5 ms·

We caught companies making it harder to delete your personal data online

318 points by amarcheschi 1y ago

fnord77 1y ago
Is there any downside to requesting data brokers delete your personal data?
- amanaplanacanal 1y ago
  The biggest downside is that it's probably a waste of your time.
- anon_e-moose 1y ago
  If you reach out to them you're risking validating that the data they already have is somewhat accurate, plus they might demand more information from you. What do you get back from giving that?
- SilverElfin 1y ago
  my worry is that the request to delete data requires that you give them data about who you are. And who knows what they will do with that
droolboy 1y ago
Try trying to delete your open ai data. Even if you live somewhere with the right to forget or some protection they refuse the request unless you upload a copy of your ID. But then they have that data.
- amarcheschi 1y ago
  if you live in a eu, a gdpr request can be followed by a request to your id only if there is reasonable doubt that you're faking an identity. Groupon did this and had to stop: https://gdprhub.eu/index.php?title=DPC_(Ireland)_-_Groupon_Ireland_Operations_Limited https://gdprhub.eu/index.php?title=DPC_(Ireland)_-_Groupon_I...
- olddustytrail 1y ago
  I don't think there is a mechanism to do that. I think that puts all AI models in breach of the GDPR by default. I might be wrong but if I'm not that's a serious problem for AI companies.
datadrivenangel 1y ago
"After reviewing the websites of all 499 data brokers registered with the state, we found 35 had code to stop certain pages from showing up in searches." That's not as bad as I would have expected
stevekemp 1y ago
Of course you did. I've been submitting GDPR subject information requests to companies that spam me - and most of them ignore me. The ones that do take the time to reply usually say "We've deleted your personal data now", which is not at all what I want. I want to know what details they have about me, where they obtained it, and why they think spamming me is acceptable. I've got a folder where I keep printouts of the recent offenders, and once I get a few weeks of holiday I'll start filing small-claims cases against them.
- graemep 1y ago
  > I've got a folder where I keep printouts of the recent offenders, and once I get a few weeks of holiday I'll start filing small-claims cases against them. A rare case of doing God's work at a profit!
- Reubachi 1y ago
  Er, you're going to file multiple small claims in the US against (suspected) firms outside the US? Be prepared to be disappointed. There is 0 evidence/elements of damage in the eyes of the archaic courts in this case, as you have no evidence of being damaged. You may be annoyed, but you're not at psychical or monetary risk due to the actions of another. I disagree^ with the above, we live in the future where comm-spam is an inherent risk. However, I lost a small claims case where documented over 5 years Mazda put the wrong oil in my car. I found out after pouring through paperwork and seeing the line items/overcharging (22 instances of this.) Judge dismissed it due to no "damage." 3rd cylinder died a week later.
  - richij 1y ago
    Steve is in GDPR land, according to his profile page.
hendo3000 1y ago
Does deleting your data even matter if it's already been sold to a data broker?
- ChrisMarshallNY 1y ago
  What mugshot extortionists do, is charge you to delete your mugshot, then move it to another domain that they own.
  - nemomarx 1y ago
    "will pay to delete info" is one of the more valuable pieces of data about you after all
- Forgeties79 1y ago
  There’s still value in turning the faucet off if you ask me. Especially if you’ve hardened security/privacy practices to better protect yourself moving forward. I only got really serious about consistently using VPN’s, firewalls, adblockers, and more privacy centered browsers a few years ago. I would say over the last 8 to 12 months I finally started to see it pay off. I still don’t see a lot of ads if ever, and they are wildly off target when I do see them. Using email aliases that I regularly purge has also made a huge difference when it comes to password/info leaks in particular. Now if I could only get my damn phone number under control… so tired of the endless spam texts
- jboggan 1y ago
  If you are a California resident you can request a deletion via the state's new DROP platform which is launching next year. That will send the deletion request to every registered data broker in the state who will then have 45 days to comply. Part of that compliance is sending deletion notifications to everyone downstream that they have shared or sold your data to in the past. The penalty for not responding to a DROP request is going to be $200 a day, per request. Starting in 2028 CA registered data brokers will have to undergo audits to ensure that they have been complying with deletion requests to the fullest extent of the law. Now, maybe only 20% of actual data brokers are registered in California like they are supposed to be, but it's a start. Shameless plug: I'm building a platform to help the data brokers actually delete the data they are supposed to, provide full auditing and accounting for that process, and automate privacy request handling: forgetmenaut.com
