Deletion done right: Annotation-driven data removal at scale
Building deletion into modern applications is deceptively hard. Most distributed data stores offer simple point-delete APIs but push the hard work onto developers: figuring out when to delete and what else needs to go with it. That hand-written logic is repetitive and error-prone, and mistakes lead either to data that should have been removed lingering in storage or to accidental deletion of the wrong records.
DELF is a framework Meta has built and run in production for several years to address that gap. Instead of calling database APIs directly, developers annotate structured data type specifications with what should happen when an object is deleted. The annotations describe the timing of deletion and whether deletion should cascade to related objects. For instance, the deep annotation on the created_photo edge between an account and its photos tells DELF that deleting the account must also delete every photo that account created.
DELF then takes over execution of the deletion request without further developer input. It hides the target object immediately and applies read-time checks to conceal dependent data from product surfaces. Behind the scenes, it traverses the graph of all data marked for deletion asynchronously and issues point deletes to the underlying stores. A restoration log records the actions taken, giving engineers a limited-time "undo" window designed to prevent data loss if something goes wrong. DELF also monitors deletion progress, automatically retries failed operations, and surfaces any persistent errors to developers until every deletion completes.
Four layers of correctness checking
Because deletion semantics rest entirely on annotation accuracy, DELF ships with a range of validation checks to catch developer mistakes before or after they hit production. Static validation runs before new data is collected and rejects any data type lacking sufficient deletion annotations. Dynamic validation heuristics inspect live production data to flag potentially incorrect annotations for human review.
Two further checks address more subtle failure modes. Privilege escalation checks scan for deletions that could affect data the requesting person does not own, blocking malicious attempts to remove arbitrary objects. Data type validation looks for object fields that implicitly reference other objects, ensuring developers haven't found a way to sidestep DELF's annotation system altogether.
The result is a framework that enforces deletion considerations early in the development cycle — before any data lands on the back end — and currently processes billions of deletions per day across Meta's products.
Why systematic deletion matters
Deletion is a simple concept for users: a clearly understood action with an expectation of quick and complete effect. The distributed architecture underneath modern services makes it anything but simple to implement correctly. Without a framework like DELF, well-intentioned developers will make mistakes — leaving data behind that should be gone, deleting data that should stay, or opening exploitable vulnerabilities that allow arbitrary data removal. DELF's contribution is a systematic, annotation-first approach that gives developers a correctness-checked path from the start of a project, rather than hoping hand-rolled deletion logic happens to be right.
