Deleting posts is the only onerous part of complying with these requests. Most can be achieved by directing to a privacy policy. Discourse lets the user download their own data. An admin can remove all identifying metadata with a single command. That leaves the posts themselves, most of which wouldn't be PII if they're not attached to a username or IP address. If there are any actually identifying details in the posts, that can be dealt with like any other moderation.

Encouraging the deletion of old posts is still a bad thing for the internet. A lot of in-depth subject knowledge is contained in old internet posts.

I don't think I support an unlimited right for people to delete everything they've posted to the internet. Previous law did not recognize one; the primary mechanism for attempting to assert one would likely be copyright, and a clickwrap user agreement would usually offer sufficient protection for the forum operator.

And more generally, prior to GDPR, a person could casually put up a forum on a website and not have a meaningful legal compliance workload. GDPR changes that.

Generally speaking, there isn't a right to force others to delete stuff you've posted to the internet - only stuff related to PII. If you anonymize posts (say, change the username to AnonymousCoward and delete real names, reset passwords, etc), you're 99% of the way there - and if the person in question comes back and says "you've not deleted PII that I posted in one of my posts", you can go and delete that or edit it out, you're not about to get fined if you make a best-effort attempt as a small company - only if you're obviously negligent.

There is no right to delete stuff that is not PII.

That's good to know. I had the impression it was more expansive.

GDPR doesn't include a blanket right to delete your data.

And forums already had to protect against eg people under 13 registering, or people under 18 sharing nudes. Both of those pose significant risk to online services, but people cope.

Forums only had to have a checkbox or user agreement saying "you must be over 13", and are protected from liability for users posting illegal content in the US by section 230 of the CDA.

Your comment made me wonder how services like archive.org that automatically save forum posts that may contain personal information are going to deal with GDPR.