In theory, it's a legal requirement based on GDPR and CCPA as well as many other new digital rights laws across Europe and many states in the USA. SoundCloud is probably big enough to do that correctly otherwise e.g. the GDPR penalty is a highish percentage of the company's total revenue which gives the laws a good amount of "teeth".
> the GDPR penalty is a highish percentage of the company's total revenue which gives the laws a good amount of "teeth"
Under 2% of GDPR complaints even result in fines. And that would require there to be grounds for a complaint - there's no way for an external user to tell whether the delete is actually done, and the DPA won't force them to submit to a third-party source code audit.
