Enabling simple, accessible data access.
Twitch built a scalable personal data access and deletion system to support user privacy rights under regulations like GDPR and CCPA. The platform processes 50,000 monthly requests across hundreds of services, enabling reliable and compliant data handling at scale.
The Problem
Under regulations like GDPR and CCPA, users have the right to access a copy of the personal data a company holds on them. At Twitch, this request volume was growing—tens of thousands per month—and our manual processes were struggling to keep up.For users, the experience was slow, opaque, and inconsistent. Reports were often delayed, arrived in confusing formats, or required unnecessary back-and-forth with support. Internally, this created operational risk, legal exposure, and a poor user experience that undermined trust.We needed a scalable, self-service solution that met both regulatory requirements and user expectations.
The solution
We launched a fully automated Data Access Report Download tool, giving users the ability to request and retrieve their personal data directly from their Twitch account settings—no support tickets, no waiting. Behind the scenes, we built a robust fulfillment pipeline that pulls data from hundreds of microservices, normalizes and formats it into a standardized, human-readable report, and ensures secure, on-time delivery within regulatory deadlines. To support this at scale—over 50,000 requests a month—we focused on system resiliency, security, and deep internal observability, making privacy self-serviceable, reliable, and efficient for every user.
Why it WAS SUCCESSFUL
This project transformed a high-risk, high-friction compliance obligation into a fast, reliable, user-first experience. It reduced support overhead, improved regulatory audit readiness, and set a new internal bar for what privacy infrastructure could look like.It also helped reframe user trust as something that could be built through product quality—not just legal checkboxes. By giving users easy access to their data, on their terms, we delivered on a core privacy principle: empowerment through transparency.