You must implement per-user crypto-deletion for customer data in BigQuery using native Cloud features (no custom encryption at ingestion). What should you use?

The correct answer is to implement AEAD (Authenticated Encryption with Associated Data) BigQuery functions. This is the only native Cloud feature that supports per-user crypto-deletion directly within BigQuery. AEAD functions allow you to encrypt individual data elements using keys managed by your application, enabling granular control over encryption and decryption, and thus facilitating per-user crypto-deletion by deleting the associated encryption key. Creating a CMEK in Cloud KMS and associating it with the table encrypts the entire table, not individual user data, and does not support per-user crypto-deletion. Creating a CMEK and using it to encrypt data before storing it in BigQuery is a form of client-side encryption, but it's not a native BigQuery function and doesn't inherently provide the per-user crypto-deletion mechanism without additional application logic. Encrypting data during ingestion using a cryptographic library in your ETL pipeline is client-side encryption and not a native BigQuery feature, and also requires custom implementation for key management and deletion.