> Anything dealing with user deletion should go through a well established, legal approved process.

If I give you an account on my linux box I don't have to go through any externalised process to delete it.

Why is Whatsapp(or any of the big players) any different? It's just an account on someone else's computer.

Is there something else at play I am missing?

The difference is that meta is providing that service world wide. Depending on where the user is located, there are a ton of considerations to be made when deleting a user. The flow should go through all these things before being deleted.

- some countries require saving "the last known address"

- others require keeping logs about "the last known connection point" (IP)

- in some countries, if the user was a paying user, you need to retain payment details / invoices / etc for years

- some countries you can receive subpoenas that mandate what data should be retained

All these things need to be checked before deleting an account. Having a "manual" deletion endpoint would be more troubling.

As an aside, early in the GDPA implementation phase, there was coverage of many companies implementing it poorly at best. There are articles detailing how you could delete a user's account by sending the "required info" (e-mail, ssn) from another e-mail and they'd delete the account / send over data. Would you be comfortable with someone being able to delete your account like that?

> The difference is that meta is providing that service world wide.

So where is the cutoff? My one free user obviously didn't make the cut. But 100 does? 1000?

Normal logs/bookkeeping need to be kept anyway if you are running a business. And special legal letters are special by definition.

I'm still not seeing why google outright couldn't delete a million random free accounts if they wish. It'd be bad for reputation but execs have done similar in the past.

I am not saying I like it. I am not saying I want it to be a certain way.

I am trying to point out that all these free accounts are running on servers provided by a business. They are subject to the whims of the business and the market the business operates in. If the business fails, so do the accounts.

You’re basically asking for legal council. The law is precise to a large extent but just as hairy and vague. You’re not getting meaningful answers from a defensive position.

But the short answer is that where is the line depends on jurisdiction, it is often along the lines of what they consider a hobby, a small business, large business, and so on.

"counsel"

I am looking for anything to back up this statement.

> Anything dealing with user deletion should go through a well established, legal approved process.

Which seems prohibitive. As though someone's personal emails/tweets/images on a free account are somehow protected from the whims of a high enough exec.

But as far as I can tell, it is within legal bounds for a business to freely give and taketh away free accounts if they wish. The only thing stopping them from mass account deletion is public perception.

It is not unconditionally within legal bounds to deny service. There is a lot of prohibitions on protected characteristics, contractual obligations and customary expectations which can open you for civil liability.

You’re just pretending a business transaction is a person one. It is not.

Legally, yes. Technically one always has to assume that companies have the ability to delete your accounts / data, why wouldn't they be able to do that? In larger systems it might be complicated and not every employee would have the permissions to do so, but certainly not impossible. Having your chatbot suggest that this is not the case is just not true.

It may be technically difficult / expensive / annoying if it was not designed into their system. Your linux box doesn't has hordes of peers / backup mechanisms and cross references to users, to a point that it may be impractical or not cost effective to conclusively prove that a user is deleted everywhere

Deletion may not have been in the original spec or in any of the specs that were bolted on.

Sure, ok. But whatever happens is still an internal process. Not a legal one.

No one said backups.

Deletion of the account should be as simple as overwriting a row on a few tables. If they can handle authentication process, disable accounts based on some automated processes, deletion or the process equivalent to it is similarly possible.

Even in case of backups it can easily be done (delete decryption key for this user's row, if you planned your backups right), but even if it isn't (historical backups for example), even the regulator will agree it's fine (BT, dt).

‘A regulator once told one business that it was okay to do one thing’ is very rarely any indication that that same regulator would take the same position for another business in another situation. Let alone that regulators in general will take the same position.