Reddit @lemmy.world malloc @lemmy.world 2y ago

Reddit user alleges California Consumer Privacy Act (CCPA) non-compliance/violation; and finds it difficult to delete posts and content on Reddit

Video description as of 2023-06-23 10:15 PDT:

This video shows that Reddit refused to delete all comments and posts of its users when they close their account via a CCPA / GDPR request. Posts and comments may contain PII. Specifically, Reddit tells users that they must delete the content themselves, which isn't realistic if a user creates a lot of posts. Even if a user does delete their content, Reddit restores the content within a few days.

Video transcript:

2023-06-13 @ 15:15 PDT: user states he deleted all posts and comments
2023-06-16 @ 10:15 PDT (3 days later): user states all posts and comments have been restored
2023-06-19: user decides to submit a legal request under CCPA to delete content
2023-06-19 @ 11:07 PDT: user receives reply from "Reddit Legal Support" (RLS) which states they will delete the account but not the content associated with the account. It is up to the owner of the account to remove the content [e-mail contents reproduced below]

Reddit Legal Support (Reddit Support)
Jun 19, 2023, 11:07 PDT

Hello,

We would be happy to help you delete your Reddit account if you have one. Before we proceed please note:

 1. Account deletion is irreversible.
 2. Posts and comments must be separately deleted before deleting your account. If not separately deleted, the content of the posts and comments will remain visible and disassociated from any account. If you want your posts and comments removed, follow the instructions on our help page. 

Once the above mentioned information is removed to your satisfaction, please submit your deletion request by using your Reddit account and this form so we know it's really you making the request.

More information about account deletion is available in our Privacy Policy.

Kind regards,

Reddit Legal Support

2023-06-19 @ 12:02 PDT: user replies back to RLS stating it is unrealistic expectation for end user to manually delete and alleges violation of CCPA [reply reproduced below]

Hello,

If I understand your response properly, you are refusing to delete all data associated with my account. I believe this is illegal and in violation of the CPR. In this case the onus is on you, Reddit, to delete all of the content associated with my account. 

It is besides the point but last week I already deleted all of the posts and comments associated with my account. However Reddit has since restored most of the content.

It is untenable to demand all users to manually delete content when Reddit itself does not provide a self-serve mechanism to mass-delete content. Some users have thousands of posts and millions of comments. 

Just as a reminder, my CPA request to delete my account and all associated data was made on June 19th 2023 and must be completed by August 3rd 2023.

2023-06-24 @ 10:45 PDT: user has not received a reply from RLS. He decided to painstakingly delete all posts and comments while screen recording the effort. Video continues with the user manually deleting posts for his account (https://www.reddit.com/user/nucleocide). Then fast forwards to the end of the segment where the last posts are deleted
2023-06-25 @ 10:25 PDT: user discovers posts and comments are restored, again

User concludes video and clarifies why this is a violation of CCPA:

At this point it appears impossible to manually delete posts and comments on Reddit and expect them to stay deleted. 

By not deleting all posts and comments in an automated way there is no way to guarantee that no PII [Personally Identifiable Information] has been left behind.

For example ...

<user gives example of a comment from 6 months ago on his account which includes his real first name and last name. Screen capture shows the comment was edited recently>

Since there is no guarantee that every single post and comment is free from PII, Reddit must delete all comments and posts from an account upon receiving a GDPR / CPA request.

Reddit Discussion on "/r/videos": https://old.reddit.com/r/videos/comments/14je01k/reddit_may_be_violating_the_fucking_ccpa/

[2023-06-23 14:52 PDT] edit ~ formatting, fix title typo

111

111 comments

Decided to expand on the original video and include a transcription of the events in the video. Hope this helps our visually impaired folks.

Personally, I find this disgusting. Hope Reddit gets litigated up the ass.
so the CEO known for sharing pornographic pictures of minors online does not respect people's privacy after all? who would've thought
That's insane. I'm no lawyer but I've used the CCPA to get my info removed from a lot of those data-broker sites. It's always immediate, "Okay, we've removed your information." California better hit Reddit hard for this, and Europe too.
If anyone here lives in California and has had reddit violate their rights you can file a complaint here: https://oag.ca.gov/contact/consumer-complaint-against-business-or-company
EU GDPR - where to report if someone refuses to delete personal data.
List of institutions for each EU member.: https://edpb.europa.eu/about-edpb/about-edpb/members_en
https://codepen.io/Deestan/full/gOQagRO/

Deletes all comments or swap them with anything eg "I've moved to Lemmy"
This seems enough to me to sue them on grounds of violating the GDPR. Not sure where spez is going with this but paying GDPR fines will most definitely not do any good to reddit's profitability lol
Keep upvoting for algorithm. Keep updating to never die. Keep disseminating to those unheard. Keep EDUCATING. So people on Internet will eventually get ourselves the insight to ponder and make (mass and individual) actions on ourselves (cause only us the mass will steer a happening ~~and slap his stubborness~~).

