225
Reddit user alleges California Consumer Privacy Act (CCPA) non-compliance/violation; and finds it difficult to delete posts and content on Reddit (youtube.com)
submitted 2 years ago* (last edited 2 years ago) by malloc@lemmy.world to c/reddit@lemmy.world
113 comments fedilink hide all child comments

Video description as of 2023-06-23 10:15 PDT:

This video shows that Reddit refused to delete all comments and posts of its users when they close their account via a CCPA / GDPR request. Posts and comments may contain PII. Specifically, Reddit tells users that they must delete the content themselves, which isn't realistic if a user creates a lot of posts. Even if a user does delete their content, Reddit restores the content within a few days.

Video transcript:

  • 2023-06-13 @ 15:15 PDT: user states he deleted all posts and comments
  • 2023-06-16 @ 10:15 PDT (3 days later): user states all posts and comments have been restored
  • 2023-06-19: user decides to submit a legal request under CCPA to delete content
  • 2023-06-19 @ 11:07 PDT: user receives reply from "Reddit Legal Support" (RLS) which states they will delete the account but not the content associated with the account. It is up to the owner of the account to remove the content [e-mail contents reproduced below]
Reddit Legal Support (Reddit Support)
Jun 19, 2023, 11:07 PDT

Hello,

We would be happy to help you delete your Reddit account if you have one. Before we proceed please note:

 1. Account deletion is irreversible.
 2. Posts and comments must be separately deleted before deleting your account. If not separately deleted, the content of the posts and comments will remain visible and disassociated from any account. If you want your posts and comments removed, follow the instructions on our help page. 

Once the above mentioned information is removed to your satisfaction, please submit your deletion request by using your Reddit account and this form so we know it's really you making the request.

More information about account deletion is available in our Privacy Policy.

Kind regards,

Reddit Legal Support
  • 2023-06-19 @ 12:02 PDT: user replies back to RLS stating it is unrealistic expectation for end user to manually delete and alleges violation of CCPA [reply reproduced below]
Hello,

If I understand your response properly, you are refusing to delete all data associated with my account. I believe this is illegal and in violation of the CPR. In this case the onus is on you, Reddit, to delete all of the content associated with my account. 

It is besides the point but last week I already deleted all of the posts and comments associated with my account. However Reddit has since restored most of the content.

It is untenable to demand all users to manually delete content when Reddit itself does not provide a self-serve mechanism to mass-delete content. Some users have thousands of posts and millions of comments. 

Just as a reminder, my CPA request to delete my account and all associated data was made on June 19th 2023 and must be completed by August 3rd 2023.
  • 2023-06-24 @ 10:45 PDT: user has not received a reply from RLS. He decided to painstakingly delete all posts and comments while screen recording the effort. Video continues with the user manually deleting posts for his account (https://www.reddit.com/user/nucleocide). Then fast forwards to the end of the segment where the last posts are deleted
  • 2023-06-25 @ 10:25 PDT: user discovers posts and comments are restored, again

User concludes video and clarifies why this is a violation of CCPA:

At this point it appears impossible to manually delete posts and comments on Reddit and expect them to stay deleted. 

By not deleting all posts and comments in an automated way there is no way to guarantee that no PII [Personally Identifiable Information] has been left behind.

For example ...

<user gives example of a comment from 6 months ago on his account which includes his real first name and last name. Screen capture shows the comment was edited recently>

Since there is no guarantee that every single post and comment is free from PII, Reddit must delete all comments and posts from an account upon receiving a GDPR / CPA request.

Reddit Discussion on "/r/videos": https://old.reddit.com/r/videos/comments/14je01k/reddit_may_be_violating_the_fucking_ccpa/

[2023-06-23 14:52 PDT] edit ~ formatting, fix title typo

top 50 comments
sorted by: hot top controversial new old
[-] malloc@lemmy.world 23 points 2 years ago

Decided to expand on the original video and include a transcription of the events in the video. Hope this helps our visually impaired folks.

Personally, I find this disgusting. Hope Reddit gets litigated up the ass.

[-] nevernevermore@kbin.social 7 points 2 years ago

Seriously, thank you for that extra mile. This is the kind selflessness that I remember on the old internet

[-] Merulox@lemmy.world 6 points 2 years ago

Good work on the transcription, it must've taken a while to do.

[-] malloc@lemmy.world 3 points 2 years ago* (last edited 2 years ago)

Normally, transcription like this will take a long time. However, since it's largely text based (e-mails, viewing reddit) and relatively short. It was pretty easy to transcribe to text. With the help of some macOS features like copying and pasting from video, it became a ~~non~~-trivial task.

