day SLA tracking
—
SLA breach insights
—
// AVAILABLE ON

Pro+ and Enterprise.

RTBF propagation is part of the Pro+ tier ($599/mo). Enterprise adds SLA breach alerts, custom retry policies, and dedicated compliance audit support.
PRO+ · $599/moENTERPRISE · custom
§ A

Warehouse deletion

Delete user events from events and profiles tables.

§ B

Platform cascade

Meta, Google, TikTok, Klaviyo deletion APIs.

§ C

Audit trail

Hash-chained RTBF events linked to rtbf_jobs.

§ D

SLA tracking

30-day compliance per job. Insights alerts.

NEXT

Complete your RTBF loop.
Audit the cascade.

14-day free trial on the Pro+ plan. RTBF propagation runs from your first deletion request. No credit card.
START FREE TRIAL →TALK TO COMPLIANCE
PRO+ · $599/MO · 14-DAY TRIAL · NO CC · CANCEL ANYTIME
// RELATED

Other compliance & security features.

§ 01
Tamper-Evident Audit Log
SHA-256 hash chain. Verify integrity in one click.
§ 02
EU/US Data Residency
Choose where events are processed. Regional queues.
§ 03
Consent Firewall
Jurisdiction-aware delivery. IAB TCF v2.2 support.
Product
Compare
Resources
Company
Server-side CAPI · 24 platforms · AI-native
Operationalv0.1.0
© 2026 TrackLayer · Built for the technically rigorous.

We use essential cookies to keep the site secure and functional. Analytics and third-party tags run only with your consent. See our Cookie Policy.

We use essential cookies to keep the site secure and functional. Analytics and third-party tags run only with your consent. See our Cookie Policy.