1y ago

Reddit violates CCPA

This video shows that Reddit refused to delete all comments and posts of its users when they close their account via a CCPA / GDPR request.

This is absolutely insane, and shows that companies OWN you.

Reddit @lemmy.world

Reddit may be violating the California Consumer Privacy Act (CCPA)

48 4

53 comments

I think the only solution currently is to use something like Redact to mass edit your posts and comments to remove the data that you have input into the site. Reddit lives or dies on the information that users post/comment on it.
- I personally believe that reddit is the type of company to save the orginal post and revert it just out of spite
  
  i wouldnt put that sort of crap past a pedophile like Spez
  
  I personally believe that reddit is the type of company to save the orginal post and revert it just out of spite
  They have been reverting them. I've been observing it in action my my Reddit account as I delete things. Even old posts that I recall deleting years ago (like random things on r/Hearthstone after I stopped playing Blizzard games) have been making a return over the past month. I've been going in and doing batches of edits to my post history every few days, and editing it differently. From ten years ago to now, I've had posts re-appearing and the edits getting un-edited.
  Wild.
  
  They probably do have copies of deleted posts/comments, also copies of the original for edits. I don’t know of a single company that easily allows users to “really” delete something.
  Database backups cannot easily be edited, for example.
- I tried this using the shreddit CLI app, and they reverted my edits as well as deletions.
- Note that redact doesn't always get everything. https://kbin.social/m/RedditMigration/t/46805/Strange-phenomenon-while-deleting-my-comments
  But agree with the idea. The best way is to use a tool to mass edit and then mass delete. For example https://kbin.social/m/RedditMigration/t/65260/PSA-Here-s-exactly-what-to-do-if-you-hit-the
- It feels like even that wouldn't work if they can just restore stuff but I don't know. Editing the comments before deleting would be a good idea though. If they just restore your stuff the last time it was up then all the comments would be useless.
- How do you know they don't keep post revisions too? It's trivial to implement and probably not much more data.
  
  You don't
- Does Reddit save edit history?
  
  Word is that they don't, deletes are soft-deletes but edits aren't so reversible.
  In this specific case it looks like it might just be that specific sub being private on the day he deleted, https://kbin.social/m/RedditMigration/t/99466/Reddit-violates-CCPA#entry-comment-406442
  Watching the video i see him deleting from 11 months ago to 12 years ago. But don't see the specific 3 year old posts on r/javascript. Which would be consistent with not being able to see them due to the sub being private.
- They mentioned shreddit able to delete more using some kind of archive but it's $15.
  Is that the only service to offer that service or are there any free/cheaper options that do the same?
  
  You can use the shreddit cli script from github as it has the same option for free.

Sign me up for the class action. I was thinking of just spinning up a selenium script because I’ve tried using one of the bots to delete post history before, and it didn’t work, so I was assuming the API was resisting. Disappointing to see that even clicking through everything doesn’t work reliably.
- Seriously...
- That would be my suggestion as well. There's a chance that all reddit users will be part of the class, but there's also a chance that only users who attempted to delete data or request that data be deleted will be part of the class.
  Attempt to edit and/or delete a few of your comments at the very least and prepare for the class action lawsuit. It'll probably take a couple years, but there's no way that some law firm isn't already looking into it and gearing up to start the process. There's a particular law firm that I follow that has gotten some really good settlements from social media companies such as this one against facebook. I would believe that if anyone decides to take on a data privacy issue against a large social media company, it would be them.

Not only do they refuse to delete your comments, they do it in such an underhanded way - quietly restoring everything after showing the user that the deletion was successful. For me personally, this is even worse than the whole killing 3rd party apps thing.
- Ah, well, that's what they are used to. All that obscurity in recommendations, weird way comment scores change over time (bots they don't fight or their own messing), weird way those affect karma, inconsistent application of rules, and so on.
  Social media mods like obscurity which is alone a sufficient reason not to use that crap.
- Yepp

Un-deleting deleted comments is certainly sleazy, but I didn't realize it was illegal.
- Under the CCPA you own your data. That data should be deleted under request.
  Same thing with the European GPDR
  You can request your data too (like on discord)
  
  Something similar passed in Texas recently: https://legiscan.com/TX/bill/HB4/2023
  
  Also this guy lives in California and Reddit is based in California sooo... These protections should apply to him
- It depends. If undeleted comments included your personal data, like IP address, home adress or your real name, it certainly is illegal
  
  Is it just me or is there an unethical way to try and entrap reddit here by posting your real name, deleting the post, and seeing what happens?

This feels like something that ought be reported to the EDPS. I’m sure they’ll be thrilled that an American company is holding user PII hostage.

Time to Europeans to take action!
- Or Californians, heh

Will this realistically go anywhere? I have a strange feeling that this’ll just get swept under the rug. I hope it doesn’t turn out like that. Ideally, I’ll like to see some charges/legal proceedings brought up right ahead of their IPO.

Apparently, this was not actually Reddit restoring the comments, but rather privated subs being made public and therefore giving the illusion that reddit had restored everything on their account. Though it is dumb that you cannot access or delete content that you made on a sub that is private.

So what's the penalty for violating the CCPA?
BTW CCPA != GDPR. They do similar things but are for different jurisdictions. If they openly break GDPR the EU will basically maul them, I imagine.

Not surprising. That's the stuff their after anyway. Im trying to cut myself from this type of thing, as much as possible for sure.

The Reddit User Agreement Section 5 clearly states that you own your data:
You retain any ownership rights you have in Your Content
So you could try to use that argument to get what you want.
The agreement also continues to say you grant them a license to use this content which can not be taken away. But I would argue that if you decide to remove your content then there is nothing to license away. In other words the license is still there but the content is gone.
Of course that's just my personal interpretation. Law is a fucked up thing that doesn't follow any logic. If you're lucky your country/state might have laws that work on your favour.

It doesn't show that Reddit owns you. It shows that we can majorly stick it to Reddit by reporting them to the appropriate agencies. A GDPR violation fine will hurt them badly

53 comments