News for hackers. Stuff that matters.

trwaway02

> They do this to comply with European GDPR regulations

In this case, they actually satisfy the two requirements:

1. "ongoing legitimate interest". They are still in a dispute with the customer. Deactivating an account does not require deleting data, so long as the case it not closed. There is no "30 day" limit in this case, and it seems like an arbitrary time period imposed by someone who hasn't thought of the consequences.

2. "users permission". In this case they do have the user permission to keep the content, because the user wants to keep access to the account.

> they don't have the capability to implement any other option.

As mentioned above, you can deactivate an account without also deleting it. It may of course be easier for Google to just delete it instead of introducing a new state, but I would argue that a company such as Google does have the capability to implement this option. I would go so far as to say this is a failure of Google to not have such a process in place.