GDPR Compliance

Companies doing business in the European Union are bound by law to follow the General Data Protection Act. While most parts of this law don't have much impact on your integration with Stream Chat, the GDPR right to data access and right to erasure involve data stored and managed on Stream's servers.

Because of this, Stream provides a set of methods that make complying with those portions of the law easy.

The Right to Access Data

GDPR gives EU citizens the right to request access to their information and the right to have access to this information in a portable format. Stream Chat covers this requirement with the Export Users method.

This method can only be used with server-side authentication.

const response = await serverClient.exportUsers({
  user_ids: [userID],
});
const taskID = response.task_id;

response = client.export_users(user_ids=[user_id])

task_id = response.data.task_id

require 'getstream_ruby'
Models = GetStream::Generated::Models

response = client.common.export_users(Models::ExportUsersRequest.new(
  user_ids: [user_id]
))

task_id = response.task_id

$response = $client->exportUsers(new Models\ExportUsersRequest(
    userIds: [$userId],
));

$taskId = $response->getData()->taskID;

response, err := client.ExportUsers(ctx, &getstream.ExportUsersRequest{
  UserIds: []string{userID},
})

taskId := response.Data.TaskID

var exportResponse = await client.ExportUsersAsync(new ExportUsersRequest
{
    UserIds = new List<string> { userId },
});
var taskId = exportResponse.Data.TaskID;

var response = client.exportUsers(ExportUsersRequest.builder()
    .userIds(List.of(userId))
    .build()).execute().getData();

var taskId = response.getTaskID();

The export runs asynchronously and returns a task ID. Poll the task until its status is completed to obtain a URL for downloading the exported data in line-separated JSON format. Each user's export contains their profile, messages, reactions, calls, and custom data.

The Right to Erasure

GDPR also gives EU citizens the right to request the deletion of their information. Stream Chat provides ways to delete users, channels, and messages depending on the use case.

There are two server-side functions which can be used: deleteUsers and deleteChannels . These allow you to delete up to 100 users or channels and optionally all of their messages in one API request.

• To permanently delete a user and all of their data, use deleteUsers and set mark_messages_deleted , hard_delete , and delete_conversation_channels options to true.

• To permanently delete a channel and all of its messages, use deleteChannels and set hard_delete to true.

For more information, and examples, see:

• Deleting a batch of users

• Deleting a batch of channels

After deleting a user, the user will no longer be able to:

• Connect to Stream Chat

• Send or receive messages

• Be displayed when querying users

• Have messages stored in Stream Chat (depending on whether or not mark_messages_deleted is set to true or false )