13 ms·

Cloudflare keeps sending emails over a year after account was cancelled

242 points by edent 6y ago

t0mmyb0y 6y ago
Once a scam company always a scam company. File a lawsuit.
hosker4u 6y ago
GDPR does exist but should GDPR exist so people can cry about an odd email. No.
- dannyw 6y ago
  The 'odd email' is just irrefutable evidence of Cloudflare's retention of the poster's email address, which is considered personal data under GDPR. If Cloudflare is unable to even remove a deleted account from a mailing list, how do you know they have actually deleted ANY other information?
  - ZWoz 6y ago
    General Data Protection Regulation don't exist in vacuum, other laws are regulating data handling. Most importantly, accounting related regulations. So, if you request your account deletion, all billing related information is still hold - that is probably 7 years in all EU countries. Sending unwanted mail for those addresses is different issue though, but having contact data as part of billing data is legal.
    - corty 6y ago
      Yes. But for all personal data the purposes for which it may be used is limited: generally[0] only the original reason for collecting the data or the legal basis for keeping the data dictate the uses. So anything kept for use in filing taxes or other bookkeeping obligations must only be used for those purposes. [0] it is possible to use data for other purposes than originally collected in some circumstances, but I'm not sure if there are many legal precedents for that yet.
- lawtalkinghuman 6y ago
  If Cloudflare can't get an email unsubscribe process to be GDPR compliant, should you trust them to handle the many far more privacy-relevant things they offer as a company...?
  - tomhoward 6y ago
    I have no dog in the fight (I'm not connected or loyal to Crowdflare whatsoever), but this is a non sequitur. Companies work to priorities lists based on how important things are for customers. So it's perfectly plausible that the very reason they're not flawless at removing cancelled users from all their email databases is that they're too busy focusing on, as you put it, "the many far more privacy-relevant things they offer as a company", which they regard as far more important. I'm not saying that's definitely the case here; I have no idea of any specifics. But I've definitely seen things happen that way in other companies/teams I've observed.
  - hosker4u 6y ago
    Yes, if they cant unsubscribe people. I could not care less, it bothers me more this guy crying about getting an email.
KingOfCoders 6y ago
I was downvoted last Cloudflare thread when I said I don't trust them. Why is the CTO deleting tweets? But because the last thread was about archive.org I love the fact that the tweet is archived on archive.org Sadly data protection agencies are understaffed and overwhelmed with requests. So if not hundreds of people complain about one company there will be no action (none of my complaints up to now has resulted in anything but notifications that I'm in a waiting queue - in some I'm for over a year now). "Our mission to help build a better Internet is rooted in the importance we place on establishing trust with our Customers, users, and the Internet community globally. To earn and maintain that trust, we commit to communicating transparently, providing security, and protecting the privacy of data on our systems."
- detaro 6y ago
  He seems to automatically remove all posts after a certain time (3 weeks or so), which isn't that unusual to do on Twitter.
  - foxdev 6y ago
    It's the reasonable thing to do when context collapses so easily on tweets.
    - samtheprogram 6y ago
      Not when you’re the face of Cloudflare, or any other company that large. It looks very deceitful.
      - SteveNuts 6y ago
        Not to me. So long as it's consistently applied, it actually seems like the responsible thing to do when something completely innocuous posted on Twitter could cause damage to the company. To me it's similar to scheduled stock selling for CEOs, which gets rid of any doubt for whether there's insider trading.
Hamuko 6y ago
I made a GDPR data deletion request to a certain large website like a year ago. There was some caveat about retaining some data that they legally have to hold on. About 11 months after they confirmed that my data had been deleted, they sent me an email informing me about their changed Terms of Service. So I guess my email at least wasn't pruned. Who knows how much more data they are holding on.
- dutchmartin 6y ago
  I’ve had this like 3 times already. You had to mail customer support for data deletion, and after that, you got a mail with ‘are you satisfied with our help?’. Well hell no, because you still store my email adress.
- isbvhodnvemrwvn 6y ago
  If they need the e-mail address for legal reasons then you can not withdraw consent, as consent was not the legal basis for storing this data in the first place. They also correctly inform you about changes in the terms of service, as this likely affects the data they store on you (e.g. they might have another legal basis for storing it).
  - donohoe 6y ago
    Just want to emphasize how correct this is. Legally, despite but you nay want, they can still store info like thus for narrow reasons. This is Beardsley and normal.
    - cxr 6y ago
      Even if true, neither you nor the person you're responding to see a distinction between: 1. retaining information because of a legal requirement and acting on their legal obligations as is necessary from time to time 2. retaining the information as above while saying that there's no such thing?
    - hyperdimension 6y ago
      I'm usually decent at mental-typo-correction and typically won't point it out, but is 'Beardsley' supposed to be 'ordinary?'
isbvhodnvemrwvn 6y ago
Please do notify your country's Data Protection Authority. This is unacceptable.
- lawtalkinghuman 6y ago
  The UK's ICO is remarkably ineffectual, sadly.
  - Nextgrid 6y ago
    Doesn't hurt to try though - at least there will be a paper trail (plus public shaming) documenting their ineffectiveness.
cagenut 6y ago
You see this with nearly every SaaS provider. There's clearly a split between the email/pii in the control plane (admin dashboard) for your account, and then separate (often third party) spam tooling that they "sync" with, where the syncs work maaaaayyyybbeee 80% of the time. Department A handles the cplane (tech) and Department B handles the spam (marketing) and they try to go about their day/month/quarter with as little interaction as possible. The end result is how your data/email is handled in one is different than how its handled in another and they can often ping pong or feedback off each other in automated ways that make trying to unsubscribe a confusing game of playing byzantine generals with other peoples products. Now, just because I understand and sympathize with how things got this way, doesn't mean I'm not glad this guy is holding CFs feet to the fire for doing something about it. This emergent anti-pattern/"worst"-practice needs to improve, who better than the poster child for consumer tech saas.
