# How to handle user deactivation in Bubble.io: Step-by-Step Guide

- Tool: Bubble
- Difficulty: Beginner
- Time required: 20-25 min
- Compatibility: All Bubble plans
- Last updated: March 2026

## TL;DR

Handle user account deactivation in Bubble with soft deactivation (flagging and blocking login), hard deletion (GDPR compliance), and data cleanup workflows. This tutorial covers building a deactivation request flow, preserving data integrity, anonymizing personal information, and providing reactivation options.

## Overview: User Account Deactivation in Bubble

Users may want to deactivate or delete their accounts. This tutorial builds both options — soft deactivation (account is disabled but data is preserved) and hard deletion (personal data is permanently removed for GDPR compliance).

## Before you start

- A Bubble account with user authentication
- Basic understanding of Workflows and Data Types
- Knowledge of your app's data relationships involving Users

## Step-by-step guide

### 1. Add deactivation fields to the User type

Add fields to User: is_deactivated (yes/no, default no), deactivated_date (date), deletion_requested (yes/no, default no), deletion_scheduled_date (date). These fields control access and track the deactivation state.

**Expected result:** User records can track deactivation and deletion status.

### 2. Build the deactivation request flow

On the account settings page, add a 'Deactivate Account' button. The workflow: show a confirmation popup explaining what deactivation means. On confirm: Make changes to Current User → is_deactivated = yes, deactivated_date = Current date/time. Then: Log the user out. On every page's 'Page is loaded' event, add a check: When Current User's is_deactivated is yes → Log the user out and redirect to a 'Your account is deactivated' page.

**Expected result:** Deactivated users are logged out and cannot log back in.

### 3. Implement hard deletion for GDPR

Add a 'Delete My Account' option that sets deletion_requested = yes and deletion_scheduled_date = Current date/time + 30 days. Schedule a backend workflow to run after 30 days that: anonymizes the user's personal data (name → 'Deleted User', email → random hash), removes the profile image, and deletes related records where appropriate (messages, comments by this user). The 30-day delay allows cancellation.

> Pro tip: Anonymize rather than delete the User record to preserve data integrity in other records that reference this User.

**Expected result:** After 30 days, personal data is anonymized and the account is permanently removed.

### 4. Build the reactivation flow

On the deactivation page, show a 'Reactivate Account' form that requires email and password. If the credentials match a deactivated user (is_deactivated = yes): Make changes to User → is_deactivated = no, deactivated_date = empty. Log the user in. If deletion_requested = yes and the scheduled date has not passed, also cancel the deletion.

**Expected result:** Users can reactivate their accounts within the deletion grace period.

### 5. Clean up related data

Create a backend workflow 'cleanup-user-data' that handles all user-related records. For records that should be deleted (private messages, drafts): Delete a list of things. For records that should be preserved but anonymized (forum posts, comments): Make changes to list → author display name = 'Deleted User'. For records owned by the user (projects, files): either delete or transfer ownership to an admin.

**Expected result:** All user-related data is properly handled according to your retention policy.

## Complete code example

File: `Workflow summary`

```text
USER DEACTIVATION — WORKFLOW SUMMARY
======================================

USER FIELDS:
  is_deactivated (yes/no), deactivated_date (date)
  deletion_requested (yes/no), deletion_scheduled_date (date)

SOFT DEACTIVATION:
  1. Confirm popup → user acknowledges
  2. Set is_deactivated = yes
  3. Log user out
  4. Block login: Page is loaded checks → redirect if deactivated

HARD DELETION (GDPR):
  1. Set deletion_requested = yes
  2. Schedule date = now + 30 days
  3. Scheduled backend workflow at date:
     a. Anonymize: name → 'Deleted User', email → hash
     b. Delete private records (messages, drafts)
     c. Anonymize public records (posts → 'Deleted User')
     d. Remove profile image
  4. Send confirmation email before deletion

REACTIVATION:
  Within 30-day grace period:
  1. Verify email + password
  2. Set is_deactivated = no
  3. Cancel deletion request
  4. Log user in
```

## Common mistakes

- **Deleting the User record instead of anonymizing** — Other records reference the User — deleting causes orphaned references and errors Fix: Anonymize personal fields instead of deleting the User record to preserve data integrity
- **Not blocking login for deactivated users** — Users can still log in if you only set a flag without checking it Fix: Add a Page is loaded check on every page that logs out and redirects deactivated users
- **Not providing a grace period before permanent deletion** — Users may change their mind but have no way to recover their account Fix: Implement a 30-day grace period between deletion request and actual data removal

## Best practices

- Use a 30-day grace period before permanent deletion
- Anonymize rather than delete User records to preserve data integrity
- Block login on every page, not just the login page
- Send a confirmation email before and after account deletion
- Document your data retention policy and display it to users
- Log all deactivation and deletion events for compliance auditing
- Handle all related data types in the cleanup workflow

## Frequently asked questions

### Is account deletion required by law?

GDPR (EU) and CCPA (California) require the ability to delete personal data upon request. Most apps should provide this functionality regardless of jurisdiction.

### Should I delete or anonymize data?

Anonymize user records and delete private data. This preserves system integrity while removing personally identifiable information.

### How do I handle subscription cancellation on deactivation?

Add a Stripe subscription cancellation step in the deactivation workflow before flagging the account.

### Can admins deactivate user accounts?

Yes. Build an admin panel that lets admins set is_deactivated = yes on any user for policy violations or security reasons.

### What data should I keep vs delete?

Keep: anonymized public content (posts, reviews). Delete: private data (messages, files, personal details, payment info).

### Can RapidDev help with GDPR compliance?

Yes. RapidDev implements GDPR-compliant account management, data export, anonymization workflows, and compliance documentation.

---

Source: https://www.rapidevelopers.com/bubble-tutorial/handle-user-deactivation-in-bubble
© RapidDev — https://www.rapidevelopers.com/bubble-tutorial/handle-user-deactivation-in-bubble