Hi, I'm from the EU, I have the right to get all of my data removed from a centralized service using GDPR. How do I do it on a decentralized one?

Leaving aside the whole issue of those companies not being trustworthy about the data deletion, at least my profile won't be public when its' been deleted and I've got someone to make a complaint about if I have reason to think they've lied about it. The fines can be pretty high. With federation, actually getting all copies of your profile deleted is nearly impossible. With torrent style decentralization, it seems completely impossible. Everyone will have access to everyone else's data and it'll be trivial to make backups.

Presumably most people would be using this on their phones with mostly their mobile data. An issue with the bittorrent protocol is that to open a connection, one peer has to have a port forwarded. Is this different with webtorrent?

Federation is simpler than true P2P here, but you then still need to trust the instance admins. It's fine for Lemmy/piefed style media for me because I don't put my real name, face and other details here.

My personal opinion is that a centralized alternative owned by a foundation rather than a for-profit company would be best of both worlds: No profit motive, just like decentralized. A centralized entity that holds liability in case there's a data leak or someone starts spreading CSAM. And ability for said centralized entity to moderate said CSAM, scams and other reports.