4 ms·
Ask HN: How to convince Airbnb to delete an account?
Hi all,
A friend created an Airbnb account a while back but never used it because Airbnb's verification system can't send texts to our phone provider apparently so they couldn't verify the account.
They decided to ask them to delete it and remove all their personal info, and Airbnb refused (even though their website says to contact customer support), so they tried sending a GDPR request because they're an EU resident, and got back a big email about how since they signed up with Airbnb US they're not a resident and aren't eligible for consideration under EU Laws (they did sign up while traveling here, but they're still an EU resident).
Is there a trick for convincing them to delete (not just deactivate) an account?
Email that they forwarded me for reference (I did ask my friend if I could post this):
> Data deletion is a right afforded by the General Data Protection Regulation. Only customers of Airbnb Ireland UC, Airbnb Payments UK Ltd. or Airbnb Global Services Limited (‘Airbnb’) are eligible to exercise their data subject rights under the GDPR.
>
> Because your country of residence and activity are related to the United States, you are contracting with Airbnb, Inc.
>
> GDPR generally does not apply to users of Airbnb Inc. Subsequently, we are unable to fulfil your deletion request.
- jrowley 8y agoSo is Airbnb misinterpreting GDPR then? I’m pretty sure GDPR rules apply to EU citizens regardless of where they reside?
- SamWhited 8y agoThat was my understanding as well, but I'm not a lawyer of course. They also seem to be misinterpreting their own support pages which say accounts can be deleted and don't mention anything about GDPR or country of residence (https://www.airbnb.com/help/article/240/how-do-i-deactivate-or-delete-my-account https://www.airbnb.com/help/article/240/how-do-i-deactivate-...).
- who-knows95 8y agoyou are correct, they seem to misunderstand. GDPR comes into play, any time a EU citizens data is being processed, for storage or identification. if the server is in america, or France it doesn't matter. your data is protected by the GDPR policies.
- buboard 8y agono it applies when they are in the EU, or if the company that controls processes the data is in the EU.
- dazc 8y agoMaybe use another phone number to verify the account and change all the details to something random. Then, if there was a data breach, the only information anyone could obtain would be useless anyway?
- SamWhited 8y agoThat might help, but who knows if they're storing all your old info still behind the scenes? EDIT: I should also have said, as far as I know they don't have another number to use for verification, but of course I may be wrong. I'll ask.
- who-knows95 8y agowith the GDPR, if you are a citizen of the EU then it doesn't matter if the server is in america. "Do you process EU residents’ personal data? If you do, then the GDPR probably applies to you. It doesn’t matter whether you are based in an EU state or not – if your company processes, stores or transmits personal data belonging to EU residents, then you will almost certainly be required to comply with it." https://www.itgovernance.eu/blog/en/does-the-gdpr-apply-to-me https://www.itgovernance.eu/blog/en/does-the-gdpr-apply-to-m... -------------- this is air's GDPR's page, the fact that your account was able to be made on the america site is their fault and doesn't invalidate your data protection. https://www.airbnb.co.uk/help/article/2273/i-am-an-airbnb-user--how-do-i-exercise-my-data-subject-rights-under-the-general-data-protection-regulation--gdpr https://www.airbnb.co.uk/help/article/2273/i-am-an-airbnb-us...
- deleted 8y ago[deleted]
- SamWhited 8y agoI was just told support made them reactivate the account, log in, provide their actual address and country of residence (even more personal information that they had declined to provide the first time), and then asked them to get back to them. Hopefully this results in deletion, I'll follow up in a bit.
- SamWhited 8y agoFollowup, support told them they'd have to log in from their home IP address or they wouldn't delete the account. Except, apparently, when logging in locally it won't let them log in (presumably because they're not using the separate site for Europe? We're not sure) and just gives a generic error or doesn't show the login popup at all (but it works fine as soon as they switch to a VPN in the US, so presumably it's not just an adblock extension or something).
- SamWhited 8y agoSeveral days later, Airbnb stopped responding to customer support emails but they can no longer log into their account (no one mentioned that they were going to delete it though). However, they still got a terms of service update email, but it came to "deleted-1234-theiremail@example.com", so airbnb obviously still has their email. I don't even think they realize that they'll actually get emails to them adding some random numbers before it. So now airbnb still has their email, refused to delete it, but they don't have an account they can file a GDPR request against even if they find a way to make their IP address show up properly in geolocation tables to convince them that they live where they say they do.
- kelsette 8y agoHi, I'm a lawyer (solicitor, England and Wales) and I specialise in privacy and internet law. I'm obliged to say that I don't have all of the facts about this matter, and so what I write is general guidance only. "Only customers of Airbnb Ireland UC / UK Ltd. or Services Limited (‘Airbnb’) are eligible to exercise their data subject rights under the GDPR. [...] GDPR generally does not apply to users of Airbnb Inc." As several other commentators have mentioned, this is wrong. The GDPR has extra-territorial scope, meaning that it applies to a company in any country - even those outside of the EU - if it processes personal data belonging to an EU resident. For reference, see Article 3 GDPR. For further explanation, see Recital 23 GDPR. The fact that your friend may have contracted with the US entity of AirBnB does not (to my knowledge) have any bearing. As an aside, remember that this is for EU residents and not simply citizens - so a French citizen who is resident in Washington D.C. would not be covered, but an American citizen in France would be, if that makes sense. If your friend was my client, I would suggest that they both 1) push back on the request, as well as 2) file a complaint with the Information Commissioners Office here in the UK (or, if Ireland is more relevant to them, the Irish DPC). I hope everything gets sorted out! If you or your friend would like to discuss further, you can find me over on twitter @KelseyFarish
- buboard 8y ago> for EU residents and not simply citizen i think GDPR does not reference residents or citizens, but "data subjects in the union"
- kelsette 8y agoCorrect. The GDPR does not use the word "resident" or "citizens" but the implication "data subjects in the union" means that it applies to persons who are resident in the EU, even if they're not an EU citizen (like me!) which is just what I hoped to make clear :)