- fphhotchips 6y ago
  I find the post to be pretty unnecessarily unforgiving; if you've worked in this industry for more than a minute, you understand how this sort of stuff happens. This is clearly not a marketing list - it's a compliance list on the first one, and a statuspage style one on the other. To call them spam is disingenuous, and to draw a line from "my email is on multiple lists and taking my name off one doesn't take it off all" to "Don't trust this company with your personal data" is really only fair if your email address is firstname.lastname.momsmaiden.childhooddog.bankaccountnumber.birthdate@gmail.com. Edit: I'm aware that GDPR considers email as confidential PII, but my post isn't legal advice. I just don't see my email as confidential.
  - deleted 6y ago
    [deleted]
deleted 6y ago
[deleted]
sippingjippers 6y ago
I once sent a 20-ish page written letter of complaint about British Airways to the UK regulator before they finally unsubscribed me OP, make a complaint to the ICO, it actually works
jgrahamc 6y ago
I'm sorry that OP hasn't received a follow up communication, I've raised that internally to figure out why. But this was investigated and his email has been deleted and an explanation was meant to have been sent. I'm sorry that he hasn't received the explanation. PS I automatically delete tweets after two weeks. Have done for a long time.
- _dibly 6y ago
  I mean he's had the issue for a year now, and each time you personally say something along the lines of "I'll look into it" or "I've raised that internally" but he waited an entire year before he posted this. Saying 'sorry, should be fixed now' is kind of unacceptable and more than a little patronizing to the people here.
  - cj 6y ago
    When you run a company with a lot of users, statistically mistakes are guaranteed to happen. What would you prefer his response be?
    - wolco2 6y ago
      You don't post I'll look into it internally multiple times and don't bother following up. I prefer no response or an honest one. No one benefits from a fake response.
    - yjftsjthsd-h 6y ago
      > What would you prefer his response be? If you get email that you're not supposed to get, it seems like marking it as spam is the logical option.
- SimeVidas 6y ago
  Can we expect this issue to now be resolved completely for all users, for example, if someone decides to delete their Cloudflare account today?
  - 6y ago
peterwwillis 6y ago
I'd cut them a little slack time-wise to track down where they have your address. In a large organization it's common for many products to have their own sets of PII records (and mailing system) and no way to query them all, so if they don't know what product captured the address, it can take time to find it. It's also interesting just how many regulations deal with e-mail addresses. https://www.absolute.com/blog/are-email-addresses-confidential-data/ https://www.absolute.com/blog/are-email-addresses-confidenti...
- luckylion 6y ago
  > I'd cut them a little slack time-wise to track down where they have your address. More than a year?
- corty 6y ago
  There are constraints in GDPR as to how much slack they are cut. Deletions such as this one should take days at most, and complaints have to be handled within 4 weeks, another 4 weeks as an extension if exceedingly difficult. A year for a mailing list unsubscribe and the related complaint isn't just excessive, it is totally illegal. If the company's processes are not set up to handle the proscribed faster timeframes, it must not handle personal data at all. Doubly shocking since this is cloudflare, where a large percentage of the internets personal data passes through...
tuxone 6y ago
This post is a little bit harsh, but I can understand writer’s point of view and feelings. Anyway, if confirmed, it looks like cloudflare needs to fix some dem target lists. Moreover, none of these emails were marketing or personal stuff (except rcpt email address). IMHO we have GDPR in order to punish intentional bad behavior, not to prosecute incompetence.
- zimpenfish 6y ago
  > we have GDPR in order to punish intentional bad behavior, not to prosecute incompetence That was exclude any data breaches though, wouldn't it? Because they are always incompetence rather than intentional bad behaviour on the part of the breached companies.
  - tuxone 6y ago
    Data breach will not disappear thanks to GDPR. GDPR tell you that you must, if possible, notify in case of data breach.
    - corty 6y ago
      Correct but incomplete: GDPR also tells you to use appropriate measures to prevent breaches. And of course if there was a breach, your measures were not appropriate so you need to change them.
- lawtalkinghuman 6y ago
  > we have GDPR in order to punish intentional bad behavior, not to prosecute incompetence Nope. It is to protect users. Users are harmed by both intentional bad behaviour and incompetence. This is the same principle as strict liability for product faults.
- throwaway2048 6y ago
  If incompetence is an acceptable excuse, every company interested in this tactics will become remarkably "incompetent".
- 6y ago
filleokus 6y ago
(Of course Cloudflare shouldn’t spam people who have quit their service). But I think posts like this explain why I’m not a huge GDPR fan yet. On the one hand we have enormous tracking empires, who most likely are maliciously compliant with GDPR. They have probably not lost much precision / revenue due to the legislation. Mostly business as usual. Then on the other side we have “normal” companies who are doing mostly “normal” crappy stuff all larger enterprises do. Clouddlare aren’t maliciously spamming people, they’re just incompetent handling their email lists. And sure it’s not a great look, but keeping someone’s email address around is probably not something governmental agencies should get involved in, in most cases. The tone used in this post would, for me, be appropriate if Cloudflare did something horrible with your data. Selling traffic infi to data-aggregation firms, having lax security for accessing your customer portal, beeing hacked and leaking data etc. Not “just” being sloppy with ther mailing lists.
- luckylion 6y ago
