Even then I would still fear that data having already been transformed into something else and using word play to disassociate with the original set of data.

edit: I've been subjected to Google's dark patterns for so many years that I doubt I will ever trust this company to be honest with me.

Legal action requires you to be able to prove they still hold the data.

If they only use it for something where other factors affect the outcome (ad targeting, etc) they can still keep your data forever while hiding behind plausible deniability the other factors provide them (from outside, there’s no way to prove that a particular ad was served to you because of your data instead of another factor they use as input for the algorithm).

There are a lot of mouths to keep shut on the inside. If anyone responsible for building the fake delete tool spoke out, Google would be in trouble.

If people couldn’t be unethical at scale then Facebook wouldn’t exist at all and yet it does, so I’m sure the same would be possible at Google.

That's different. People can easily be unethical at scale when incentives align. What they almost never can be is coordinated at scale against the individual incentives - whether for good or bad.

Also maintaining that deleted data is an issue, can't just magically move it to your datacenter in the mountains. someone will notice the movement of data even if it's automated. i suspect google just extracts as much data as possible from the photo, maybe trains an algo or two with the metadata and then deletes

> from outside, there’s no way to prove that a particular ad was served to you because of your data instead of another factor they use as input for the algorithm

Create an account, use it to excessively look for tea pots until you predominantly get ads for tea pots. Store the cookie[0] that encodes your user id. Delete the account.

After the advertised account retention period, try the cookie again in an otherwise squeaky clean session that gives random ads without the cookie:

Tea pots? Something survived.

No tea pots? No targetting.

(and yes, the onus to demonstrate your accusation well enough to convince a DPA is on you, IMHO as it should be)

[0] or whatever bits of data are necessary: try to recreate the tea-pot session after a logout without logging in officially to determine what's necessary.

I don't believe for a second they keep the data at a company of Google's size. But they don't need to anymore if they just feed your data through some neural network training that outputs a black box filled with weights. They can legally show your data is gone but now their model knows that people with similar browsing history, location, etc have a weak signal for tea cups. You'll get the occasional ad for them if their other networks don't filter out all the history for appearing suspicious. Google can bring in a bunch of experts saying how much data they've processed and no one really knows how the ML algorithm learns, etc.

They've improved their model none the less even if you delete your data after the fact.

And that is fine by me. Using my behavioral data to train an underfitting model is very different from actually storing my behavioral data. Sure, the word 'underfitting' does the heavy lifting in my previous sentence. But I don't think that overfitting is even feasible at this scale. Google does not train models that just memorize the habits of 3 billion people. Such a model would be useless.

Unless your behavioural data is enough of an outlier to identify you.

Yes but an outlier will be identified regardless of where s/he chooses to go, the data just reflects that idea

If you're coming from the same device or IP address/range, that's enough of a link.

An anecdote: I stayed with relatives for a few days one time, and my two-year-old niece really liked one particular music video on YouTube, so it got played on their TV box 3-4 times during my visit. Not on my laptop, but I used said laptop on their wifi (not logged into Google products, as I never am). When I got home, YouTube highly recommended that video to me after I watched an unrelated video, when there was no other reason to recommend it (I didn't know the artist, almost never watch music videos, and it wasn't anything all that popular).

I notice a similar behaviour. I don’t have a Google account and don’t keep cookies, so the only way for them to track me is my IP.

My IP seems to be permanently associated with my YouTube habits. They’re even being sneaky about it, as in they’ll give you a default homepage and generic recommendations first, but watching any video similar to the previous viewing habits will bring back not just videos related to that one, but the entire history they’ve collected over the years (some of the topics I watch are completely separate and would never intersect normally, so the only way for them to both come up in suggestions is from previous viewing history).

I didn’t create an account, didn’t agree to any privacy policies, and am blocking any and all cookies just like they advise in their own privacy policy and yet I am still being tracked.

I wonder how they define 'your data'? If I train a neural net to recognize you and predict your behaviors and preferences, are the weights of the network yours, or can I keep them? What if the network covers you and your family? Do I have to retrain my network?

Yes, if the neural net can identify a person, it's covered by the GDPR:

"Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person" (Recital 26).

In which case you need a lawful basis for doing such processing (of which consent is just one possibility). Furthermore, that's considered "profiling" and is subject to extra rules if it can have strong impact on the person's life.

On the other hand, if the data is well mixed with other people's, preventing that recognition, then it has been anonymized, and therefore it's not longer subject to the GDPR (Recital 26). But note that you're still subject to it when you're capturing and using personal data to train that model, even if the model itself is anonymized.

You mean the fines that the board of directors writes off as a cost of business and they never change policy due to them? Those fines?

Not changing policy means escalating fines (those 4% of global revenue maximum are nothing to sneeze at, and so far compliance was the cheaper route) but also, at some point, the inability to operate in the EU.

Even if a company only does the bare minimum required under GDPR, total deletion of data on request is part of that.

But these more severe measures are either 5-10 years away, or never going to happen at all (the latter part is my assumption, not claiming it as a fact).

IMO the corporate board of directors will coast on the situation for as long as possible and only then will we see some changes, don't you agree?

> IMO the corporate board of directors will coast on the situation for as long as possible and only then will we see some changes, don't you agree?

There are a few cases already with fines around 2.8% of revenue, and those fines don't mean the DPA will go away. The expectation is that these fines are paid _and_ the reason for the fine is resolved.

Turnover in the 2.8% case (Taxa 4x35 in Denmark) was from Fall 2018 (start of investigation) to March 2019 (when the DPA reported the incident to the police and "recommended" that fine). Sadly the only follow-ups on the case that I could find are behind paywalls (so I can't read them), but apparently the DPA isn't done with them yet.

It's all a matter of exercising pressure, and it seems that the authorities are willing to do that.

As someone impacted by the GDPR (AAA Game Studio, and all player stats / multiplayer matches getting impacted), backups are exempted:

"The GDPR is open to interpretation, so we asked an EU Member State supervisory authority (CNIL in France) for clarification. CNIL confirmed that you’ll have one month to answer to a removal request, and that you don’t need to delete a backup set in order to remove an individual from it. Organizations will have to clearly explain to the data subject (using clear and plain language) that his or her personal data has been removed from production systems, but a backup copy may remain, but will expire after a certain amount of time (indicate the retention time in your communication with the data subject). Backups should only be used for restoring a technical environment, and data subject personal data should not be processed again after restore (and deleted again). While this adds some complexity, it allows organizations to have some time to re-engineer their data protection processes." https://blog.quantum.com/backup-administrators-the-1-advice-...

You are absolutely correct that following the intent of the GDPR (we don't have access to the user data once they file the request) is of utmost importance. But the prior poster is correct that the data still exists.

Edit: All opinions my own and not that of my employer, etc. etc.

True, but I doubt EU courts could take up a case involving non-EU consumers. So, even though Google compiles in Europe, they don't have to afford the same protection to non-EU users.

> involving non-EU consumers

GDPR covers any interaction of people or organizations in the EU.

So non-EU consumers are covered once they're visiting the EU (citizen of a member state or not), and potentially (untested, not spelled out explicitly) when they use a VPN with an endpoint in the EU (because they're then likely talking to data centers under the control of the European subsidiary).

> they don't have to afford the same protection to non-EU users

Given that "EU user" is murky like that, I'm not sure if any company goes through the trouble of differentiating which action happened from inside or outside the EU beyond raw GDPR blocking that refuse service entirely for accesses from within the EU.