Facebook ordered to explain deleted profile | Hacker News Reader

Facebook ordered to explain deleted profile

bbc.com

221 pointsmikece144 comments

While it's not exactly the same thing but Facebook needs to tighten up their rules. I got in a squabble with someone who wanted my FB identity.

Even though I didn't follow him he filled out a form online and had me declared deceased. It took me close to a week, with the intervention of a friend who worked at Facebook, to get my account back.

How can someone who you don't even follow back be allowed to do something like this to someone? I had to prove that I was alive, complete with photos of me with my drivers license.

But why is a complete stranger without any proof whatsoever able to have me declared dead? Facebook needs to rethink these rules. Seems to me in this case the guys widow should be the one who has final say over his account.

I can see why the opposite might be valid, if you recently lost someone the last thing you want is argue with Facebook that yes, that loved one is indeed dead.

Probably needs some better rules but that part needs to be as painless as possible

For that case, though, there is a very valid way to verify the status of the deceased: The death certificate.

Indeed, at least in the US, it’s expected that you’ll need several copies of the death certificate to handle bank accounts, etc. I doesn’t seem like a burdensome requirement to ask for one.

Why not err on the side of caution and leave the profile alone until someone, with adequate documentation and at a time of their choosing, contacts FB about converting or deleting the profile? I don't think leaving it up does any harm.

I had a friend die in sufficiently unfortunate circumstances to attract media attention. It was definitely a good thing that Facebook deactivated his account very quickly upon request (I doubt the person who asked for it to be deactivated had access to the death certificate at the time) before journalists used it as a source of photographs and people to ask for quotes.

Years ago I took it upon myself to cancel a record of the month club membership belonging to a work colleague who died suddenly. They would not do a thing without a copy of the death certificate, so I had to tell them that all I could do then was recommend they keep sending the records and they'd have to eventually try suing him for payment.

I can offer Facebook two choices to verify death if a third party alleges it. Either provide the death certificate or the name of the funeral home.

If Facebook was smart they'd make it super simple for the funeral directors to provide this information directly to them. I lost my dad late last year and had to answer a number of questions for the funeral director.

All the funeral director would have to do is ask if the deceased had any social media accounts and do you want me to contact them on your behalf?

> All the funeral director would have to do is ask if the deceased had any social media accounts and do you want me to contact them on your behalf?

This would make a great plot for a novel, a disgruntled funeral director starts "killing" people digitally by marking various accounts permanently deactivated after death. And thanks to advances in genetic engineering, even showing up in person isn't enough to prove they're who they claim to be anymore, so they can't drive, work, buy anything, or communicate with anyone.

I dig this, and want to have a crack at a short story for it. Do you mind?

LastPass seems to have a decent system (thankfully I haven't needed to test it yet):

1) I set an "emergency heir" contact

2) They can request access at any time

3) I'm sent an email notifying me of the request

4) If I don't deny the request in X amount of time (custom, I think), they are granted complete access to my account

Granted there's a potential for abuse; but that's somewhat mitigated by only allowing 1-2 people to make the request and if someone already has access to my email they can cause all sorts of other trouble without having me declared digitally dead. It shouldn't be hard for Facebook to implement something similar.

That's exploitable. Hack the heirs email, wait until you are on a holiday, hit them with a request for access. You won't respond in time because you're climbing Mount Everest or diving in the Marianas Trench (the heir might really be a heir in either of those scenarios) and then access will be granted.

All systems are exploitable given enough time and effort. At that point they may as well just"hack" the actual account owners email.

In cases like that you'd set set the time window to be longer than you expect to be off the grid.

Granted it is a slightly larger attack surface but it relies on 1) knowing the heir (wife, parent, child, friend) 2) gaining access to their email 3) Relying on the original owner having an inadequate time window 4) the owner going somewhere they are completely cut off from the world. It could happen, but that's a vanishingly small opportunity.

You’re going up Everest? Cool, change X to 40 days.

No, you'd have to hack the heir's LastPass account.

Also, as others have mentioned (including the parent), the length of time is customizable as well.

Or you could just skip the middle man and hack the target's last pass account.

Anything can be exploited if the criteria for exploiting it is somehow breaking into an arbitrarily secured network/facility.

I have mine set to 30 days (maximum).

Honestly, If I'm in a situation where I'm without internet for 30 days its involuntary and I'm fine with releasing access.

Why? Why is the priority to shut down an account? That should not be what is important.

Declaring you deceased, even to a corporation, sounds like a serious crime.

In this wild world of get killed by a swatting, having someone assassinate your FB profile is small potatoes.

Another reason to not trust FB.

Being dead in India is very "popular"

You can also go to usps.com and declare someone has moved and have all their mail sent to somewhere else (probably don't pick your own address if you don't want to get caught).

I don't know about the USPS's implementation, but the UK's Royal Mail not only collects ID for this service, but sends an unredirectable letter to your old address saying 'we're starting a redirect, contact us if this is odd'. So it is possible to do sanely. Like Facebook, I suppose - require a scanned death certificate?

