GDPR Compliance

LAST EDIT Jul 23 2024

Companies doing business in the European Union are bound by law to follow the General Data Protection Act. While most parts of this law don't have much impact on your integration with Stream Chat, the GDPR right to data access and right to erasure involve data stored and managed on Stream's servers.

Because of this, Stream provides a set of methods that make complying with those portions of the law easy.

The Right to Access Data


GDPR gives EU citizens the right to request access to their information and the right to have access to this information in a portable format. Stream Chat covers this requirement with the Export User method.

This method can only be used with server-side authentication.

The export will return all data about the user, including:

  • User ID

  • Messages

  • Reactions

  • Custom Data

Running a user export will return a JSON object like the following example.

Users with more than 10,000 messages will throw an error during the export process. The Stream Chat team is actively working on a workaround for this issue and it will be resolved soon.

The Right to Erasure


GDPR also gives EU citizens the right to request the deletion of their information. Stream Chat provides ways to delete users, channels, and messages depending on the use case.

There are two server-side functions which can be used: deleteUsers and deleteChannels. These allow you to delete up to 100 users or channels and optionally all of their messages in one API request.

  • To permanently delete a user and all of their data, use deleteUsers and set mark_messages_deleted, hard_delete, and delete_conversation_channels options to true.

  • To permanently delete a channel and all of its messages, use deleteChannels and set hard_delete to true.

For more information, and examples, see:

After deleting a user, the user will no longer be able to:

  • Connect to Stream Chat

  • Send or receive messages

  • Be displayed when querying users

  • Have messages stored in Stream Chat (depending on whether or not mark_messages_deleted is set to true or false)