  > And sure it’s not a great look, but keeping someone’s email address around is probably not something governmental agencies should get involved in, in most cases. Why not? They are unwilling or unable to do it without government intervention. I agree that for an honest mistake you don't need the government to step in. But after a year and multiple tries and broken promises, it's not an honest mistake, it's either intentional or gross incompetence. I especially like that they keep stuff despite GDPR to "comply with internal policies and legal obligations". Making up an internal policy has no relevance to GDPR whatsoever (otherwise it would be quite easy "sorry, we have an internal policy to keep all your data forever"). Sounds like they simply don't care about GDPR.
- lawtalkinghuman 6y ago
  "Oh, my private data got leaked all over the darkweb, but it is fine because the company that collected it is merely incompetent rather than malicious", said nobody ever.
  - cxr 6y ago
    Comments like this one are probably not helpful in the overall scheme. The people who agree with you (like me) already agree with you, and I strongly disagree with the way of thinking by the person you're responding to, especially wrt this piece: > Then on the other side we have “normal” companies who are doing mostly “normal” crappy stuff all larger enterprises do. Clouddlare aren’t maliciously spamming people, they’re just incompetent handling their email lists. ... but your comment seems to be mostly self-serving and geared towards points-scoring.
pilsetnieks 6y ago
They are definitely not managing their mailing lists efficiently. My case is somewhat different, not that I want to unsubscribe but at one point they started addressing me as Dick in all their mass marketing emails. That's despite the fact that my name is not Richard or any variation thereof, nor have I used that name to sign up for anything at Cloudflare. It began immediately after I shot down one pushy salesperson's "invitation to arrange a call or videoconference" for a product that I already told them would not work for me. Could be just a coincidence, though.
- christophilus 6y ago
  Wow. That’s some serious passive aggressive BS, if that really is the reason. Their sales team is really obnoxious and pushy from my limited experience. But that’s pretty true of most sales teams I’ve interacted with.
  - nerdponx 6y ago
    Sounds more like said pushy salesperson didn't realize the OP would actually get email with that name attached.
  - sosodev 6y ago
    I’ve also had a bad experience with Cloudflare’s sales team. I was testing out their workers platform very shortly after its initial release when I got an email from a guy at Cloudflare claiming to be looking for user feedback on workers. I agreed to talk to him and he continued to pretend it wasn’t a sales call. The minute the call started it was clear he didn’t want to hear anything I had to say about workers and began pressing me to tell him where I worked. I told him and the conversation immediately turned into “what can I do to get you guys a contract for workers?” The whole interaction was unsettling for me. Seems like a pretty sleezy sales tactic.
    - CraftThatBlock 6y ago
      I can also echo this. I was interesting in one of there products (can't remember which) and after a call where I said I was interested, and they never emailed me back, even after I sent a follow up. The self-serve platform is great and I wish all products were self-serve, because dealing with sale teams is very annoying when you're just trying to evaluate a product.
mehrdadn 6y ago
I care about privacy as much as anybody, but why make such a big outcry over such a minor infraction? An email address is one of the least private and most non-consequential pieces of information that could be retained about someone in this day and age. Which many other companies flagrantly abuse all the time with no shame. Yet compared to many other large companies, Cloudflare has been a company with at least a respectable reputation and track record. Does that not warrant treating them a little bit better than this? Is the fact that they were unable to unsubscribe a user really something that warrants alarming the HN community over? Is there such a dearth of hills to die on right now that this is what we should be outraged about today?
- _dibly 6y ago
  So you're basically saying we should give them the benefit of the doubt on not complying with GDPR because they have a good track record? It would be one thing if OP was receiving cookie-cutter responses from CloudFlare's support team, but the CEO repeatedly personally intervenes and makes assurances that simply aren't true (and he's already made the same promises in this thread). How can those promises be taken at face value when it's still a problem a year later?
  - mehrdadn 6y ago
    No, I'm not saying anything about "doubt". I'm saying if a nice friend (or a non-friend for that matter) takes your pencil and insists for the next year that he'll return to you despite never doing so, maybe there's a better way to deal with this trauma than to crucify him in front of 7 billion people.
    - shean_massey 6y ago
      A better way, such as? You mean like writing email / tweet requests directly to those responsible? What's this magical alternative method? FWIW, this method seems to have worked where the reasonable and common methods clearly failed. He bought his own nails and cross when he promised action would be taken but failed to execute.
deleted 6y ago
[deleted]
metalliqaz 6y ago
I got into gmail during the beta and have a first-initial-last-name address that other people tend to use for signing up for services. There is a bank (PNC) that sends me emails all the time with no unsubscribe option. I don't have an account so they won't talk to me. It seems like a CAN-SPAM violation but I havn't bothered to look into how to actually sue for it. Edit: correct "PNY->"PNC"
- gogopuppygogo 6y ago
  Probably worth looking into. Sounds lucrative since PNC has money.
- znpy 6y ago
  i'm kinda in the same spot. I have "${lastname}${firstname}@gmail.com" and i routinely get emails directed to "${lastname}.${firstname}@gmail.com" (notice the dot in the middle). This was no big deal for me. But I received important documents (sometimes even legal document) that were not directed to me, at all. They were meant to be delivered to people in other areas of the country. This is because Google has moronically and unilaterally decided that the dots are not meaningful and that they are smart enough to understand who is the actual recipient of an email (spoiler: they are not). This also means that somebody else is also getting mail directed to me. This is super scary and made me distrust gmail as an email provider. Nowadays I keep my gmail account for my android phone only. But knowing I cannot trust the email address I am not confident to, for example, start using Google Cloud Platform with my private account.