I think I spent more time on formatting rather than on transcription.

load more comments (3 replies)
load more comments (1 replies)
[-] pollodiabolo@kbin.social 12 points 2 years ago

so the CEO known for sharing pornographic pictures of minors online does not respect people's privacy after all? who would've thought

[-] nevernevermore@kbin.social 5 points 2 years ago

I’m OOTL, spez did what now?

[-] 1st@kbin.social 7 points 2 years ago

Spez was a mod of /r/jailbait

Worth noting that at the time users did not need to agree to be a moderator, it could be thrust upon them. I've heard that he had comments both on the sub and comments defending it, but have not personally seen any proof of that.

It's not strictly untrue, but it has implications that I don't personally quite believe (though I'm willing to change that opinion if somebody has evidence).

[-] Bonehead@kbin.social 3 points 2 years ago

Spez was a mod of the jailbait sub before the corporate buyout shut it down. Technically we don't know if he shared any pictures, but we know he was a mod at one point.

load more comments (2 replies)
[-] holdthemayo@programming.dev 3 points 2 years ago* (last edited 2 years ago)

Back in the day invitations to be a mod were auto-accepted so the mod of /r/jailbait added him to the modlist

The guy's a crappy CEO I'm not sure why people have meme about stupid shit like the above to distract from that especially on the fediverse which has it's share of questionable content

[-] NMSGalacticHub@lemmy.world 11 points 2 years ago

That's insane. I'm no lawyer but I've used the CCPA to get my info removed from a lot of those data-broker sites. It's always immediate, "Okay, we've removed your information." California better hit Reddit hard for this, and Europe too.

[-] witch_of_winter@fedia.io 11 points 2 years ago

If anyone here lives in California and has had reddit violate their rights you can file a complaint here: https://oag.ca.gov/contact/consumer-complaint-against-business-or-company

[-] YellowtoOrange@lemmy.world 9 points 2 years ago

https://codepen.io/Deestan/full/gOQagRO/

Deletes all comments or swap them with anything eg "I've moved to Lemmy"

load more comments (6 replies)
[-] greenmarty@lemmy.world 9 points 2 years ago

EU GDPR - where to report if someone refuses to delete personal data.
List of institutions for each EU member.: https://edpb.europa.eu/about-edpb/about-edpb/members_en

[-] yeeter@lemmy.world 8 points 2 years ago* (last edited 2 years ago)

Discord is worse. At least Reddit lets you delete everything you post. With Discord, if you are banned from a server, then there is no way to delete your posts in that server. That is insane to me in this day and age.

[-] oaklandnative@lemmy.world 4 points 2 years ago

Yes, reddit let's you delete everything you post but then they secretly repost it all a few days later. I'd argue that's worse because they make you think it's deleted but it's not.

This behavior is demonstrated in the video and many other reddit users have posted similar complaints recently. I have personally experienced the same issue.

load more comments (1 replies)
load more comments (1 replies)
[-] Techie@lemmy.world 7 points 2 years ago

I really hope the GDPR is put to full use here.

I'm curious though, what would happen if someone sent a GDPR deletion request to a Lemmy instance? The server admin would then delete the posts and account, but what if some other instances had defederated after the user made the posts, how would it be possible to make sure the posts are deleted from those instances as well? In theory that could be hundreds of servers. I guess the user would have to reach out to each instance?

[-] samus12345@lemmy.world 6 points 2 years ago

Good question. Yes, it would be much harder because you're basically shotgunning your posts all over the place when posting here. I would think it's pretty much impossible to make sure that every single instance of it is gone.

load more comments (1 replies)
[-] HerrLewakaas@lemmy.world 7 points 2 years ago

This seems enough to me to sue them on grounds of violating the GDPR. Not sure where spez is going with this but paying GDPR fines will most definitely not do any good to reddit's profitability lol

load more comments (21 replies)
[-] xptiger@lemmy.world 7 points 2 years ago

Keep upvoting for algorithm. Keep updating to never die. Keep disseminating to those unheard. Keep EDUCATING. So people on Internet will eventually get ourselves the insight to ponder and make (mass and individual) actions on ourselves (cause only us the mass will steer a happening ~~and slap his stubborness~~).

Should never let this go down and covered.

I bet that this video/problem will never solve/succeed if people do not become considerate and woke but just read and passby from this. Protests seem not working to my perspectives. But, mass (compliant and infallible) actions ensures changes.

[-] AlphaLordTennyson@lemmy.world 3 points 2 years ago

Was this written by an AI?

load more comments (4 replies)
[-] Maggoty@lemmy.world 6 points 2 years ago* (last edited 2 years ago)

Well shoot. I'm in California these days and recently deleted all my comments on Reddit. I'll have to monitor and see if they come back...