amarcheschi 1y ago
btw, in europe, UK, turkey you should be able to use the official european digital advertisement alliance website to opt out from profiling from a bunch of ad providers: https://www.youronlinechoices.com/ https://www.youronlinechoices.com/
jFriedensreich 1y ago
And as important: making it impossible or very hard and annoying to export and own your data.
- cnst 1y ago
  Some companies somehow blatantly get away with not allowing any export at all. For example, Amazon eero, the overpriced WiFi router that doesn't even work (without phoning back home and having an app installed on your phone). They had an outage like a year ago, and during said outage, all your existing ad blocking stopped working, too, even if you never rebooted during the outage, and even though said blocking is supposed to be performed locally. I think you can't even get the ad blocking unless you or your ISP pays for the special subscription, either. (I imagine the thing could have removed all local ad blocking settings and lists during the time it couldn't confirm you're still a paying customer because their cloud was down?) Does anyone know how exactly does Amazon get away with not providing data export for their eero product? I haven't seen a Blink or Ring exports, either. The main Amazon dot com does have the export, which has some extensive data you may not think they do collect, but it doesn't cover eero, Blink or Ring.
  - Someone 1y ago
    > Does anyone know how exactly does Amazon get away with not providing data export for their eero product? I checked eero.com. It seems info about the product other than “it’s a secure WiFi router that doesn’t require users to manage it” is in the videos, if it is on that site at all, but I couldn’t get the videos to play, so I may be wrong, but why would a WiFi router have personal data on the device? It will have the username and password at your internet provider, but what else does it store?
    - williamscales 1y ago
      I’m guessing Amazon could have info on their side about your eero. Without knowing more about the router’s cloud functionality it’s hard to say what exactly they would have.
    - 1y ago
benjiro 1y ago
Here is another offender "VanceAI" ... Try deleting your account with the delete button. Nothing happens. Everything on the site perfect, just that Delete button is broken (and the request times out). But wait, you can send a ticket. Get response days later that it is marked as resolved. You go back to the site ... O, i am still logged in with my old session. Then you see your email: deleted_2544642405_blabla@gmail.com So fake "delete" by simply putting a deleted and some timestamp before your email address, while keeping your other data. O and the Delete button is also not fixed ;) Companies really only seem to learn with some hefty GDPR fines.
tracker1 1y ago
Has anyone used deleteme or a similar service? What was your experience, and do you feel it was worth it? It feels like such a cat and mouse game, that should be easy to automate, that said, I'm not sure it'll be effective.
- temp0826 1y ago
  I have (optery, not deleteme) and I think it's good to use at least once to clear out a buildup of your info out there. I couldn't justify paying for it monthly but if I was a semi-important person it might be worth it, or at least 1 or 2 months out of the year. Many brokers aren't responsive and it takes forever or never actually happens, and stuff definitely creeps back, but from what I can tell there is a heck of a lot less of me out there.
- neon_electro 1y ago
  I have used Incogni for a few years now, I was a little worried after the first year things wouldn't be worth the price, but I'm noticing that there are data brokers who will happily remove you but not put you on a block-list, meaning that they will happily ingest your information again if it comes to them, and another request from Incogni will be needed to remove it again. I'm on the fence about whether that's real value delivered from Incogni, but I do think overall it's working to limit some of the spread of my data.
  - buzer 1y ago
    > but not put you on a block-list, meaning that they will happily ingest your information again if it comes to them So since you don't know if they information or not, you should start sending them delete request every second? You know, just in case they got new data since the last request and we know it takes a while to actually process those requests.
725686 1y ago
Deleting your personal data is just an illusion. Companies just mark your data as "deleted", but keep the data anyway, in the best of cases just for auditing purposes. You will never, ever, be able to delete your data. Stop dreaming.
- johnisgood 1y ago
  Exactly, that is what I have been saying for ages. People think they can delete their messages on say, Discord. I tell them it is not deleted, just marked deleted. The data is still there.
- JoshTriplett 1y ago
  Don't stop dreaming. Keep fighting.
martin-t 1y ago