  - MarkSweep 6y ago
    I don’t think it is possible for someone to register a gmail account name that contains dots. Therefore the mail you are getting is just people sending it the wrong address. I also have a "${lastname}${firstname}@gmail.com" email account and experience misdirected emails somewhat frequently. I wish more websites supported a “delete and recreate your account” feature, because some of my account were principally created by someone else and I can’t edit the details (Hulu).
raverbashing 6y ago
> When we receive a request for account deletion, we may retain the email address on the account up to a year to ensure that we comply with internal policies and legal obligations. On this specific aspect, they're not wrong. For example, they might keep that info to contact past clients about breaches, tax compliance issues, etc. Sure it would be better if this issue was explicitly spelled out and maybe more specific, but it is not wrong. (Sure, using that email to warn about a downtime is outside of that scope)
PaulHoule 6y ago
If somebody unsubscribed from a mailing list and the unsubscribe was effective that would be on the front page of the New York Times; it might even displace Trump's latest temper tantrum for 5 min on CNN. I am always unsubscribing from email lists and still getting email later. That's why I almost always block email from the sender when I unsubscribe. My only regret is that I can't program my mail server to bounce the email message to have the bounce handler unsubscribe me and/or hurt their deliverability.
asien 6y ago
Nothing surprising here. Company like Cloudflare , Netlify etc... are generally built for Sale or to IPO. People in charge of this type of Startup care about two things Growth - ARR. It’s very common for those business to have multiples teams with their own « Mailing List » because it’s just faster and simpler to operate this way rather than having one single mailing system. Add to that Software Turnover and your good for some trouble just to get rid of something that should have never been a problem in the first place.
mcintyre1994 6y ago
They send emails without an unsubscribe link? What do people do when they get emails like that? I just mark as spam in Gmail, they go away but that's surely the last thing an email sender would want to have happen.
- rightbyte 6y ago
  They do? I have tried that in Gmail but it seems some domains are whitelisted so you can't mark them as spam.
- cypres 6y ago
  There are unsubscribe links on all their e-mails and I think the automatic unsubscribe feature too. What I really want to know is if the OP actually tried to unsubscribe or just went directly to twitter about still receiving e-mails after cancelling his account for that nice twitter/HN buzz?
thewebcount 6y ago
He could take the route that some people take with telemarketers. Take them to small claims court[0]. I remember reading about someone who went a step further. When they got a default judgement against a company and the company didn't pay, they put a lien on the owner's home so he couldn't ever sell it until he paid up. I don't know what that takes to do, but it sounds fun! [0]http://www.killthecalls.com/suing-telemarketers.php http://www.killthecalls.com/suing-telemarketers.php
kemonocode 6y ago
Obviously not the real solution, but at that point it's time to just mark their emails as spam as they would squarely fit the definition by then.
3gg 6y ago
It's definitely fairly shady. For what it's worth, they seem to have deleted my account. I say "seems" because I don't recall receiving a confirmation email; my login eventually just stopped working. At any rate, demanding that customers send an email to have their account deleted is ridiculous. Put a damn button in there already. And before any claims are made to the contrary, invoking "security" here is nonsense; if someone hacks my login, having my account deleted is the least of my problems.
umvi 6y ago
Seems a bit overdramatic. Just mark as spam or make a filter. I know it's the principle of the thing, but still, a bit over the top.
ilrwbwrkhv 6y ago
Just mark as spam. I actually mark everything as spam. I don't even click unsubscribe.
deleted 6y ago
[deleted]
slx26 6y ago
Look, memory synchronization is hard. Some operations might take a decade to achieve consistency.
- mrmuagi 6y ago
  Just push the consistency date past any human life span and the problem is solved.
ananonymoususer 6y ago
Cloudflare isn't the only one with this sort of problem. I continue to get email from FedEx every month instructing me to update my credit card information. The information they have on file is from a card that expired over 10 years ago, and I closed my account with them 12 years ago. I called them last month to ask them why they continue to send me these emails, and asked them to stop. Their response was that they cannot stop the emails. Even when I pointed out that my having no business relationship with them, and them not offering a way to opt-out is a violation of the "Can Spam" act, they shrugged.
- cgb223 6y ago
  You should call their bluff and file a complaint on them under the act I’d bet they’d fix it really quick once regulators get involved
Seb-C 6y ago
I had a positive view on Cloudflare until recently. I started using it for my project about 3 months ago. I was impressed by the available features and even started planning to spend more in the future (I have only been on the free plan). You can set-up a lot of things and even have a load-balancer. I was also impressed by the smooth and easy onboarding process. Unfortunately, after starting to use it I realized that my site was extremely slow for everything that is not cached. Cloudflare was adding 250ms of latency to every request to my server. I certainly did not expect that much. When you try to send a support ticket, they aggressively try to make you not do it. My support ticket did not receive an answer for 2 months. I stopped using it last week and will certainly not look back.
kakarukeys 6y ago
Same thing happened to me, but with Heroku/Salesforce. You can read about it here: https://news.ycombinator.com/item?id=21969358 https://news.ycombinator.com/item?id=21969358 Account was suspended about 10 months ago (for no reason given). I sent Heroku, Salesforce, their data protection officers emails asking them to remove my account, databases, codes, everything on it. I kept receiving notifications that an active account would receive. And their DPO lied to me that they have closed the account. Another US company doing that is not really a coincidence.