Edit - update, it looks like they've restored some but not others. That might have something to do with the multiple overwrites I did.

[-] witch_of_winter@fedia.io 4 points 2 years ago

Since some have been restored you can now file a complaint with California. https://oag.ca.gov/contact/consumer-complaint-against-business-or-company

load more comments (3 replies)
[-] thatwill@lemmy.world 6 points 2 years ago

I made a GDPR request through reddithelp.com last night; maybe I shouldn't have bothered! Assuming I don't hear back, I'll resend the request via email then report them to the Information Commissioner (UK gov dept) if I've had no proper response.

By the way, I'm not sure if the California law is the same, but with a GDPR "right to be forgotten" request, the organisation must delete your data from their backups (or at least make sure your data will not be restored from a backup). Asking you to delete your own comments clearly won't meet that requirement.

[-] Tired8281@lemmy.world 3 points 2 years ago

I'm gonna send mine registered mail. The way they have been behaving, I wouldn't put it past them to just send requests straight to the trash, then claim they never received them with a shit eating grin on their face.

load more comments (1 replies)
[-] Maraval26@lemmy.world 6 points 2 years ago

That is crazy. I spent hours one week ago deleting manually all my comments. I had an empty profile. After reading this post I checked my account and all my comments are back. That is crazy. What a shit company. I’m hesitant to submit GDPR request since I feel like I’ll lost account access with comments still visible…

[-] overlordror@lemmy.world 3 points 2 years ago

I guarantee most power users are the ones who are upset about this change. Losing decades of content they created for free hurts reddit unimaginably. How many articles have you seen about SEO ruining Google and needing to append 'reddit' to searches?

Power users deleting their content ruins that search engine to reddit pipeline.

load more comments (1 replies)
[-] Rand_alFlagg@lemmy.world 5 points 2 years ago

I had to DMCA some of my stuff off the site to get it to stay off.

[-] Fangslash@lemmy.world 5 points 2 years ago

Quick question: is there any similar law in Australia?

[-] gila@lemmy.world 4 points 2 years ago* (last edited 2 years ago)

From my quick reading Privacy Act 1988 and GDPR are fairly consistent with eachother, but our legislation is a bit outdated. It seems to be amended every few months, but only in relation to niche clauses that cover very specific circumstances about someone in a particular role and their specific ability to interact with data.

-There is no distinction in Privacy Act between a data processor and a data controller. GDPR regulates individual responsibilities for both.

-In the Privacy Act there's nothing to stop multiple de-identified datasets from being cross referenced together in a way that could re-identify the data subject.

-The legal basis to protect consumers from collection of personally identifiable data is stronger under GDPR. The only thing an Aus organisation needs to do to collect sensitive data is establish that it's 'reasonably necessary' for their core business operation.

Also note that although GDPR is a European union regulation, many Australian businesses are still beholden to it, e.g. if they knowingly collect information from European customers or have a branch located in EU. You can't really have an EU branch that's GDPR-compliant if your parent company overseas isn't.

[-] ja2@lemmy.world 3 points 2 years ago

This post says it pretty well, I'll just leave this here in case anyone wants an editorial.

[-] oyenyaaow@lemmy.zip 3 points 2 years ago

response video by Louis Rossmann

load more comments
view more: next ›
this post was submitted on 26 Jun 2023
225 points (100.0% liked)

Reddit

17793 readers
594 users here now

News and Discussions about Reddit

Welcome to !reddit. This is a community for all news and discussions about Reddit.

The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:

Rules

Rule 1- No brigading.

**You may not encourage brigading any communities or subreddits in any way. **

YSKs are about self-improvement on how to do things.

Rule 2- No illegal or NSFW or gore content.

**No illegal or NSFW or gore content. **

Rule 3- Do not seek mental, medical and professional help here.

Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.

Rule 4- No self promotion or upvote-farming of any kind.

That's it.

Rule 5- No baiting or sealioning or promoting an agenda.

Posts and comments which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.

Rule 6- Regarding META posts.

Provided it is about the community itself, you may post non-Reddit posts using the [META] tag on your post title.

Rule 7- You can't harass or disturb other members.

If you vocally harass or discriminate against any individual member, you will be removed.

Likewise, if you are a member, sympathiser or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people, and you were provably vocal about your hate, then you will be banned on sight.

Rule 8- All comments should try to stay relevant to their parent content.

Rule 9- Reposts from other platforms are not allowed.

Let everyone have their own content.

:::spoiler Rule 10- Majority of bots aren't allowed to participate here.

founded 2 years ago
MODERATORS
ja2@lemmy.world
Rooki@lemmy.world
Thekingoflorda@lemmy.world
_MoveSwiftly@lemmy.world
L3s@lemmy.world