In their (now archived) ideas repo, one guy suggested ActivityPub. But they rejected that specification as not fitting with their requirements. See: https://github.com/OpenbookOrg/ideas/issues/1
This seems to go to far. Give the users control over their data in your system AND give them control over how their data is sent to other systems.
Edit: In the linked issue, OpenBook CEO said that you can't delete mastodon accounts, but Mastodon got that feature a couple weeks after his post:
Depending on how you define "system", being unable to track and/or delete data federated out might put you in a hazardous position around GDPR. It's not just about users controlling their own data. It's also about system operators being able to enumerate who they shared data with, what safeguards and processes they follow, and so on.