Here's how the law should work. You own the data you produce, both intentionally (writing, making videos) and unintentionally ("metadata", logs). You have to explicitly give others permission to use that data for any purpose where money exchanges hands (and many where it does not). You can limit or revoke the permission at any time.
- matheusmoreira 1y ago
  > You have to explicitly give others permission to use that data for any purpose This is already the case. All the contracts and terms of service documents already contain these permission clauses. People don't even read such things. The funniest contracts are the ones that say "by using this site, you agree to [surveillance capitalism]". People have to navigate the site in order to even read the contract so it's logically equivalent to writing "by reading this contract, you accept it". People need to start making laws that invalidate these silly documents.
  - martin-t 1y ago
    Yep, just like it's illegal to sell your organs or sell yourself into slavery, society needs to recognize that even through the severity of exploiting personal data is much lower, the principle is the same - the power differential between the two parties is so large that the weaker one has no choice but to agree. It's the illusion of choice that gives is the veneer of legitimacy.
- Reubachi 1y ago
  This is the case. In every aspect of life in which personal data is indexed/transmitted, the point of origin at least is some place you've explicitly indicated approval of this process. IF you walk into walmart, you are granting them the ability to sell your facial data and card metadata to whoever. No third party is calling your mobile provider to ask them to leak info. They are PAYING the mobile provider to leak them info that we provided express written consent for them to do so. TO avoid these ToS and binding agreements, you would need to live a disconnected agrarian lifestyle. Literally, can't walk into any corporate store. yay!
Vinnl 1y ago
> Telesign, a company that advertises fraud-prevention services for businesses, offers a simple form for “Data Deletion” and “Opt Out / Do Not Sell”. But that form is hidden from search engines and other automated systems, and isn’t linked on its homepage. > > Instead, consumers must search about 7,000 words into a privacy policy filled with legalese to find a link to the page. In fact, while they do have a robots.txt [1], their form [2] isn't actually listed there. Instead, the page itself has a meta tag: <meta name="robots" content="noindex, nofollow"> The reason is probably something mundane like this being easiest to do via the Wordpress UI, but putting on my conspiratorial hat, they just want to make it even hard to find out that they did this. (Disclosure: I work on Mozilla Monitor, where we try to help people send these data deletion requests.) [1] https://www.telesign.com/robots.txt https://www.telesign.com/robots.txt [2] https://www.telesign.com/privacy-requests https://www.telesign.com/privacy-requests
vanillax 1y ago
is there no tool or app or ai agent that cant just automatically request your data to be deleted?
freeAgent 1y ago
AI tools tend to ignore noindex, etc. when scraping training data, so finding data removal request forms may be a great use case for AI!
nothrowaways 1y ago
My kids are having a hard time deleting their Snapchat account.
dpoloncsak 1y ago
I'm not in support of the practice laid out in the article, but we're talking about robots.txt, right? I guess it was written for a less technical audience, but it makes it seem like they have JS or 'code' was specifically written to hide these from web crawlers. It makes more sense, in context, that companies could be unaware. Sure, a 'noindex' doesn't just show up, but how many were old configs disallowing *, and only allowing indexing on a few sites Edit: I didn't see the screenshot section. Most (of the few I spot-checked) are, in fact, noindex. I stand corrected
hoherd 1y ago
Google photos removed the delete api endpoint. Now, in order to delete your own photos from their service, you have to automate browser interactions that batch by batch delete your photos. I've just done this with both my wife's and my google photos accounts, and it took over 24 hours of browser interactions to fully delete everything. Ridiculous.
- 0xfffafaCrash 1y ago
  On a tangent, I don’t understand how Apple’s App Store allows the Google Photos app to insist on being given access to all photos on your device rather than selected photos to even work (even just to view photos shared elsewhere). Seems like an obvious violation of privacy and terms around not requiring unnecessary permissions. I think the app should be banned until they provide an option to gracefully respect users’ privacy settings rather than holding unrelated features hostage if they don’t get to spy on every photo on your device.
  - kassner 1y ago
    The worst part is that you can’t even browse your photos on Google without giving full local library permissions. If you want to upload nothing and just see the old stuff, gotta give them content to train their models.
megamindbrian2 1y ago
[dead]