242 points by edent 6y ago

t0mmyb0y 6y ago

Once a scam company always a scam company. File a lawsuit.

hosker4u 6y ago

GDPR does exist but should GDPR exist so people can cry about an odd email. No.

dannyw 6y ago
The 'odd email' is just irrefutable evidence of Cloudflare's retention of the poster's email address, which is considered personal data under GDPR. If Cloudflare is unable to even remove a deleted account from a mailing list, how do you know they have actually deleted ANY other information?
- ZWoz 6y ago
  General Data Protection Regulation don't exist in vacuum, other laws are regulating data handling. Most importantly, accounting related regulations. So, if you request your account deletion, all billing related information is still hold - that is probably 7 years in all EU countries. Sending unwanted mail for those addresses is different issue though, but having contact data as part of billing data is legal.
  - corty 6y ago
    Yes. But for all personal data the purposes for which it may be used is limited: generally[0] only the original reason for collecting the data or the legal basis for keeping the data dictate the uses. So anything kept for use in filing taxes or other bookkeeping obligations must only be used for those purposes. [0] it is possible to use data for other purposes than originally collected in some circumstances, but I'm not sure if there are many legal precedents for that yet.
lawtalkinghuman 6y ago
If Cloudflare can't get an email unsubscribe process to be GDPR compliant, should you trust them to handle the many far more privacy-relevant things they offer as a company...?
- tomhoward 6y ago
  I have no dog in the fight (I'm not connected or loyal to Crowdflare whatsoever), but this is a non sequitur. Companies work to priorities lists based on how important things are for customers. So it's perfectly plausible that the very reason they're not flawless at removing cancelled users from all their email databases is that they're too busy focusing on, as you put it, "the many far more privacy-relevant things they offer as a company", which they regard as far more important. I'm not saying that's definitely the case here; I have no idea of any specifics. But I've definitely seen things happen that way in other companies/teams I've observed.
- hosker4u 6y ago
  Yes, if they cant unsubscribe people. I could not care less, it bothers me more this guy crying about getting an email.

KingOfCoders 6y ago

I was downvoted last Cloudflare thread when I said I don't trust them. Why is the CTO deleting tweets? But because the last thread was about archive.org I love the fact that the tweet is archived on archive.org Sadly data protection agencies are understaffed and overwhelmed with requests. So if not hundreds of people complain about one company there will be no action (none of my complaints up to now has resulted in anything but notifications that I'm in a waiting queue - in some I'm for over a year now). "Our mission to help build a better Internet is rooted in the importance we place on establishing trust with our Customers, users, and the Internet community globally. To earn and maintain that trust, we commit to communicating transparently, providing security, and protecting the privacy of data on our systems."

detaro 6y ago
He seems to automatically remove all posts after a certain time (3 weeks or so), which isn't that unusual to do on Twitter.
- foxdev 6y ago
  It's the reasonable thing to do when context collapses so easily on tweets.
  - samtheprogram 6y ago
    Not when you’re the face of Cloudflare, or any other company that large. It looks very deceitful.
    - SteveNuts 6y ago
      Not to me. So long as it's consistently applied, it actually seems like the responsible thing to do when something completely innocuous posted on Twitter could cause damage to the company. To me it's similar to scheduled stock selling for CEOs, which gets rid of any doubt for whether there's insider trading.

Hamuko 6y ago

I made a GDPR data deletion request to a certain large website like a year ago. There was some caveat about retaining some data that they legally have to hold on. About 11 months after they confirmed that my data had been deleted, they sent me an email informing me about their changed Terms of Service. So I guess my email at least wasn't pruned. Who knows how much more data they are holding on.

dutchmartin 6y ago
I’ve had this like 3 times already. You had to mail customer support for data deletion, and after that, you got a mail with ‘are you satisfied with our help?’. Well hell no, because you still store my email adress.
isbvhodnvemrwvn 6y ago
If they need the e-mail address for legal reasons then you can not withdraw consent, as consent was not the legal basis for storing this data in the first place. They also correctly inform you about changes in the terms of service, as this likely affects the data they store on you (e.g. they might have another legal basis for storing it).
- donohoe 6y ago
  Just want to emphasize how correct this is. Legally, despite but you nay want, they can still store info like thus for narrow reasons. This is Beardsley and normal.
  - cxr 6y ago
    Even if true, neither you nor the person you're responding to see a distinction between: 1. retaining information because of a legal requirement and acting on their legal obligations as is necessary from time to time 2. retaining the information as above while saying that there's no such thing?
  - hyperdimension 6y ago
    I'm usually decent at mental-typo-correction and typically won't point it out, but is 'Beardsley' supposed to be 'ordinary?'

isbvhodnvemrwvn 6y ago

Please do notify your country's Data Protection Authority. This is unacceptable.

lawtalkinghuman 6y ago
The UK's ICO is remarkably ineffectual, sadly.
- Nextgrid 6y ago
  Doesn't hurt to try though - at least there will be a paper trail (plus public shaming) documenting their ineffectiveness.