USPS sends the same letter and requires you to answer several questions before doing it

No they don't. My roommate moved out a few months ago, I watched him fill out the mail forwarding form (with his name and my/our address). Not only did no confirmation letter show up in my mailbox -- in fact I stopped getting my own mail for several days and when I confronted the USPS worker, he said, "Oh, I thought your apartment was vacant now." I got pretty mad and he just shrugged, not even an apology.

I had to get my car's title reissued from the DMV (I had just bought it off my roommate as he was leaving), and also had a paycheck disappear (was working 1099 remotely and paid monthly via check) because both things were coming in the mail that week and disappeared never to be seen again. (Luckily the guy I was subcontracting from paid for his own stop payment and reissued the check)

Yeah, when I moved a few years ago I also got no confirmation. So after the move, I sent a letter to my old address, with no return address, to see if it got redirected.

(Although my letter did, I'm pretty sure my first Ventra card was lost in the mail anyway. With the insanity of the switch it got delayed a couple months, and ended up getting sent out right about when I moved)

Or you can just send an email asking if user is still alive.

Last time I did this, the "we're starting a redirect, contact us if this is odd" letter was sent after the redirect started, and it was helpfully redirected to the new address!

Seamless!

The USPS sends two - one to your old address and one to your new address. The one sent to your old address does indicate that they’re redirecting - that is, it is sent after the fact, it is not asking for confirmation or providing a grace period before they do - but it is marked clearly as something that should not be forwarded.

I suppose it could have been forwarded by accident (at scale screw ups do happen), but perhaps you confused one with the other?

>Like Facebook, I suppose - require a scanned death certificate?

This whole discussion is completely absurd.

What went so wrong that we want to send our government IDs and death certificates to one of the companies with worse records with respect to their users' data?

The real solution is to stop using Facebook.

Amen to that. Monetization of friendships (and "friendships") is evil.

But beyond any of that, the idea that a Facebook account needs to correlate to real world consequences, and real world facts is beyond stupid.

I can buy ten phones, create ten free email addresses, and create ten facebook accounts, tonight, and no one can stop me, or challenge what I've done, as long as it's not invasive and obnoxious to other users.

Nor should it be possible to draw reproach for doing such a thing. There are real reasons for users to want to create dummy accounts like that, and as usual, there's no reason 99 people need to suffer because one asshole has to misbehave.

Facebook, as a walled garden, is fated to forever lack practical utility. It's like a rain gutter that empties into a sewage facility you can never see inside. If you know that you can crack open a mercury thermometer and dump it into the drain, don't drink the lemonade they're selling outside the front gate, unless you can prove it's not contaminated by your thermometer disposal activities.

The USPS also sends a notification to the old address.

They require a credit/debit card that they charge a $1 to. That cards billing address must be either the old address or the new address. So yea, its easy, but it's not that easy.

Though now that I think about it i wonder if you could use those visa giftcards that let you edit your address. Maybe it is indeed that easy.

USPS requires the credit/debit card charge if you fill out the form online. IIRC, they charge nothing if you do it in person, but you may be required to show ID.

Nope. Fill out form, hand in (or IIRC, drop in any mail box). They may glance to make sure you signed it, but nothing more.

Maybe enough to skip through the automated checks, maybe not. I suppose it depends on whether it's being done through an ID verification service or just a payment processor putting a hold on the card.

The gift card number wouldn't be visible to the ID verification services as a credit or deposit account, and that'll certainly knock points off in their scoring system.

I suspect it would just shift the point where someone eventually notices either way.

Anyone can change their credit card billing address to anything they want.

That does leave a paper trail for the postal inspector looking for a collar.

You correct a $1 preauthorization without capture occurs that veirfy AVS part of Zip code and disappeares from yiur account within 48 hours. So only Zip code of new/old card is required at the office, unless you do it online then whole address is being verified.

Usps system recognizes gift cards and do not allow those, so is majority of online services for example Digital Ocean (due to using their boxes for spam)

AVS can check the numeric part of the address as well as the zip code.

As I understand it, though, this would still green-light "1234 Sixth Street" for "1234 Wilson Avenue." I also suspect it's less than bulletproof on some weird format addresses

Yes, the Visa gift cards work, at least as of a few years ago. Most of them will let you change the "billing zip code" online as often as you like, or simply always return success on Address Verification System (AVS) queries.

Most stores don't routinely keep surveillance footage around very long, though I have suspicions about Target.

The deterrent against this is serious prison time. That's mail fraud, a federal crime that could hypothetically get you 20 years in prison. Standard sentencing guidelines mean you would almost certainly not get that 20 years, but it's still not the sort of crime you'd commit casually.

Change-of-address scam moved UPS corporate headquarters to tiny Rogers Park apartment, feds say

http://www.chicagotribune.com/news/local/breaking/ct-met-ups...