318 points by amarcheschi 1y ago

fnord77 1y ago

Is there any downside to requesting data brokers delete your personal data?

amanaplanacanal 1y ago
The biggest downside is that it's probably a waste of your time.
anon_e-moose 1y ago
If you reach out to them you're risking validating that the data they already have is somewhat accurate, plus they might demand more information from you. What do you get back from giving that?
SilverElfin 1y ago
my worry is that the request to delete data requires that you give them data about who you are. And who knows what they will do with that

droolboy 1y ago

Try trying to delete your open ai data. Even if you live somewhere with the right to forget or some protection they refuse the request unless you upload a copy of your ID. But then they have that data.

amarcheschi 1y ago
if you live in a eu, a gdpr request can be followed by a request to your id only if there is reasonable doubt that you're faking an identity. Groupon did this and had to stop: https://gdprhub.eu/index.php?title=DPC_(Ireland)_-_Groupon_Ireland_Operations_Limited https://gdprhub.eu/index.php?title=DPC_(Ireland)_-_Groupon_I...
olddustytrail 1y ago
I don't think there is a mechanism to do that. I think that puts all AI models in breach of the GDPR by default. I might be wrong but if I'm not that's a serious problem for AI companies.

datadrivenangel 1y ago

"After reviewing the websites of all 499 data brokers registered with the state, we found 35 had code to stop certain pages from showing up in searches." That's not as bad as I would have expected

stevekemp 1y ago

Of course you did. I've been submitting GDPR subject information requests to companies that spam me - and most of them ignore me. The ones that do take the time to reply usually say "We've deleted your personal data now", which is not at all what I want. I want to know what details they have about me, where they obtained it, and why they think spamming me is acceptable. I've got a folder where I keep printouts of the recent offenders, and once I get a few weeks of holiday I'll start filing small-claims cases against them.

graemep 1y ago
> I've got a folder where I keep printouts of the recent offenders, and once I get a few weeks of holiday I'll start filing small-claims cases against them. A rare case of doing God's work at a profit!
Reubachi 1y ago
Er, you're going to file multiple small claims in the US against (suspected) firms outside the US? Be prepared to be disappointed. There is 0 evidence/elements of damage in the eyes of the archaic courts in this case, as you have no evidence of being damaged. You may be annoyed, but you're not at psychical or monetary risk due to the actions of another. I disagree^ with the above, we live in the future where comm-spam is an inherent risk. However, I lost a small claims case where documented over 5 years Mazda put the wrong oil in my car. I found out after pouring through paperwork and seeing the line items/overcharging (22 instances of this.) Judge dismissed it due to no "damage." 3rd cylinder died a week later.
- richij 1y ago
  Steve is in GDPR land, according to his profile page.

hendo3000 1y ago

Does deleting your data even matter if it's already been sold to a data broker?

ChrisMarshallNY 1y ago
What mugshot extortionists do, is charge you to delete your mugshot, then move it to another domain that they own.
- nemomarx 1y ago
  "will pay to delete info" is one of the more valuable pieces of data about you after all
Forgeties79 1y ago
There’s still value in turning the faucet off if you ask me. Especially if you’ve hardened security/privacy practices to better protect yourself moving forward. I only got really serious about consistently using VPN’s, firewalls, adblockers, and more privacy centered browsers a few years ago. I would say over the last 8 to 12 months I finally started to see it pay off. I still don’t see a lot of ads if ever, and they are wildly off target when I do see them. Using email aliases that I regularly purge has also made a huge difference when it comes to password/info leaks in particular. Now if I could only get my damn phone number under control… so tired of the endless spam texts
jboggan 1y ago
If you are a California resident you can request a deletion via the state's new DROP platform which is launching next year. That will send the deletion request to every registered data broker in the state who will then have 45 days to comply. Part of that compliance is sending deletion notifications to everyone downstream that they have shared or sold your data to in the past. The penalty for not responding to a DROP request is going to be $200 a day, per request. Starting in 2028 CA registered data brokers will have to undergo audits to ensure that they have been complying with deletion requests to the fullest extent of the law. Now, maybe only 20% of actual data brokers are registered in California like they are supposed to be, but it's a start. Shameless plug: I'm building a platform to help the data brokers actually delete the data they are supposed to, provide full auditing and accounting for that process, and automate privacy request handling: forgetmenaut.com

amarcheschi 1y ago

btw, in europe, UK, turkey you should be able to use the official european digital advertisement alliance website to opt out from profiling from a bunch of ad providers: https://www.youronlinechoices.com/ https://www.youronlinechoices.com/

jFriedensreich 1y ago

And as important: making it impossible or very hard and annoying to export and own your data.