cagenut 6y ago

You see this with nearly every SaaS provider. There's clearly a split between the email/pii in the control plane (admin dashboard) for your account, and then separate (often third party) spam tooling that they "sync" with, where the syncs work maaaaayyyybbeee 80% of the time. Department A handles the cplane (tech) and Department B handles the spam (marketing) and they try to go about their day/month/quarter with as little interaction as possible. The end result is how your data/email is handled in one is different than how its handled in another and they can often ping pong or feedback off each other in automated ways that make trying to unsubscribe a confusing game of playing byzantine generals with other peoples products. Now, just because I understand and sympathize with how things got this way, doesn't mean I'm not glad this guy is holding CFs feet to the fire for doing something about it. This emergent anti-pattern/"worst"-practice needs to improve, who better than the poster child for consumer tech saas.

fphhotchips 6y ago
I find the post to be pretty unnecessarily unforgiving; if you've worked in this industry for more than a minute, you understand how this sort of stuff happens. This is clearly not a marketing list - it's a compliance list on the first one, and a statuspage style one on the other. To call them spam is disingenuous, and to draw a line from "my email is on multiple lists and taking my name off one doesn't take it off all" to "Don't trust this company with your personal data" is really only fair if your email address is firstname.lastname.momsmaiden.childhooddog.bankaccountnumber.birthdate@gmail.com. Edit: I'm aware that GDPR considers email as confidential PII, but my post isn't legal advice. I just don't see my email as confidential.
- deleted 6y ago
  [deleted]

deleted 6y ago

[deleted]

sippingjippers 6y ago

I once sent a 20-ish page written letter of complaint about British Airways to the UK regulator before they finally unsubscribed me OP, make a complaint to the ICO, it actually works

jgrahamc 6y ago

I'm sorry that OP hasn't received a follow up communication, I've raised that internally to figure out why. But this was investigated and his email has been deleted and an explanation was meant to have been sent. I'm sorry that he hasn't received the explanation. PS I automatically delete tweets after two weeks. Have done for a long time.

_dibly 6y ago
I mean he's had the issue for a year now, and each time you personally say something along the lines of "I'll look into it" or "I've raised that internally" but he waited an entire year before he posted this. Saying 'sorry, should be fixed now' is kind of unacceptable and more than a little patronizing to the people here.
- cj 6y ago
  When you run a company with a lot of users, statistically mistakes are guaranteed to happen. What would you prefer his response be?
  - wolco2 6y ago
    You don't post I'll look into it internally multiple times and don't bother following up. I prefer no response or an honest one. No one benefits from a fake response.
  - yjftsjthsd-h 6y ago
    > What would you prefer his response be? If you get email that you're not supposed to get, it seems like marking it as spam is the logical option.
SimeVidas 6y ago
Can we expect this issue to now be resolved completely for all users, for example, if someone decides to delete their Cloudflare account today?
- 6y ago

peterwwillis 6y ago

I'd cut them a little slack time-wise to track down where they have your address. In a large organization it's common for many products to have their own sets of PII records (and mailing system) and no way to query them all, so if they don't know what product captured the address, it can take time to find it. It's also interesting just how many regulations deal with e-mail addresses. https://www.absolute.com/blog/are-email-addresses-confidential-data/ https://www.absolute.com/blog/are-email-addresses-confidenti...

luckylion 6y ago
> I'd cut them a little slack time-wise to track down where they have your address. More than a year?
corty 6y ago
There are constraints in GDPR as to how much slack they are cut. Deletions such as this one should take days at most, and complaints have to be handled within 4 weeks, another 4 weeks as an extension if exceedingly difficult. A year for a mailing list unsubscribe and the related complaint isn't just excessive, it is totally illegal. If the company's processes are not set up to handle the proscribed faster timeframes, it must not handle personal data at all. Doubly shocking since this is cloudflare, where a large percentage of the internets personal data passes through...

tuxone 6y ago

This post is a little bit harsh, but I can understand writer’s point of view and feelings. Anyway, if confirmed, it looks like cloudflare needs to fix some dem target lists. Moreover, none of these emails were marketing or personal stuff (except rcpt email address). IMHO we have GDPR in order to punish intentional bad behavior, not to prosecute incompetence.

zimpenfish 6y ago
> we have GDPR in order to punish intentional bad behavior, not to prosecute incompetence That was exclude any data breaches though, wouldn't it? Because they are always incompetence rather than intentional bad behaviour on the part of the breached companies.
- tuxone 6y ago
  Data breach will not disappear thanks to GDPR. GDPR tell you that you must, if possible, notify in case of data breach.
  - corty 6y ago
    Correct but incomplete: GDPR also tells you to use appropriate measures to prevent breaches. And of course if there was a breach, your measures were not appropriate so you need to change them.
lawtalkinghuman 6y ago
> we have GDPR in order to punish intentional bad behavior, not to prosecute incompetence Nope. It is to protect users. Users are harmed by both intentional bad behaviour and incompetence. This is the same principle as strict liability for product faults.
throwaway2048 6y ago
If incompetence is an acceptable excuse, every company interested in this tactics will become remarkably "incompetent".
6y ago

filleokus 6y ago

(Of course Cloudflare shouldn’t spam people who have quit their service). But I think posts like this explain why I’m not a huge GDPR fan yet. On the one hand we have enormous tracking empires, who most likely are maliciously compliant with GDPR. They have probably not lost much precision / revenue due to the legislation. Mostly business as usual. Then on the other side we have “normal” companies who are doing mostly “normal” crappy stuff all larger enterprises do. Clouddlare aren’t maliciously spamming people, they’re just incompetent handling their email lists. And sure it’s not a great look, but keeping someone’s email address around is probably not something governmental agencies should get involved in, in most cases. The tone used in this post would, for me, be appropriate if Cloudflare did something horrible with your data. Selling traffic infi to data-aggregation firms, having lax security for accessing your customer portal, beeing hacked and leaking data etc. Not “just” being sloppy with ther mailing lists.

