Video description as of 2023-06-23 10:15 PDT:
This video shows that Reddit refused to delete all comments and posts of its users when they close their account via a CCPA / GDPR request. Posts and comments may contain PII. Specifically, Reddit tells users that they must delete the content themselves, which isn’t realistic if a user creates a lot of posts. Even if a user does delete their content, Reddit restores the content within a few days.
Video transcript:
- 2023-06-13 @ 15:15 PDT: user states he deleted all posts and comments
- 2023-06-16 @ 10:15 PDT (3 days later): user states all posts and comments have been restored
- 2023-06-19: user decides to submit a legal request under CCPA to delete content
- 2023-06-19 @ 11:07 PDT: user receives reply from “Reddit Legal Support” (RLS) which states they will delete the account but not the content associated with the account. It is up to the owner of the account to remove the content [e-mail contents reproduced below]
Reddit Legal Support (Reddit Support)
Jun 19, 2023, 11:07 PDT
Hello,
We would be happy to help you delete your Reddit account if you have one. Before we proceed please note:
1. Account deletion is irreversible.
2. Posts and comments must be separately deleted before deleting your account. If not separately deleted, the content of the posts and comments will remain visible and disassociated from any account. If you want your posts and comments removed, follow the instructions on our help page.
Once the above mentioned information is removed to your satisfaction, please submit your deletion request by using your Reddit account and this form so we know it's really you making the request.
More information about account deletion is available in our Privacy Policy.
Kind regards,
Reddit Legal Support
- 2023-06-19 @ 12:02 PDT: user replies back to RLS stating it is unrealistic expectation for end user to manually delete and alleges violation of CCPA [reply reproduced below]
Hello,
If I understand your response properly, you are refusing to delete all data associated with my account. I believe this is illegal and in violation of the CPR. In this case the onus is on you, Reddit, to delete all of the content associated with my account.
It is besides the point but last week I already deleted all of the posts and comments associated with my account. However Reddit has since restored most of the content.
It is untenable to demand all users to manually delete content when Reddit itself does not provide a self-serve mechanism to mass-delete content. Some users have thousands of posts and millions of comments.
Just as a reminder, my CPA request to delete my account and all associated data was made on June 19th 2023 and must be completed by August 3rd 2023.
- 2023-06-24 @ 10:45 PDT: user has not received a reply from RLS. He decided to painstakingly delete all posts and comments while screen recording the effort. Video continues with the user manually deleting posts for his account (https://www.reddit.com/user/nucleocide). Then fast forwards to the end of the segment where the last posts are deleted
- 2023-06-25 @ 10:25 PDT: user discovers posts and comments are restored, again
User concludes video and clarifies why this is a violation of CCPA:
At this point it appears impossible to manually delete posts and comments on Reddit and expect them to stay deleted.
By not deleting all posts and comments in an automated way there is no way to guarantee that no PII [Personally Identifiable Information] has been left behind.
For example ...
<user gives example of a comment from 6 months ago on his account which includes his real first name and last name. Screen capture shows the comment was edited recently>
Since there is no guarantee that every single post and comment is free from PII, Reddit must delete all comments and posts from an account upon receiving a GDPR / CPA request.
Reddit Discussion on “/r/videos”: https://old.reddit.com/r/videos/comments/14je01k/reddit_may_be_violating_the_fucking_ccpa/
[2023-06-23 14:52 PDT] edit ~ formatting, fix title typo
deleted by creator
It’s not possible to find all your Reddit content. Even using tools, you won’t do it. The only way is to google your username and maybe you’ll get some hits.
I really hope the GDPR is put to full use here.
I’m curious though, what would happen if someone sent a GDPR deletion request to a Lemmy instance? The server admin would then delete the posts and account, but what if some other instances had defederated after the user made the posts, how would it be possible to make sure the posts are deleted from those instances as well? In theory that could be hundreds of servers. I guess the user would have to reach out to each instance?
It would basically be the same experience as leaked nudes currently. Whack-a-mole with dozens of different sites and needing to send a takedown request to each one, some of them sketchy or based in other geographies/jurisdictions.
Reddit has sites like push shift that copy every single post permanently for academic use. It’s unlikely that there won’t be (or already aren’t) similar data vacuums for the Fediverse. In my opinion it’s a good idea to think of everything on the Fediverse as permanent.
Good question. Yes, it would be much harder because you’re basically shotgunning your posts all over the place when posting here. I would think it’s pretty much impossible to make sure that every single instance of it is gone.
As far as I can tell, GDPR is a defense against corporations who claim to own your data, and hold that data hostage. But it’s not a infallible tool to scrub data from the internet.
