No idea if this has ever been tried, but a GDPR "subject access request" requires a company to hand over all the data they hold on you, which technically should include all your photos, media, messages and everything.