luckylion 6y ago
> And sure it’s not a great look, but keeping someone’s email address around is probably not something governmental agencies should get involved in, in most cases. Why not? They are unwilling or unable to do it without government intervention. I agree that for an honest mistake you don't need the government to step in. But after a year and multiple tries and broken promises, it's not an honest mistake, it's either intentional or gross incompetence. I especially like that they keep stuff despite GDPR to "comply with internal policies and legal obligations". Making up an internal policy has no relevance to GDPR whatsoever (otherwise it would be quite easy "sorry, we have an internal policy to keep all your data forever"). Sounds like they simply don't care about GDPR.
lawtalkinghuman 6y ago
"Oh, my private data got leaked all over the darkweb, but it is fine because the company that collected it is merely incompetent rather than malicious", said nobody ever.
- cxr 6y ago
  Comments like this one are probably not helpful in the overall scheme. The people who agree with you (like me) already agree with you, and I strongly disagree with the way of thinking by the person you're responding to, especially wrt this piece: > Then on the other side we have “normal” companies who are doing mostly “normal” crappy stuff all larger enterprises do. Clouddlare aren’t maliciously spamming people, they’re just incompetent handling their email lists. ... but your comment seems to be mostly self-serving and geared towards points-scoring.

pilsetnieks 6y ago

They are definitely not managing their mailing lists efficiently. My case is somewhat different, not that I want to unsubscribe but at one point they started addressing me as Dick in all their mass marketing emails. That's despite the fact that my name is not Richard or any variation thereof, nor have I used that name to sign up for anything at Cloudflare. It began immediately after I shot down one pushy salesperson's "invitation to arrange a call or videoconference" for a product that I already told them would not work for me. Could be just a coincidence, though.

christophilus 6y ago
Wow. That’s some serious passive aggressive BS, if that really is the reason. Their sales team is really obnoxious and pushy from my limited experience. But that’s pretty true of most sales teams I’ve interacted with.
- nerdponx 6y ago
  Sounds more like said pushy salesperson didn't realize the OP would actually get email with that name attached.
- sosodev 6y ago
  I’ve also had a bad experience with Cloudflare’s sales team. I was testing out their workers platform very shortly after its initial release when I got an email from a guy at Cloudflare claiming to be looking for user feedback on workers. I agreed to talk to him and he continued to pretend it wasn’t a sales call. The minute the call started it was clear he didn’t want to hear anything I had to say about workers and began pressing me to tell him where I worked. I told him and the conversation immediately turned into “what can I do to get you guys a contract for workers?” The whole interaction was unsettling for me. Seems like a pretty sleezy sales tactic.
  - CraftThatBlock 6y ago
    I can also echo this. I was interesting in one of there products (can't remember which) and after a call where I said I was interested, and they never emailed me back, even after I sent a follow up. The self-serve platform is great and I wish all products were self-serve, because dealing with sale teams is very annoying when you're just trying to evaluate a product.

mehrdadn 6y ago

I care about privacy as much as anybody, but why make such a big outcry over such a minor infraction? An email address is one of the least private and most non-consequential pieces of information that could be retained about someone in this day and age. Which many other companies flagrantly abuse all the time with no shame. Yet compared to many other large companies, Cloudflare has been a company with at least a respectable reputation and track record. Does that not warrant treating them a little bit better than this? Is the fact that they were unable to unsubscribe a user really something that warrants alarming the HN community over? Is there such a dearth of hills to die on right now that this is what we should be outraged about today?

_dibly 6y ago
So you're basically saying we should give them the benefit of the doubt on not complying with GDPR because they have a good track record? It would be one thing if OP was receiving cookie-cutter responses from CloudFlare's support team, but the CEO repeatedly personally intervenes and makes assurances that simply aren't true (and he's already made the same promises in this thread). How can those promises be taken at face value when it's still a problem a year later?
- mehrdadn 6y ago
  No, I'm not saying anything about "doubt". I'm saying if a nice friend (or a non-friend for that matter) takes your pencil and insists for the next year that he'll return to you despite never doing so, maybe there's a better way to deal with this trauma than to crucify him in front of 7 billion people.
  - shean_massey 6y ago
    A better way, such as? You mean like writing email / tweet requests directly to those responsible? What's this magical alternative method? FWIW, this method seems to have worked where the reasonable and common methods clearly failed. He bought his own nails and cross when he promised action would be taken but failed to execute.

deleted 6y ago

[deleted]

metalliqaz 6y ago

I got into gmail during the beta and have a first-initial-last-name address that other people tend to use for signing up for services. There is a bank (PNC) that sends me emails all the time with no unsubscribe option. I don't have an account so they won't talk to me. It seems like a CAN-SPAM violation but I havn't bothered to look into how to actually sue for it. Edit: correct "PNY->"PNC"

gogopuppygogo 6y ago
Probably worth looking into. Sounds lucrative since PNC has money.
znpy 6y ago
i'm kinda in the same spot. I have "${lastname}${firstname}@gmail.com" and i routinely get emails directed to "${lastname}.${firstname}@gmail.com" (notice the dot in the middle). This was no big deal for me. But I received important documents (sometimes even legal document) that were not directed to me, at all. They were meant to be delivered to people in other areas of the country. This is because Google has moronically and unilaterally decided that the dots are not meaningful and that they are smart enough to understand who is the actual recipient of an email (spoiler: they are not). This also means that somebody else is also getting mail directed to me. This is super scary and made me distrust gmail as an email provider. Nowadays I keep my gmail account for my android phone only. But knowing I cannot trust the email address I am not confident to, for example, start using Google Cloud Platform with my private account.
- MarkSweep 6y ago
  I don’t think it is possible for someone to register a gmail account name that contains dots. Therefore the mail you are getting is just people sending it the wrong address. I also have a "${lastname}${firstname}@gmail.com" email account and experience misdirected emails somewhat frequently. I wish more websites supported a “delete and recreate your account” feature, because some of my account were principally created by someone else and I can’t edit the details (Hulu).

