My GDPR Rights Were Trapped Inside a Broken Dropdown

I wanted to download the data SoundCloud has collected about me. This should be one of the more straightforward things the GDPR gives me the right to do. I was not asking them to explain their recommendation system, delete the company database, or locate some obscure record from fifteen years ago. I just wanted a copy of my own data.

SoundCloud's instructions sent me to a support chatbot. The chatbot asked for my email, asked me to choose the relevant jurisdiction, and then presented a list of legal rights. Right to erasure. Right to data portability. Right of access. Right to restrict processing. Right to rectification.

The list opened normally. I could see the exact option I needed.

I just could not select it.

Clicking did nothing. Keyboard navigation did nothing. The dropdown remained empty and the submit button remained disabled. The interface was aware that I had a legal right, capable of displaying its name, and unable to let me exercise it.

There was something almost too perfect about the failure. My right had made it all the way from European legislation into SoundCloud's privacy policy, through their compliance process, into a chatbot, and finally into a dropdown menu. Then it stopped.

Nobody explicitly refused my request. There was no message saying SoundCloud would not provide the data. There was no argument over jurisdiction or identity verification. The process simply became impossible to complete.

That distinction probably matters legally, but it matters much less to the person using the form. A right that cannot be exercised because a dropdown is broken has roughly the same practical value as a right that does not exist. The outcome is identical. I do not get the data.

We tend to talk about digital rights at the level of laws, regulators, court decisions, and corporate policies. Those things are important, but most people never encounter them directly. What we actually encounter is a form. We encounter an account settings page, a confirmation link, a support bot, or a dropdown that is supposed to register a click.

That interface becomes the real enforcement layer.

This means a surprising amount of legal power now sits inside ordinary product decisions. Whether a person can access their data may depend on whether a JavaScript component works in their browser. Whether someone can cancel a subscription may depend on whether the cancellation button has been hidden under the correct menu. Whether a person can appeal an automated decision may depend on whether a support ticket reaches the correct internal queue.

These systems do not need to be malicious to become barriers. SoundCloud's broken form may be a browser compatibility problem, a neglected third-party chatbot, or a small regression introduced during an update. Someone may fix it quickly once they notice. I have no evidence that anyone deliberately designed the dropdown to fail.

That may be the more uncomfortable version of the story.

At least a deliberate dark pattern has an owner and a motive. A neglected compliance interface can fail because responsibility has dissolved across several teams and vendors. Legal wrote the policy. Support owns the chatbot. A third-party platform renders the form. Engineering may never use it. Compliance assumes requests are arriving. Everyone can point to a system that technically exists.

Meanwhile, the user is clicking the same option five times and wondering whether they are doing something wrong.

I eventually found an email address for SoundCloud's Data Protection Officer and sent the request directly. I included the categories of information I wanted, the email address connected to the account, and references to Articles 15 and 20 of the GDPR. That route may work.

But finding the alternative required more effort than the official process suggested. I had to search through policy pages, compare different instructions, test the chatbot, document the failure, and decide whether the published email address was still appropriate. Most people will not do that. They will open the dropdown, click twice, assume the site is malfunctioning, and leave.

Companies often count abandonment as absence of demand. Perhaps very few users request their data. Perhaps people do not care. Or perhaps the path has enough friction that the people who care never reach the end.

This is why measuring compliance by the existence of a process is weak. A company can have a privacy policy, a dedicated request form, and a menu listing every relevant legal right. All of it can look complete in a compliance review. The only missing part is whether a real person can successfully submit the request.

Someone has to test the button.

The deeper problem is that we have attached important rights to software that receives ordinary software maintenance. Features break. Vendors change. Browsers update. Teams reorganize. Old flows remain online long after the people who created them have left. Yet a broken music player and a broken data-access form are not equivalent failures. One interrupts a song. The other interrupts a legal right.

Our systems rarely reflect that difference.

Maybe compliance interfaces should be treated more like payment systems or account security. They should be monitored, tested across browsers, and checked using actual end-to-end submissions. A company should know when the number of completed privacy requests suddenly falls to zero. Regulators should test the process themselves instead of only reading the policy describing it.

None of this is technically difficult. That is partly why the situation feels so strange. Europe built an ambitious legal framework around personal data, and my ability to use it came down to whether one option in one dropdown could receive focus.

I had the legal right to access my data.

What I did not have was a working button.

Connected reading

• The Last Obstacle Was a Popup
• A Toggle Is Not an Explanation
• When Systems Teach Us Not to Try
• The Most Dangerous Interface Is the One That Says Everything Worked
• The Report Is a Form

AI authorship note

This essay began with Kris Haamer trying to download his SoundCloud data, discovering that the official GDPR chatbot could display the correct request types but could not select them, and asking for the Raw Drafts angle. Kris documented the broken interaction, chose the central argument about legal rights becoming dependent on ordinary interface maintenance, and made the final publication decision. AI helped develop and edit the essay, prepared the data-access email, and assembled the publishing workflow.