Well, to some degree it is a liability. It just took this long and some accidents for them to finally figure it out.

That attitude will create a problem - a.k.a. opportunity - for others to come in and solve. Google got rich by scraping the internet and solving the headache of how to find decent content. If there's value in some of this data headed to the dump, it gives a chance for someone to do the same. Who knows, they might even find a way to do in a privacy-respecting manner.

This particularly consequence was so clearly predictable that it's hard to call it unintentional. It's a hard-to-avoid trade-off.

Jury's out on whether it was the right one.

Note that "deleting" is problematic in itself, especially for "cloud" data, considering how storage works, especially transistor one like SSD's !

Mark it inaccessible and write the new data over it in the next write cycle.

That doesn't work on SSDs, and the data might be even theoretically recoverable on HDDs : https://security.stackexchange.com/questions/12503/can-wiped... > Therefore, you should assume there is no reliable way to securely erase individual files on a SSD; you need to sanitize the whole drive, as an entire unit.

There's a reason why when security is deemed important, the storage is physically destroyed instead.

I meant for the sake of data protection, not for forensics. You start with all ones and gradually deplete your ability to write ones over time in electron charge memories such as SSDs.

This is not about companies following best practices but about what is going to happen when some of the supposedly deleted data pops up again, as it eventually will.

Will a judge that is clueless about how computers really work consider that as a GDPR violation or not ? As deliberate or not ?

If you disable wear levelling, you could force it to end in a final all-zeros state.