raverbashing 6y ago

> When we receive a request for account deletion, we may retain the email address on the account up to a year to ensure that we comply with internal policies and legal obligations. On this specific aspect, they're not wrong. For example, they might keep that info to contact past clients about breaches, tax compliance issues, etc. Sure it would be better if this issue was explicitly spelled out and maybe more specific, but it is not wrong. (Sure, using that email to warn about a downtime is outside of that scope)

PaulHoule 6y ago

If somebody unsubscribed from a mailing list and the unsubscribe was effective that would be on the front page of the New York Times; it might even displace Trump's latest temper tantrum for 5 min on CNN. I am always unsubscribing from email lists and still getting email later. That's why I almost always block email from the sender when I unsubscribe. My only regret is that I can't program my mail server to bounce the email message to have the bounce handler unsubscribe me and/or hurt their deliverability.

asien 6y ago

Nothing surprising here. Company like Cloudflare , Netlify etc... are generally built for Sale or to IPO. People in charge of this type of Startup care about two things Growth - ARR. It’s very common for those business to have multiples teams with their own « Mailing List » because it’s just faster and simpler to operate this way rather than having one single mailing system. Add to that Software Turnover and your good for some trouble just to get rid of something that should have never been a problem in the first place.

mcintyre1994 6y ago

They send emails without an unsubscribe link? What do people do when they get emails like that? I just mark as spam in Gmail, they go away but that's surely the last thing an email sender would want to have happen.

rightbyte 6y ago
They do? I have tried that in Gmail but it seems some domains are whitelisted so you can't mark them as spam.
cypres 6y ago
There are unsubscribe links on all their e-mails and I think the automatic unsubscribe feature too. What I really want to know is if the OP actually tried to unsubscribe or just went directly to twitter about still receiving e-mails after cancelling his account for that nice twitter/HN buzz?

thewebcount 6y ago

He could take the route that some people take with telemarketers. Take them to small claims court[0]. I remember reading about someone who went a step further. When they got a default judgement against a company and the company didn't pay, they put a lien on the owner's home so he couldn't ever sell it until he paid up. I don't know what that takes to do, but it sounds fun! [0]http://www.killthecalls.com/suing-telemarketers.php http://www.killthecalls.com/suing-telemarketers.php

kemonocode 6y ago

Obviously not the real solution, but at that point it's time to just mark their emails as spam as they would squarely fit the definition by then.

3gg 6y ago

It's definitely fairly shady. For what it's worth, they seem to have deleted my account. I say "seems" because I don't recall receiving a confirmation email; my login eventually just stopped working. At any rate, demanding that customers send an email to have their account deleted is ridiculous. Put a damn button in there already. And before any claims are made to the contrary, invoking "security" here is nonsense; if someone hacks my login, having my account deleted is the least of my problems.

umvi 6y ago

Seems a bit overdramatic. Just mark as spam or make a filter. I know it's the principle of the thing, but still, a bit over the top.

ilrwbwrkhv 6y ago

Just mark as spam. I actually mark everything as spam. I don't even click unsubscribe.

deleted 6y ago

[deleted]

slx26 6y ago

Look, memory synchronization is hard. Some operations might take a decade to achieve consistency.

mrmuagi 6y ago
Just push the consistency date past any human life span and the problem is solved.

ananonymoususer 6y ago

Cloudflare isn't the only one with this sort of problem. I continue to get email from FedEx every month instructing me to update my credit card information. The information they have on file is from a card that expired over 10 years ago, and I closed my account with them 12 years ago. I called them last month to ask them why they continue to send me these emails, and asked them to stop. Their response was that they cannot stop the emails. Even when I pointed out that my having no business relationship with them, and them not offering a way to opt-out is a violation of the "Can Spam" act, they shrugged.

cgb223 6y ago
You should call their bluff and file a complaint on them under the act I’d bet they’d fix it really quick once regulators get involved

Seb-C 6y ago

I had a positive view on Cloudflare until recently. I started using it for my project about 3 months ago. I was impressed by the available features and even started planning to spend more in the future (I have only been on the free plan). You can set-up a lot of things and even have a load-balancer. I was also impressed by the smooth and easy onboarding process. Unfortunately, after starting to use it I realized that my site was extremely slow for everything that is not cached. Cloudflare was adding 250ms of latency to every request to my server. I certainly did not expect that much. When you try to send a support ticket, they aggressively try to make you not do it. My support ticket did not receive an answer for 2 months. I stopped using it last week and will certainly not look back.

kakarukeys 6y ago

Same thing happened to me, but with Heroku/Salesforce. You can read about it here: https://news.ycombinator.com/item?id=21969358 https://news.ycombinator.com/item?id=21969358 Account was suspended about 10 months ago (for no reason given). I sent Heroku, Salesforce, their data protection officers emails asking them to remove my account, databases, codes, everything on it. I kept receiving notifications that an active account would receive. And their DPO lied to me that they have closed the account. Another US company doing that is not really a coincidence.