Reddit violates CCPA
youtu.be
This video shows that Reddit refused to delete all comments and posts of its users when they close their account via a CCPA / GDPR request. Posts and comment...

cross-posted from: https://programming.dev/post/251752

It is important to note that although this may be a result of Reddit’s UI not displaying the content users posted to now-private subreddits, it remains a problem. Additionally, I agree with the author’s comments in the video description, as it appears strategically unrealistic for Reddit to ask that users manually delete the content themselves.

This is particularly true when considering that many automated methods to accomplish this task will be hindered by Reddit’s upcoming API pricing changes. Furthermore, Reddit has demonstrated a recurring pattern of rolling back databases using historical backups, thereby disregarding user deletion requests that were submitted prior to the database rollback.

See similar discussion of this video on Hacker News:

  • dfyxAEnglish
    1·
    1 year ago

    Disclaimer: not defending reddit here at all, just sharing my understanding as someone who has dealt with forums and GDPR. Also, I am not a lawyer and everything I write here might be wrong.

    According to some readings of the GDPR, reddit is absolutely correct in not automatically deleting all posts when deleting an account. This comes down to a few reasons (note that I use post and comment interchangably):

    • GDPR mainly protects PII that was collected as such. This includes profile fields, payment information, connection information (e.g. IP addresses). Comments on the other hand are free form texts that may or may not contain PII. Because of the sheer volume of comments and the vagueness of what makes something PII, we cannot reasonably expect anyone but the user themselves to sift through a user’s comments and determine what contains PII and what doesn’t.
    • The platform’s owner can safely assume that all PII in comments was submitted willingly and for the purpose of being seen by others, giving them the rights to store and display it for as long as they’re publicly accessible.
    • Comments provide context for their replies and deleting them may make whole threads unreadable, giving the platform’s owner a legitimate interest in only deleting comments that actually do contain PII that’s worth protecting.

    All in all that gives a platform’s owner the right to go the minimum effort route and only delete the account while leaving the comments intact (but now no longer linked to a username). If the user wants their comments deleted or censored, they have to do it themselves.

    Now, restoring comments that the user has deleted seems like something that may be worth reporting to your local privacy protection agency. I’m not sure if there are edge cases if the user deletes “too much” (from the platform owner’s point of view), triggering my third point but overall I would assume that a user should be able to expect that manually deleted comments are gone forever unless explicitly stated otherwise.