8 ms·

Wait, so if I know someone's name and email address or username I can probably cause arbitrary companies to delete their account?

schlimig 7y ago
Exactly! As a site administrator I've received much abuse from users who have used a "service" such as this. Upon doing my job and legally verifying they own the data, I've frequently been subjected to a torrent of abuse and legal threats - companies such as this foster a belief that you can just enter your details, press go and that's he end of the matter.
Tenoke 7y ago
You have to send the request from an email and if you send it from an unrecognized one they'll probably ignore it, have grounds to do so or will ask you for more information in a follow-up email.
- kyrieeschaton 7y ago
  "Probably" some hazy business process will intervene is not a reassuring guarantee! (And those manual processes are expensive and likely to be automated away to some hackable business logic at some point.)
  - Bartweiss 7y ago
    > those manual processes are expensive and likely to be automated away to some hackable business logic I suppose this depends on who they're manual and expensive for. Some people will probably automate "respond to all agent-based deletion requests with a request for proof of authorization and direct user verification", because it lets them delete as little as possible. But actually checking that info if its provided? Yeah, that sounds less likely. And I'll bet a lot of companies will just obey anyone claiming to be the actual user and providing some piece of personal info.
Bartweiss 7y ago
Legally, no. CCPA guidelines say that for deletion requests via an "authorized agent", companies can require the consumer to verify their identity directly with the business, and require the agent to furnish written permission from the consumer. (Unless the authorized agent holds power of attorney. Good luck sorting that case out.) Practically? Yep. The burden of work and evidence for refusing requests is pretty high, and most companies probably won't handle it. Companies under GDPR have consistently agreed to delete or even reveal info without reasonable evidence. They generally aren't allowed to gather new info to verify you, either - they specifically can't require official ID if they don't require it as part of their normal business. Probably a decent number will require you to confirm the request via the email they have on file, but if you did the work to plead "no longer have access to that email" they'd probably delete anyway. The only good news is that password-based accounts are different, and the standard for verification is meant to scale based on the damage of a positive mistake. So you could cause bulk deletions from an email list to hurt a company, or target a person for massive inconvenience, but you probably couldn't get hit someone's most important accounts like file backups or online bill payments. A really surreal thing, though, is that opt-out-of-sale requests don't even require verification, and they prohibit businesses from asking you to opt back in for a long time. They can only be refused with a "reasonable and documented" belief that the request is fraudulent. What's more, a deletion request that can't be verified is supposed to be treated as a valid opt-out request! So for targeting a consumer, maybe. But I absolutely expect we'll see someone target a company by taking a multi-million-record email breach and sending deletion/opt-out requests for all of them.

schlimig 7y ago

Exactly! As a site administrator I've received much abuse from users who have used a "service" such as this. Upon doing my job and legally verifying they own the data, I've frequently been subjected to a torrent of abuse and legal threats - companies such as this foster a belief that you can just enter your details, press go and that's he end of the matter.

Tenoke 7y ago

You have to send the request from an email and if you send it from an unrecognized one they'll probably ignore it, have grounds to do so or will ask you for more information in a follow-up email.

kyrieeschaton 7y ago
"Probably" some hazy business process will intervene is not a reassuring guarantee! (And those manual processes are expensive and likely to be automated away to some hackable business logic at some point.)
- Bartweiss 7y ago
  > those manual processes are expensive and likely to be automated away to some hackable business logic I suppose this depends on who they're manual and expensive for. Some people will probably automate "respond to all agent-based deletion requests with a request for proof of authorization and direct user verification", because it lets them delete as little as possible. But actually checking that info if its provided? Yeah, that sounds less likely. And I'll bet a lot of companies will just obey anyone claiming to be the actual user and providing some piece of personal info.

Bartweiss 7y ago

Legally, no. CCPA guidelines say that for deletion requests via an "authorized agent", companies can require the consumer to verify their identity directly with the business, and require the agent to furnish written permission from the consumer. (Unless the authorized agent holds power of attorney. Good luck sorting that case out.) Practically? Yep. The burden of work and evidence for refusing requests is pretty high, and most companies probably won't handle it. Companies under GDPR have consistently agreed to delete or even reveal info without reasonable evidence. They generally aren't allowed to gather new info to verify you, either - they specifically can't require official ID if they don't require it as part of their normal business. Probably a decent number will require you to confirm the request via the email they have on file, but if you did the work to plead "no longer have access to that email" they'd probably delete anyway. The only good news is that password-based accounts are different, and the standard for verification is meant to scale based on the damage of a positive mistake. So you could cause bulk deletions from an email list to hurt a company, or target a person for massive inconvenience, but you probably couldn't get hit someone's most important accounts like file backups or online bill payments. A really surreal thing, though, is that opt-out-of-sale requests don't even require verification, and they prohibit businesses from asking you to opt back in for a long time. They can only be refused with a "reasonable and documented" belief that the request is fraudulent. What's more, a deletion request that can't be verified is supposed to be treated as a valid opt-out request! So for targeting a consumer, maybe. But I absolutely expect we'll see someone target a company by taking a multi-million-record email breach and sending deletion/opt-out requests for all of them.