EU already has this with the GDPR. Only limitation are retention periods required by law, like employee data needs to be kept for ten years in Germany for example, but for the duration whoever has the data must block it from being processed for anything but the legal requirment, as that becomes the legal basis for processing (storing in this case) and no other uses are allowed until deletion.

Only applies to EU citizens though plenty companies have implemented straightforward ways to delete an account for everyone.

“Dopamine Nation” is a good book on this whole issue. I really wonder how much the dead internet theory might play a role in eventually breaking this cycle, or just younger generations being contrarian to older generations.