What I wanna know is: is this legal? For a company to one-sidedly impose new policies and punish users when they didn't agree to such changes by making them unable to delete their data until they comply?

I think Paypal demanded a phone number to login for awhile until they modified this practice. At the very lesat I'm positive right now they have a serious form of asshole design up when you login that tries to you into giving a phone number. Try a VOIP or Google Voice?

I assume you could find a legal challenge just as much as I assume the costs and energy involved in pursuing such a thing would drain life itself from your veins. And companies know this for small scale issues, that's why they continuously do it.

EG I worked at a company that repeatedly broke FCC laws and simply paid out 10G in fines every time a consumer complained.