Video description as of 2023-06-23 10:15 PDT:
This video shows that Reddit refused to delete all comments and posts of its users when they close their account via a CCPA / GDPR request. Posts and comments may contain PII. Specifically, Reddit tells users that they must delete the content themselves, which isn’t realistic if a user creates a lot of posts. Even if a user does delete their content, Reddit restores the content within a few days.
Video transcript:
- 2023-06-13 @ 15:15 PDT: user states he deleted all posts and comments
- 2023-06-16 @ 10:15 PDT (3 days later): user states all posts and comments have been restored
- 2023-06-19: user decides to submit a legal request under CCPA to delete content
- 2023-06-19 @ 11:07 PDT: user receives reply from “Reddit Legal Support” (RLS) which states they will delete the account but not the content associated with the account. It is up to the owner of the account to remove the content [e-mail contents reproduced below]
Reddit Legal Support (Reddit Support)
Jun 19, 2023, 11:07 PDT
Hello,
We would be happy to help you delete your Reddit account if you have one. Before we proceed please note:
1. Account deletion is irreversible.
2. Posts and comments must be separately deleted before deleting your account. If not separately deleted, the content of the posts and comments will remain visible and disassociated from any account. If you want your posts and comments removed, follow the instructions on our help page.
Once the above mentioned information is removed to your satisfaction, please submit your deletion request by using your Reddit account and this form so we know it's really you making the request.
More information about account deletion is available in our Privacy Policy.
Kind regards,
Reddit Legal Support
- 2023-06-19 @ 12:02 PDT: user replies back to RLS stating it is unrealistic expectation for end user to manually delete and alleges violation of CCPA [reply reproduced below]
Hello,
If I understand your response properly, you are refusing to delete all data associated with my account. I believe this is illegal and in violation of the CPR. In this case the onus is on you, Reddit, to delete all of the content associated with my account.
It is besides the point but last week I already deleted all of the posts and comments associated with my account. However Reddit has since restored most of the content.
It is untenable to demand all users to manually delete content when Reddit itself does not provide a self-serve mechanism to mass-delete content. Some users have thousands of posts and millions of comments.
Just as a reminder, my CPA request to delete my account and all associated data was made on June 19th 2023 and must be completed by August 3rd 2023.
- 2023-06-24 @ 10:45 PDT: user has not received a reply from RLS. He decided to painstakingly delete all posts and comments while screen recording the effort. Video continues with the user manually deleting posts for his account (https://www.reddit.com/user/nucleocide). Then fast forwards to the end of the segment where the last posts are deleted
- 2023-06-25 @ 10:25 PDT: user discovers posts and comments are restored, again
User concludes video and clarifies why this is a violation of CCPA:
At this point it appears impossible to manually delete posts and comments on Reddit and expect them to stay deleted.
By not deleting all posts and comments in an automated way there is no way to guarantee that no PII [Personally Identifiable Information] has been left behind.
For example ...
<user gives example of a comment from 6 months ago on his account which includes his real first name and last name. Screen capture shows the comment was edited recently>
Since there is no guarantee that every single post and comment is free from PII, Reddit must delete all comments and posts from an account upon receiving a GDPR / CPA request.
Reddit Discussion on “/r/videos”: https://old.reddit.com/r/videos/comments/14je01k/reddit_may_be_violating_the_fucking_ccpa/
[2023-06-23 14:52 PDT] edit ~ formatting, fix title typo
I am obviously not a lawyer but I don’t see how Reddit is in the wrong here. On GDPR.EU that “The EU’s GDPR only applies to personal data, which is any piece of information that relates to an identifiable person. It’s crucial for any business with EU consumers to understand this concept for GDPR compliance.” I don’t see how your comment history would be considered “personal data”.
It even says in Reddit’s TOS that “When Your Content is created with or submitted to the Services, you grant us a worldwide, royalty-free, perpetual, irrevocable, non-exclusive, transferable, and sublicensable license to use, copy, modify, adapt, prepare derivative works of, distribute, store, perform, and display Your Content and any name, username, voice, or likeness provided in connection with Your Content in all media formats and channels now known or later developed anywhere in the world”.
You’ve agreed that your posts are no longer your “personal data” at that point…
From the GDPR definitions: The data subjects are identifiable if they can be directly or indirectly identified, especially by reference to an identifier such as a name, an identification number, location data, an online identifier or one of several special characteristics, which expresses the physical, physiological, genetic, mental, commercial, cultural or social identity of these natural persons. In practice, these also include all data which are or can be assigned to a person in any kind of way. For example, the telephone, credit card or personnel number of a person, account data, number plate, appearance, customer number or address are all personal data.
No, that is not how that works under European law at all. You can at **any **time revoke this right, that’s one of the basic rules of GDPR. And yes, Reddit falls under GDPR as they specifically enable EU citizens to use their services.
And since they introduced their ambassador program where they tried to “clone” well know subreddits to make a local alternative (in German, French,…), they can’t even deny it since they specifically targeted European countries
When you delete a Reddit account, it will mark your username as “[deleted]” so they are at least attempting to anonymize the posts. Reddit has no obligation to remove anonymized posts unless it contains identifiable personal data. (https://www.jdsupra.com/legalnews/eu-general-court-examines-data-1532025/) “If data about individuals is processed so that the individuals cannot be identified, the data can be used free from the restrictions imposed by the GDPR (e.g. enabling a pharmaceutical company to use patient data for R&D).” If the data recipients (readers) can’t link it back to a identifiable person (a specific person), it’s not personal data. Of course, they’re not going to just blanket delete every post a user ever made because that’s not in their favor. If there is a specific post with personally identifiable data Reddit is clearly assuming the onus is on the user to request deletions of specific posts that contain identifiable personal data (which GPDR.EU says they are absolutely allowed to do). Unless they are challenged in court, they ain’t gonna do jack shit. Not saying you can’t try or that what Reddit is doing is right, but good luck!
Correct but there’s been no proof of them ever taking action on requests like those. That’s what this thread was started about.
Fines by Privacy Authorities are not handled by courts though
Companies put illegal things in their TOS’s all the time.
It could be personally identifiable depending on the content. This is a problem I’ve had at work where users put in callback numbers or emails when using the “contact us” form. As far as I can tell this data still needs to be deleted upon request, though it’s unclear to what lengths we are expected to go to. This would be an interesting test case if nothing else.