Think about a tweet that’s been screenshotted throughout the Internet. Twitter would have to delete the original post and and data they control, but I imagine they have no liability for the outsiders taking screenshots.
How GDPR applies to Lemmy may have to be explored in court.
But I’m just a layperson without specific knowledge of the law, so that legal framework may already exist.
Is there bot / tool to edit my reddit posts in batch ? Seems that editing could be harder to mass reverse as it requires someone to review if the edit was for better or worse.
Alternatively to keep on deleting my reddit posts every day ?
PowerDeleteSuite on GitHub
I am right this second in the process of using PowerDeleteSuite to edit all my old reddit comments to be ads for lemmy
Edit: huh but it only worked okay, successfully replaced about 1/4 of my old comments after running it a few times. Any recommendations from those who have had more success?
I’ve run it about a dozen times over the past few weeks, it misses different comments and also comments get restored to previous versions (i.e. back to the original or to one of the earlier overwrite pass versions). At this point I don’t have any comments in my profile that aren’t at least some version of the overwrite message but I also manually deleted a bunch of comments that either were restored or were missed during an overwrite pass. It seems like at least once a day something gets reverted or restored but I haven’t been paying close attention. My plan is to check again in a few days and probably run it a few more times.
Removed by mod
Unfortunately this doesn’t get past the 1000 comment limit. I’ve found lots of my old comments still on Reddit. Does anyone have another solution?
I’ve heard good things about redact.dev
react.dev worked really well for me, be warned though some subs ban you for using it. I was banned from r/funny for removing my posts, a couple of others banned me too but don’t think they were big names/ as well known as rfunny
Does it matter if they ban you if you are planning on leaving anyways?
it was just a cautionary message for anyone else looking to use the same app.
Alternatively to keep on deleting my reddit posts every day ?
Late to the game here, but that’s the approach I’ve gone with. I got Shreddit, made a config file (containing the necessary detail for all my accounts), and made a shell script that I ran three times a day, likely until June 30.
Nowadays, my accounts look clean enough, and whenever some post or comment resurface, the next run of the script should take care of it.
And just on top of all that, I do check my accounts from a different browser I never use Reddit on. So far it’s clean-looking, no posts or replies showing on any of them. But whether or not Reddit actually deleted them, I’m not sure. I’m never sure.
EU GDPR - where to report if someone refuses to delete personal data.
List of institutions for each EU member.: https://edpb.europa.eu/about-edpb/about-edpb/members_enQuick question: is there any similar law in Australia?
From my quick reading Privacy Act 1988 and GDPR are fairly consistent with eachother, but our legislation is a bit outdated. It seems to be amended every few months, but only in relation to niche clauses that cover very specific circumstances about someone in a particular role and their specific ability to interact with data.
-There is no distinction in Privacy Act between a data processor and a data controller. GDPR regulates individual responsibilities for both.
-In the Privacy Act there’s nothing to stop multiple de-identified datasets from being cross referenced together in a way that could re-identify the data subject.
-The legal basis to protect consumers from collection of personally identifiable data is stronger under GDPR. The only thing an Aus organisation needs to do to collect sensitive data is establish that it’s ‘reasonably necessary’ for their core business operation.
Also note that although GDPR is a European union regulation, many Australian businesses are still beholden to it, e.g. if they knowingly collect information from European customers or have a branch located in EU. You can’t really have an EU branch that’s GDPR-compliant if your parent company overseas isn’t.
I had to DMCA some of my stuff off the site to get it to stay off.
https://codepen.io/Deestan/full/gOQagRO/
Deletes all comments or swap them with anything eg “I’ve moved to Lemmy”
Removed by mod
Also, it looks like reddit has been restoring posts deleted by that. Even with edit comments.
Craziness. I’m a long time PDS user and I’ve never had an issue with it or with my deleted comments getting rez’d. The boat must actually be sinking if they’re resorting to these kinds of desperate actions.
Removed by mod
those recovered to the “Deleted: Click here to know more” version.
I’m not familiar with this - what are you referring to? (It may not display the same on my UI.)
this may be a side effect of how the subreddits were reopened and possibly had their terabytes of John Oliver Hentai removed.
I did wonder about this. I wiped my account before the protests picked up and it is unaffected. But a few comments seem to express that some of their older content was restored. I hope we learn more about what happened here.
This DOES highlight questions as to whether doing the edit before the delete even matters though, since these are the pre-edit comments.
A little worrisome, isn’t it? But also entirely expected. What a dystopia we live in.
If anyone uses this, they may need to add a 5-20 second delay between each modification due to Reddits existing API rate changes.
