Dozens of new privacy laws have been passed in the last few years. In some cases, there are now severe financial penalties associated with non-compliance. This has started to empower internal teams within companies (who want to do the right thing) to actually do the right thing, and follow both the letter and spirit of these laws. I'm part of a project to build a global "delete me" button so I have insight into a range of different responses. Most companies still tend to be maliciously compliant or they simply ignore the request, but I'd be comfortable sending them my data. There are definitely bad actors out there for whom you're probably better off not sending them any request at all. Progress is slow but it's headed in the right direction.