How to Add Data Deletion Instructions for Facebook & Meta (2026 Guide)

If your app uses Facebook Login, the Meta SDK, or any Meta product that accesses user data, you are required to provide a data deletion mechanism. Without it, your app will not pass Meta's App Review, and existing apps risk having their API access revoked. This guide walks through exactly what Meta requires, how to implement both a callback URL and an instructions page, and how to avoid the most common review failures.

What Meta Requires and Why

Meta's Platform Terms (Section 3.2) and Developer Policies require that any app accessing user data through Meta's APIs must give users a way to request deletion of their data from your systems. This is separate from what happens when a user removes your app from their Facebook account — Meta handles its side, but you are responsible for deleting data you have stored on your own servers.

The requirement exists because of GDPR, but Meta enforces it globally, not just for EU users. Every app that integrates with Facebook Login, Instagram API, or other Meta products must comply regardless of where your users are located.

Meta gives you two options for handling this, and you must implement at least one: a Data Deletion Callback URL (automated) or a Data Deletion Instructions URL (manual process). Most developers implement one or both.

Option 1: Data Deletion Callback URL

This is the automated approach. You provide an endpoint on your server that Meta calls when a user requests data deletion through Facebook (Settings > Apps and Websites > Remove App > Delete Data). When Meta sends this request, your server should delete all data associated with that Facebook user ID.

How the Callback Works

Meta sends a signed POST request to your callback URL containing a signed_request parameter. You decode this to get the user's Facebook ID, then delete their data from your systems. Your endpoint must return a JSON response with a confirmation code and a URL where the user can check the status of their deletion request.

The response format looks like this:

{
  "url": "https://yourapp.com/deletion-status?id=abc123",
  "confirmation_code": "abc123"
}

The user sees this confirmation code in their Facebook settings, and can visit the URL to check whether the deletion has been completed.

Implementation Considerations

Your callback endpoint must be publicly accessible (no authentication required for the endpoint itself), verify the signed request using your app secret to prevent spoofing, handle the deletion asynchronously if it takes time (return the confirmation immediately, process deletion in the background), and return the correct JSON format or Facebook will flag it as non-functional.

If you use a framework like Laravel, you can create a simple controller that decodes the signed request, queues a deletion job, and returns the confirmation response. The Facebook PHP SDK provides helper methods for decoding signed requests.

Option 2: Data Deletion Instructions URL

This is the simpler approach and works for apps that cannot implement an automated callback. You provide a URL to a page that explains how users can request data deletion manually. This is the approach most indie developers and small teams use because it does not require building a custom API endpoint.

What the Instructions Page Must Include

The page should clearly explain: what data your app collects from Facebook users, how users can request deletion (email, in-app form, or web form), what happens when they submit a request (confirmation, timeframe, what gets deleted), and how long the process takes (30 days is the standard maximum).

Here is what a solid instructions page typically covers:

Data collected — List what you store: name, email, profile photo, Facebook user ID, friend list (if applicable), and any other data your app accesses.
How to request deletion — Provide a clear method: a form on the page, an email address, or a link to an in-app setting. A form is best because it reduces friction and gives you structured data to process.
Processing time — State how long deletion takes. "Within 30 days" is standard and aligns with GDPR requirements.
Confirmation — Explain how the user will know their data has been deleted (email confirmation, status page, etc.).
Exceptions — If you retain any data for legal reasons, disclose this. For example: "We may retain transaction records as required by tax law."

Where to Configure It in Meta for Developers

Go to Meta for Developers (developers.facebook.com) > Your App > Use Cases or App Settings > Basic. In the privacy section (or under the specific product like Facebook Login), you will find a field for "Data Deletion Callback URL" or "Data Deletion Instructions URL." Enter your URL in the appropriate field.

If you are using Facebook Login specifically, the setting is usually under: Facebook Login > Settings > User Data Deletion. You choose whether to provide a callback URL or an instructions URL, then enter the URL.

After saving, Meta may test the URL during App Review. Make sure it is live, publicly accessible, and returns the expected response (for callbacks) or displays clear instructions (for instructions URLs).

Common Reasons for App Review Rejection

Meta's App Review team frequently rejects apps for data deletion issues. Here are the patterns that cause failures:

URL returns 404 or error — Your data deletion URL must be live and accessible at review time. If it is behind authentication, the reviewer cannot access it. Make the page public.
Callback returns wrong format — The JSON response must include both url and confirmation_code. Missing either field or returning HTML instead of JSON will fail.
Instructions are too vague — "Email us to delete your data" with no further detail is not enough. Explain what data you hold, what gets deleted, and give a timeframe.
No actual deletion happens — Meta can test callbacks. If your endpoint acknowledges the request but never actually deletes data, you risk enforcement action.
Page is not in English (or user's language) — If your app targets English-speaking users, the instructions must be in English. For multilingual apps, provide at least English.
Mixed with other content — The data deletion instructions should be on a dedicated page or a clearly marked section, not buried inside a 10,000-word privacy policy with no anchor link.

Connecting It to Your Privacy Policy

Your privacy policy should reference your data deletion process and link to your data deletion instructions page. This creates a consistent experience: the privacy policy explains what data you collect, and the data deletion page explains how to remove it. Cross-link between them.

If you also support Apple's and Google's account deletion requirements (which you should), your data deletion instructions page can serve multiple purposes: it satisfies Meta's requirement, provides the web-based deletion path Google Play requires, and supplements your in-app deletion for Apple's requirement.

Using App Club for Data Deletion Pages

App Club generates a dedicated data deletion instructions page for every project at {slug}.app-club.org/data-deletion. It also generates an account deletion request form at {slug}.app-club.org/delete-account with a working form that captures deletion requests and notifies you by email. Both pages are generated from your project settings and are ready to use as your Facebook Data Deletion Instructions URL and Google Play deletion URL.

You can also generate a privacy policy that includes the appropriate data deletion sections, cross-linked to your deletion pages. This gives you a complete set of compliance documents without having to write any of them from scratch.