[mynameisvlad]

To add to the other comments, they have confirmed in the past they don’t keep track of history.

That could have changed, sure, but nothing indicates that is the case.

You could also go the GDPR route and request all your data be deleted, if you are subject to that. They would be forced to comply with that request.

[blibble]

I did a GDPR request and it showed the content of my deleted comments

but if you overwrite first with garbage then delete that's what shows up in the dump

[PaulKeeble]

Which is how shreddit works, it changes it to garbage then deletes it.

[mynameisvlad]

Nice. I wouldn’t have expected them to have changed this but it’s good to see it at least partially confirmed.

[cinntaile]

GDPR has exceptions, this would be such an exception that doesn't allow you to simply invoke GDPR and get everything deleted. They just have to anonymize the poster by deleting their signature, avatar, profile,... while the posts can stay intact (unless they contain personal info).

[mynameisvlad]

> (unless they contain personal info)

Do you think they are going to go through each of your comments individually to determine if it contains personal info or not? That requires actual time and effort, and as an individual user you or your comments are nowhere even remotely in the vicinity of important enough for that.

It’s far easier for them to take the loss and delete wholesale.

Do they do this? I don’t know, I haven’t done it. But it certainly could be argued that by them not doing this, they are not fully complying with the requirements of a GDPR deletion request.

[cinntaile]

That would destroy their whole value proposition, your user generated content is their goldmine. Of course they don't have to sift through your thousands of posts to find the one that has GDPR info, you'll have to show them the post.

[mynameisvlad]

You cannot impose requirements like that as part of the deletion process.

It is 100% not the user’s responsibility to keep track of this information. That is explicitly a requirement of the provider and it is fully on them to ensure that a deletion request deletes all the personal data. If they didn’t tag it properly and can’t ensure that, then that is their problem to solve not yours.

Their value proposition is also not a single user’s data. It’s the entirety of the data set. One user’s data is nearly worthless, certainly not worth enough to have a human review it. Which was my point.

[cinntaile]

I take it you haven't seen how forums deal with GDPR notices? It's exactly how I described. The profile is anonymized/emptied and the posts stay.

[vonmoltke]

Just because a bunch of forums do it that way doesn't mean it's correct. When I was at Twitter the Compliance team determined that all user-generated content was Personal Data under the scope of GDPR. Those forums may be getting away with it right now, but they're playing with fire. If someone wanted to raise a stink with regulators they could be in trouble. I guarantee you if Reddit or a site of similar scope tried something like that someone would.