cnst 1y ago
Some companies somehow blatantly get away with not allowing any export at all. For example, Amazon eero, the overpriced WiFi router that doesn't even work (without phoning back home and having an app installed on your phone). They had an outage like a year ago, and during said outage, all your existing ad blocking stopped working, too, even if you never rebooted during the outage, and even though said blocking is supposed to be performed locally. I think you can't even get the ad blocking unless you or your ISP pays for the special subscription, either. (I imagine the thing could have removed all local ad blocking settings and lists during the time it couldn't confirm you're still a paying customer because their cloud was down?) Does anyone know how exactly does Amazon get away with not providing data export for their eero product? I haven't seen a Blink or Ring exports, either. The main Amazon dot com does have the export, which has some extensive data you may not think they do collect, but it doesn't cover eero, Blink or Ring.
- Someone 1y ago
  > Does anyone know how exactly does Amazon get away with not providing data export for their eero product? I checked eero.com. It seems info about the product other than “it’s a secure WiFi router that doesn’t require users to manage it” is in the videos, if it is on that site at all, but I couldn’t get the videos to play, so I may be wrong, but why would a WiFi router have personal data on the device? It will have the username and password at your internet provider, but what else does it store?
  - williamscales 1y ago
    I’m guessing Amazon could have info on their side about your eero. Without knowing more about the router’s cloud functionality it’s hard to say what exactly they would have.
  - 1y ago

benjiro 1y ago

Here is another offender "VanceAI" ... Try deleting your account with the delete button. Nothing happens. Everything on the site perfect, just that Delete button is broken (and the request times out). But wait, you can send a ticket. Get response days later that it is marked as resolved. You go back to the site ... O, i am still logged in with my old session. Then you see your email: deleted_2544642405_blabla@gmail.com So fake "delete" by simply putting a deleted and some timestamp before your email address, while keeping your other data. O and the Delete button is also not fixed ;) Companies really only seem to learn with some hefty GDPR fines.

tracker1 1y ago

Has anyone used deleteme or a similar service? What was your experience, and do you feel it was worth it? It feels like such a cat and mouse game, that should be easy to automate, that said, I'm not sure it'll be effective.

temp0826 1y ago
I have (optery, not deleteme) and I think it's good to use at least once to clear out a buildup of your info out there. I couldn't justify paying for it monthly but if I was a semi-important person it might be worth it, or at least 1 or 2 months out of the year. Many brokers aren't responsive and it takes forever or never actually happens, and stuff definitely creeps back, but from what I can tell there is a heck of a lot less of me out there.
neon_electro 1y ago
I have used Incogni for a few years now, I was a little worried after the first year things wouldn't be worth the price, but I'm noticing that there are data brokers who will happily remove you but not put you on a block-list, meaning that they will happily ingest your information again if it comes to them, and another request from Incogni will be needed to remove it again. I'm on the fence about whether that's real value delivered from Incogni, but I do think overall it's working to limit some of the spread of my data.
- buzer 1y ago
  > but not put you on a block-list, meaning that they will happily ingest your information again if it comes to them So since you don't know if they information or not, you should start sending them delete request every second? You know, just in case they got new data since the last request and we know it takes a while to actually process those requests.

