The current Web Access Control spec states that you cannot delete the ACL resource for the root container of a user's account.
The root container of a user's account MUST have an ACL resource specified. (If all else fails, the search stops there.)
How does the server indicate to a client application that an ACL resource cannot be deleted?
A way to figure this out today is that the client can check every parent container available if there is a ACL available, but this can be an expensive operation.