5 ms·

Yeah... we made this better yesterday (removed the delay and the request for ID). It was totally a dark pattern. We built the initial deletion process right aft

by ammon 6y ago

Yeah... we made this better yesterday (removed the delay and the request for ID). It was totally a dark pattern. We built the initial deletion process right after GDPR passed. We were thinking about it mostly from a legal perspective then, and had not reviewed it since.

GordonS 6y ago
But this makes no sense. Why would you legally need someone's ID to delete their account, but not to create it?
- aaanotherhnfolk 6y ago
  GDPR devalued PII-stores, and companies tried really hard to only let the value drop on the European portion of their data. Requiring ID is a way to discourage and even deny deletion requests in other countries. These constraints are walked back almost immediately in practice, once companies learn that requiring a human touch for a deletion flow is not worth the hassle. I think "legal" here meant what's the bare minimum to respect the letter of GDPR law, while not actually implementing a useful delete flow.
  - deleted 6y ago
    [deleted]
phreack 6y ago
Thanks for recognizing it. I think it'd be encouraging to see a post mortem detailing the positive changes that came out of this whole ordeal, the sort of user hostile behaviors that you (as a company) recognized from this self reflection, their origins and corrections.
sah2ed 6y ago
> Yeah... we made this better yesterday (removed the delay and the request for ID). It was totally a dark pattern. We built the initial deletion process right after GDPR passed. We were thinking about it mostly from a legal perspective then, and had not reviewed it since. Appreciate the honesty here by admitting that account deletion relies on dark patterns, but it brings up two salient questions regarding how you approach product development. 1. Internally, do you at least have the equivalent of a “directly responsible individual" (DRI) for the product? It seems no one spoke up in the interests of users against legal’s overzealous decision to tack on lots of friction to the account deletion process? 2. It seems you could have also garnered some push back on the feature from your alumni Slack [0] but didn’t, perhaps due to the rush to ship quickly? In addition to the changes you’ve pledged as part of rebuilding user trust, hopefully, you & your team will reassess your product development practices to add these checks so that such mistakes are not repeated in future. [0] @hysan mentions that TB maintains an alumni Slack upthread: https://news.ycombinator.com/item?id=23304199 https://news.ycombinator.com/item?id=23304199

by ammon 6y ago

GordonS 6y ago

But this makes no sense. Why would you legally need someone's ID to delete their account, but not to create it?

aaanotherhnfolk 6y ago
GDPR devalued PII-stores, and companies tried really hard to only let the value drop on the European portion of their data. Requiring ID is a way to discourage and even deny deletion requests in other countries. These constraints are walked back almost immediately in practice, once companies learn that requiring a human touch for a deletion flow is not worth the hassle. I think "legal" here meant what's the bare minimum to respect the letter of GDPR law, while not actually implementing a useful delete flow.
- deleted 6y ago
  [deleted]

phreack 6y ago

Thanks for recognizing it. I think it'd be encouraging to see a post mortem detailing the positive changes that came out of this whole ordeal, the sort of user hostile behaviors that you (as a company) recognized from this self reflection, their origins and corrections.

sah2ed 6y ago

> Yeah... we made this better yesterday (removed the delay and the request for ID). It was totally a dark pattern. We built the initial deletion process right after GDPR passed. We were thinking about it mostly from a legal perspective then, and had not reviewed it since. Appreciate the honesty here by admitting that account deletion relies on dark patterns, but it brings up two salient questions regarding how you approach product development. 1. Internally, do you at least have the equivalent of a “directly responsible individual" (DRI) for the product? It seems no one spoke up in the interests of users against legal’s overzealous decision to tack on lots of friction to the account deletion process? 2. It seems you could have also garnered some push back on the feature from your alumni Slack [0] but didn’t, perhaps due to the rush to ship quickly? In addition to the changes you’ve pledged as part of rebuilding user trust, hopefully, you & your team will reassess your product development practices to add these checks so that such mistakes are not repeated in future. [0] @hysan mentions that TB maintains an alumni Slack upthread: https://news.ycombinator.com/item?id=23304199 https://news.ycombinator.com/item?id=23304199