Hate to tell you but 95% of companies do this. It’s common practice. You’re “deleted” account? There’s a column called “DeletedDate” and it’s marked to whenever you hit delete. Their query then just says “Select Account where DeletedDate is null” and yours just doesn’t return until that date is cleared.
Is it asshole design? No. And it’s not for privacy reasons. it’s because the vast majority of people who hit delete will call the next day and yell and scream saying “But I didn’t know it would delete everything”. That’s why Meta keeps it, and Youtube, and Google, and everyone.
Not to mention legal reasons. If someone uses your platform for illegal purposes and the feds come knocking you bet your ass you need that data or your company is liable. That is different in the EU I grant you, but that’s the exception, not the common practice. Over there they can point to GDPR and say “That’s why we don’t have it”. Anywhere else you’re pretty screwed.
So. Not asshole design. The session staying open is bad security though. Everything else is just knowing your userbase and knowing that people will be pissed and need something. If you want privacy stop giving your data to companies in the first place.
You are mostly correct, some additional insight from someone who works with security/privacy stuff:
That is different in the EU I grant you
Even in the EU, when a user requests to delete their data, you’re allowed to keep enough to validate they were a previous rule-breaker so they can’t just delete their data and re-register
The session staying open is bad security though.
There isn’t enough context to say for sure, but in general this is standard practice. JWTs, probably the most widely adopted standard for authorization on the web, have an expiry date and cannot be revoked. Yes it’s not great security, but I want to emphasize this is standard practice. Google, Apple, Meta, Slack, etc all do this.
Also, when you request data deletion, the companies have up to a month to do it. I’m not sure if OP expected it to be instant, but it doesn’t have to be
That’s why Meta keeps it, and Youtube, and Google, and everyone.
It’s been a while since I deleted those accounts, but from what I remember, Meta explicitly says that they will NOT delete your account for 30 days, unless you log in. After that, it’s gone “forever”.
I’m almost certain that Google does the same, but I don’t recall.
Still, if you want it deleted, it should be deleted!
Hate to tell you but 95% of companies do this. It’s common practice. You’re “deleted” account? There’s a column called “DeletedDate” and it’s marked to whenever you hit delete. Their query then just says “Select Account where DeletedDate is null” and yours just doesn’t return until that date is cleared.
Is it asshole design? No. And it’s not for privacy reasons. it’s because the vast majority of people who hit delete will call the next day and yell and scream saying “But I didn’t know it would delete everything”. That’s why Meta keeps it, and Youtube, and Google, and everyone.
Not to mention legal reasons. If someone uses your platform for illegal purposes and the feds come knocking you bet your ass you need that data or your company is liable. That is different in the EU I grant you, but that’s the exception, not the common practice. Over there they can point to GDPR and say “That’s why we don’t have it”. Anywhere else you’re pretty screwed.
So. Not asshole design. The session staying open is bad security though. Everything else is just knowing your userbase and knowing that people will be pissed and need something. If you want privacy stop giving your data to companies in the first place.
You are mostly correct, some additional insight from someone who works with security/privacy stuff:
Even in the EU, when a user requests to delete their data, you’re allowed to keep enough to validate they were a previous rule-breaker so they can’t just delete their data and re-register
There isn’t enough context to say for sure, but in general this is standard practice. JWTs, probably the most widely adopted standard for authorization on the web, have an expiry date and cannot be revoked. Yes it’s not great security, but I want to emphasize this is standard practice. Google, Apple, Meta, Slack, etc all do this.
Also, when you request data deletion, the companies have up to a month to do it. I’m not sure if OP expected it to be instant, but it doesn’t have to be
It’s been a while since I deleted those accounts, but from what I remember, Meta explicitly says that they will NOT delete your account for 30 days, unless you log in. After that, it’s gone “forever”.
I’m almost certain that Google does the same, but I don’t recall.
Still, if you want it deleted, it should be deleted!