My 11 year old account took about 8 hours to churn through with the script.
It also seems Reddit has turned on rate limiting early. I’ve had to run PDS a number of times to try and get all of my comments. At first I was just editing them, but since it’s rate limited, it would only get 1 comment every few seconds, with the reddit server responding “You’ve done this too much recently, try waiting 3 seconds” in between.
I’ve now moved on to editing and then deleting, since it won’t keep cycling over the edited messages and overwriting them again. I wish PDS would check to see if the comment had already been edited by a previous run and skip if the comment already contained the message chosen to replace. Then you could run it as many times as needed to replace all comments.
Doesn’t seem to work.
First off browser didn’t even allow to open embed website within none securely written website. With less secure setting old.reddit.com will refuse connection.
How to make it work?
Perhaps try a different browser. Worked fine for a couple of accounts in fire fox.
Firefox won’t let me open it within that tool.
Edge and Chrome will allow me to open it but old.reddit.com refuses the connection. I guess they countered it or something ?Yeah, I heard reddit stopped allowing it to delete posts, though mainly they’ve blocked it.
You tried moving the icon into the firefox bookmark toolbar then running it within reddit?
If anyone here lives in California and has had reddit violate their rights you can file a complaint here: https://oag.ca.gov/contact/consumer-complaint-against-business-or-company
This post says it pretty well, I’ll just leave this here in case anyone wants an editorial.
It’s funny. I got a little drunk and posted something on Reddit I really ought not have. I went back a day later and deleted it. A day after that, the comment came back, and I was suspended for three days over it. If you hadn’t brought that comment back from the dead, this wouldn’t even have happened, but okay, whatever. It wasn’t like I wanted to spent too much time at Reddit after the lemur-eyed, horse-teethed worm told us how expendable we all are as users.
Decided to expand on the original video and include a transcription of the events in the video. Hope this helps our visually impaired folks.
Personally, I find this disgusting. Hope Reddit gets litigated up the ass.
Good work on the transcription, it must’ve taken a while to do.
Normally, transcription like this will take a long time. However, since it’s largely text based (e-mails, viewing reddit) and relatively short. It was pretty easy to transcribe to text. With the help of some macOS features like copying and pasting from video, it became a non-trivial task.
I think I spent more time on formatting rather than on transcription.
I think you meant ‘it be came a non-trivial task’. At least that fits more with that paragraph’s overall sentiment.
Anyway, thanks for the work. I much rather skim a text than watch a YouTube video.
My grammar took a nose dive after transcription 😅. I fixed it. Thx
Thank you. I’m not visually impaired but I have cognitive issues that make watching videos difficult. I appreciate your time and effort 😊
Seriously, thank you for that extra mile. This is the kind selflessness that I remember on the old internet
Fuck u/Spez
I am obviously not a lawyer but I don’t see how Reddit is in the wrong here. On GDPR.EU that “The EU’s GDPR only applies to personal data, which is any piece of information that relates to an identifiable person. It’s crucial for any business with EU consumers to understand this concept for GDPR compliance.” I don’t see how your comment history would be considered “personal data”.
It even says in Reddit’s TOS that “When Your Content is created with or submitted to the Services, you grant us a worldwide, royalty-free, perpetual, irrevocable, non-exclusive, transferable, and sublicensable license to use, copy, modify, adapt, prepare derivative works of, distribute, store, perform, and display Your Content and any name, username, voice, or likeness provided in connection with Your Content in all media formats and channels now known or later developed anywhere in the world”.
You’ve agreed that your posts are no longer your “personal data” at that point…
I don’t see how your comment history would be considered “personal data”.
From the GDPR definitions: The data subjects are identifiable if they can be directly or indirectly identified, especially by reference to an identifier such as a name, an identification number, location data, an online identifier or one of several special characteristics, which expresses the physical, physiological, genetic, mental, commercial, cultural or social identity of these natural persons. In practice, these also include all data which are or can be assigned to a person in any kind of way. For example, the telephone, credit card or personnel number of a person, account data, number plate, appearance, customer number or address are all personal data.
irrevocable You’ve agreed that your posts are no longer your “personal data” at that point…
No, that is not how that works under European law at all. You can at **any **time revoke this right, that’s one of the basic rules of GDPR. And yes, Reddit falls under GDPR as they specifically enable EU citizens to use their services.
And yes, Reddit falls under GDPR as they specifically enable EU citizens to use their services
And since they introduced their ambassador program where they tried to “clone” well know subreddits to make a local alternative (in German, French,…), they can’t even deny it since they specifically targeted European countries
Companies put illegal things in their TOS’s all the time.