Should never let this go down and covered.

I bet that this video/problem will never solve/succeed if people do not become considerate and woke but just read and passby from this. Protests seem not working to my perspectives. But, mass (compliant and infallible) actions ensures changes.
I really hope the GDPR is put to full use here.

I'm curious though, what would happen if someone sent a GDPR deletion request to a Lemmy instance? The server admin would then delete the posts and account, but what if some other instances had defederated after the user made the posts, how would it be possible to make sure the posts are deleted from those instances as well? In theory that could be hundreds of servers. I guess the user would have to reach out to each instance?
Well shoot. I'm in California these days and recently deleted all my comments on Reddit. I'll have to monitor and see if they come back...

Edit - update, it looks like they've restored some but not others. That might have something to do with the multiple overwrites I did.
I made a GDPR request through reddithelp.com last night; maybe I shouldn't have bothered! Assuming I don't hear back, I'll resend the request via email then report them to the Information Commissioner (UK gov dept) if I've had no proper response.

By the way, I'm not sure if the California law is the same, but with a GDPR "right to be forgotten" request, the organisation must delete your data from their backups (or at least make sure your data will not be restored from a backup). Asking you to delete your own comments clearly won't meet that requirement.
That is crazy. I spent hours one week ago deleting manually all my comments. I had an empty profile. After reading this post I checked my account and all my comments are back. That is crazy. What a shit company. I’m hesitant to submit GDPR request since I feel like I’ll lost account access with comments still visible…
I had to DMCA some of my stuff off the site to get it to stay off.
Quick question: is there any similar law in Australia?
This post says it pretty well, I'll just leave this here in case anyone wants an editorial.
response video by Louis Rossmann
Is there bot / tool to edit my reddit posts in batch ? Seems that editing could be harder to mass reverse as it requires someone to review if the edit was for better or worse.

Alternatively to keep on deleting my reddit posts every day ?
Is anyone surprised at this?

I think Reddit should be forced to retroactively delete all comments and post history from users who have since deleted their account. If the user account was deleted, there is no reason they should be allowed to keep the data on that deleted account, period.
Call them out on LinkedIn. Bet.
I am obviously not a lawyer but I don't see how Reddit is in the wrong here. On GDPR.EU that "The EU’s GDPR only applies to personal data, which is any piece of information that relates to an identifiable person. It’s crucial for any business with EU consumers to understand this concept for GDPR compliance." I don't see how your comment history would be considered "personal data".

It even says in Reddit's TOS that "When Your Content is created with or submitted to the Services, you grant us a worldwide, royalty-free, perpetual, irrevocable, non-exclusive, transferable, and sublicensable license to use, copy, modify, adapt, prepare derivative works of, distribute, store, perform, and display Your Content and any name, username, voice, or likeness provided in connection with Your Content in all media formats and channels now known or later developed anywhere in the world".

You've agreed that your posts are no longer your "personal data" at that point...
Just use shreddit..
Interesting, from a GDPR perspective this is unacceptable.
Pondering about a proper GDPR complaint.

some of my old reddit accounts might have > 1000 comments.
It's funny. I got a little drunk and posted something on Reddit I really ought not have. I went back a day later and deleted it. A day after that, the comment came back, and I was suspended for three days over it. If you hadn't brought that comment back from the dead, this wouldn't even have happened, but okay, whatever. It wasn't like I wanted to spent too much time at Reddit after the lemur-eyed, horse-teethed worm told us how expendable we all are as users.
Worth noting Colorado and very recently Connecticut have similar laws, so the complaint could be leveraged from multiple states.
I have been removing my posts from Reddit over the last week and have found that you don't see and can't remove posts from subreddits that you don't have access to. I keep seeing sets of posts all from the same subreddit as they come out of blackout.
It's not possible to find all your Reddit content. Even using tools, you won't do it. The only way is to google your username and maybe you'll get some hits.

111 comments