725686 1y ago

Deleting your personal data is just an illusion. Companies just mark your data as "deleted", but keep the data anyway, in the best of cases just for auditing purposes. You will never, ever, be able to delete your data. Stop dreaming.

johnisgood 1y ago
Exactly, that is what I have been saying for ages. People think they can delete their messages on say, Discord. I tell them it is not deleted, just marked deleted. The data is still there.
JoshTriplett 1y ago
Don't stop dreaming. Keep fighting.

martin-t 1y ago

Here's how the law should work. You own the data you produce, both intentionally (writing, making videos) and unintentionally ("metadata", logs). You have to explicitly give others permission to use that data for any purpose where money exchanges hands (and many where it does not). You can limit or revoke the permission at any time.

matheusmoreira 1y ago
> You have to explicitly give others permission to use that data for any purpose This is already the case. All the contracts and terms of service documents already contain these permission clauses. People don't even read such things. The funniest contracts are the ones that say "by using this site, you agree to [surveillance capitalism]". People have to navigate the site in order to even read the contract so it's logically equivalent to writing "by reading this contract, you accept it". People need to start making laws that invalidate these silly documents.
- martin-t 1y ago
  Yep, just like it's illegal to sell your organs or sell yourself into slavery, society needs to recognize that even through the severity of exploiting personal data is much lower, the principle is the same - the power differential between the two parties is so large that the weaker one has no choice but to agree. It's the illusion of choice that gives is the veneer of legitimacy.
Reubachi 1y ago
This is the case. In every aspect of life in which personal data is indexed/transmitted, the point of origin at least is some place you've explicitly indicated approval of this process. IF you walk into walmart, you are granting them the ability to sell your facial data and card metadata to whoever. No third party is calling your mobile provider to ask them to leak info. They are PAYING the mobile provider to leak them info that we provided express written consent for them to do so. TO avoid these ToS and binding agreements, you would need to live a disconnected agrarian lifestyle. Literally, can't walk into any corporate store. yay!

Vinnl 1y ago

> Telesign, a company that advertises fraud-prevention services for businesses, offers a simple form for “Data Deletion” and “Opt Out / Do Not Sell”. But that form is hidden from search engines and other automated systems, and isn’t linked on its homepage. > > Instead, consumers must search about 7,000 words into a privacy policy filled with legalese to find a link to the page. In fact, while they do have a robots.txt [1], their form [2] isn't actually listed there. Instead, the page itself has a meta tag: <meta name="robots" content="noindex, nofollow"> The reason is probably something mundane like this being easiest to do via the Wordpress UI, but putting on my conspiratorial hat, they just want to make it even hard to find out that they did this. (Disclosure: I work on Mozilla Monitor, where we try to help people send these data deletion requests.) [1] https://www.telesign.com/robots.txt https://www.telesign.com/robots.txt [2] https://www.telesign.com/privacy-requests https://www.telesign.com/privacy-requests

vanillax 1y ago

is there no tool or app or ai agent that cant just automatically request your data to be deleted?

freeAgent 1y ago

AI tools tend to ignore noindex, etc. when scraping training data, so finding data removal request forms may be a great use case for AI!

nothrowaways 1y ago

My kids are having a hard time deleting their Snapchat account.

dpoloncsak 1y ago

I'm not in support of the practice laid out in the article, but we're talking about robots.txt, right? I guess it was written for a less technical audience, but it makes it seem like they have JS or 'code' was specifically written to hide these from web crawlers. It makes more sense, in context, that companies could be unaware. Sure, a 'noindex' doesn't just show up, but how many were old configs disallowing *, and only allowing indexing on a few sites Edit: I didn't see the screenshot section. Most (of the few I spot-checked) are, in fact, noindex. I stand corrected

hoherd 1y ago

Google photos removed the delete api endpoint. Now, in order to delete your own photos from their service, you have to automate browser interactions that batch by batch delete your photos. I've just done this with both my wife's and my google photos accounts, and it took over 24 hours of browser interactions to fully delete everything. Ridiculous.

0xfffafaCrash 1y ago
On a tangent, I don’t understand how Apple’s App Store allows the Google Photos app to insist on being given access to all photos on your device rather than selected photos to even work (even just to view photos shared elsewhere). Seems like an obvious violation of privacy and terms around not requiring unnecessary permissions. I think the app should be banned until they provide an option to gracefully respect users’ privacy settings rather than holding unrelated features hostage if they don’t get to spy on every photo on your device.
- kassner 1y ago
  The worst part is that you can’t even browse your photos on Google without giving full local library permissions. If you want to upload nothing and just see the old stuff, gotta give them content to train their models.

megamindbrian2 1y ago

[dead]