Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Some discouraging anecdotes on how services handle account deletions

ctrl.blog

Post reply on HN
Print view View original

51–60 of 133 posts

Re: Some discouraging anecdotes on how services handle account deletions

#51

Post by vkou »

hereforphone wrote: post #9
ShakataGaNai wrote: post #4

This is super duper common. Most companies that I've run across don't actually have a mechanism for properly deleting accounts. My anecdote: Collage.com - I tried it, was unsatisfied with the results so I requested that they delete my account under CCPA (being a Californian). They said they completed. My account was renamed from email@domain.com to email@domain.com-deleted12344843223432 . My session wasn't even termi…

Name and shame. And please take the time to file a complaint.

Naming and shaming on a techie forum does nothing. People spent over a decade grousing about Micro$$$$oft on Slashdot to no effect.

Regulators and legislators are the only people who can do something about this. If you want to make a difference, politick, vote, or lobby.

Re: Some discouraging anecdotes on how services handle account deletions

#52

Post by paranoidrobot »

AnonC wrote: post #33
barbazoo wrote: post #29

> 2 services moved my account to a different email address instead of deleting it. I was only able to detect this because they changed the mailbox part (the bit in front of the @ sign) but left the domain unchanged. I capture all incoming emails to my domain, so I saw email-change confirmation emails and other emails arriving at the new unexpected addresses. That's sketchy, especially if you don't own the domain but…

AFAIK, with the default domains owned by the email providers, Gmail and Yahoo don’t recycle unused/deleted gmail/yahoo addresses ever (whereas other paid providers like Fastmail, Posteo, etc., do recycle within a few months or in a year or so). One needs to be wary of address recycling policies while using somebody else’s domain.

This is talking about registering with example@gmail.com on ServiceX.

Then you ask ServiceX to delete your account, and they instead change your email address to example-deleted@gmail.com or something like that.

I doubt GMail are going to stop you registering accounts that have arbitrary portions of your email being another registered user.

Re: Some discouraging anecdotes on how services handle account deletions

#53

Post by c0balt »

warmwaffles wrote: post #36
organsnyder wrote: post #31

Earlier quoted context omitted.

As long as all PII is purged in this process (tricky to guarantee with software like Confluence that is entirely dedicated to hosting user-generated data), that could be compliant.

I wonder if they also go through all of their backups and purge the PII. I would be willing to bet, they don't.

Backups usually have limited retention after various data protection agencies. In my current location the recommended time is a few weeks for backups, a few days for logs etc. Those agencies are fully aware that nobody goes around purging data from backups (which may also be hard with airgapped backups etc.) and you might need to wait before being "forgotten".

Re: Some discouraging anecdotes on how services handle account deletions

#54

Post by alasdair_ »

itvision wrote: post #6

I've worked for several companies and let me tell you the truth: * accounts are never deleted, period * At most there's a column in the table which specifies whether the account is alive or not. That's it.

I worked for a company that made games that were used by young children and so covered by COPA. They definitely took a lot of care to delete everything.

Re: Some discouraging anecdotes on how services handle account deletions

#56

Post by jack335 »

itvision wrote: post #6

I've worked for several companies and let me tell you the truth: * accounts are never deleted, period * At most there's a column in the table which specifies whether the account is alive or not. That's it.

That's true. But * probably * pseudonymised :D

Re: Some discouraging anecdotes on how services handle account deletions

#58

Post by AnonC »

paranoidrobot wrote: post #52
AnonC wrote: post #33

Earlier quoted context omitted.

AFAIK, with the default domains owned by the email providers, Gmail and Yahoo don’t recycle unused/deleted gmail/yahoo addresses ever (whereas other paid providers like Fastmail, Posteo, etc., do recycle within a few months or in a year or so). One needs to be wary of address recycling policies while using somebody else’s domain.

This is talking about registering with example@gmail.com on ServiceX. Then you ask ServiceX to delete your account, and they instead change your email address to example-deleted@gmail.com or something like that. I doubt GMail are going to stop you registering accounts that have arbitrary portions of your email being another registered user.

GP here. I understood that part on later reflection. Yes, any random name-deleted address could be registered by someone else.

I’m unable to edit my previous comment now and correct it. Will add a note as a reply anyway.

Re: Some discouraging anecdotes on how services handle account deletions

#59

Post by AnonC »

AnonC wrote: post #33
barbazoo wrote: post #29

> 2 services moved my account to a different email address instead of deleting it. I was only able to detect this because they changed the mailbox part (the bit in front of the @ sign) but left the domain unchanged. I capture all incoming emails to my domain, so I saw email-change confirmation emails and other emails arriving at the new unexpected addresses. That's sketchy, especially if you don't own the domain but…

AFAIK, with the default domains owned by the email providers, Gmail and Yahoo don’t recycle unused/deleted gmail/yahoo addresses ever (whereas other paid providers like Fastmail, Posteo, etc., do recycle within a few months or in a year or so). One needs to be wary of address recycling policies while using somebody else’s domain.

I’m unable to edit my comment above, but I understood the problem of changing the email address (even to something like name-deleted, since it could be claimed or already registered by someone else). In this context, my comment above is pointless. :(

Thanks also to @paranoidrobot for the additional explanation.

Re: Some discouraging anecdotes on how services handle account deletions

#60

Post by Ansil849 »

esturk wrote: post #57

Is it name and shame time? Cause I know Walgreens doesn't even have the option to allow you to request deleting your online account. Not an online option nor even calling them on the phone.

> Is it name and shame time?

I feel like this will basically be "pretty much every company out there". A more useful list might be companies who actually do truly delete accounts.

Post reply on HN