Don't pick UPS's HQ address either, they're probably going to notice...

https://www.npr.org/sections/thetwo-way/2018/05/10/610102872...

> widow

To be picky, I recall the article saying "partner" in that they were not legally married… not that it takes anything away from your points otherwise.

I've noticed in the last few years that many Europeans use the word "partner" even if they're married. It seems to be part of the Euro version of being over politically correct.

How is it "over politically correct" to use the word partner?

s/politically correct/respectful/ usually works well, and shows that people using the term intend disrespect.

But in this case, I think we are just maintaining privacy. You don't need to know whether I'm married or not, or the gender of the person.

I use the term "partner" because I'm in a civil partnership. Same legalities as being married but without the terminology and ceremony, not to be politically correct, respectful, or to maintain privacy.

So it depends on where you're from, partner could be the legally correct term as opposed to just meaning "significant other"

Not politically correct at all. I'm marrying my partner next month, she'll still be my partner. The 'wife' bit will be for formal conversations. Much as my son is actually my son despite him being from another father, i'd rather not dick around with clarifications when it's no concern of anybody else what our legal status is when compared to our actual relationship.

I'm European; I think the word has a little different meaning here than it does in the USA. It has nothing to do with political correctness. It's common (in most European languages including both Slavic and Latin ones) to call your girlfriend a "partner" here. The word means that you're in it together ("business partner" is also used, BTW), whatever it is; when your girlfriend becomes a wife, she still is your partner (or at least you hope she is). Sometimes the word is used to empathize that he/she isn't just "some random" boy/girl friend and that it's a long term serious relationship.

It's got very little to do with political correctness at all, "partner" is a word that can be used as a fitting translation for married individuals in many european countries.

I don't understand what that has to do with political correctness.

The easy way to fix this is to contact Facebook and declare Mark Zuckerberg deceased, no?

And yet my friend who actually died, and whom I've sent them multiple obituaries profile is still up like usual some 5 years later.

I think there is a sea chnage coming in how we (society) deal with problems that require subtly and judgement.

Let's give FB the benefit of the doubt here, there were legitimate conflicting requests over this profile, with some degree of documentation.

A human would have been needed to look at the case and make a decision. Let's say that human would take 6 minutes - and is a well trained professional. Full time that's about 10,000 6 minute cases per year. A room of lawyers like this is maybe 1/4 Million cases per year flat out.

Facebook probably generates 1/4M edge cases a day.

Automated cars will be making billions of decisions a year that affect human lives more deeply.

We will have to change our rules in society - from post-hoc review as in court today to mainly decide the rules upfront - from the trolley problem in automated cars to what are the rules around deleting digital assets.

We are heading for an open / closed society

GDPR request over some embarrassing information, perhaps? Facebook probably can't win here. Presumably they have a policy that compels deletion in some cases and they don't want to argue about individual cases

I don't think dead people can make GDPR erasure requests. No idea about the legalities involved if an executor or heir tries it.

My bet would be on a fake profile report.

This happened over a year ago already, before GDPR was enforced.

Maybe try reading the article? The person died in 2016 and the profile delete was 6 months later - long before GDPR took effect.

"Don't want to argue about individual cases" is a business model decision that companies like Facebook make. We need to stop accepting this as a reasonable position.

It's not only Facebook who have this process unsufficiently secured. The process for administering real death is also not really tamperproof. There is a hilarious defcon presentation on virtually killing someone and getting a real death certificate: https://www.youtube.com/watch?v=9FdHq3WfJgs

Improperly reporting someone dead, or misrepresenting someone's will is something "you don't do" so the system is designed to minimize friction/pain.

Two ideas to improve this:

Transparency. If Foo dies and Bar reports them as dead, then inform all of Foo's friends about what Bar did. Foo's friends have a right to know that Foo has died and that Bar wants Foo's data deleted. In the real world, this is basic human decency.

Appeal process. If X number/percent of Foo's friends say that he isn't really dead or that his profile shouldn't have been deleted, then ask all of Foo's friends what to do. Simple vote, majority wins. If someone is still unhappy with the result of this, then they can take it to the real world court system.

Some people don't want all of their friends and family to be notified when they die... so while your transparency idea sounds good in THEORY, I fundamentally disagree with it. Ditto for your appeal process idea. Some people prefer to fade away in silence with dignity (from their point of view).

That said, both of your ideas have merit if they are proposed to users as available OPTIONS that can be manually activated/opted into, but I would hope they never make them the default behavior. Losing someone close is hard enough without turning it into some democratic voting catastrophe.

I believe the legacy contact system is far and away superior to any mess like democratic voting by social peers. It's specified by the person THEMSELVES, as it is after all their account, their life, and their identity being handled here. For those that don't specify a legacy contact, respect their privacy settings and don't auto-opt them into new features that deactivate previously set privacy settings... I'm looking at you FACEBOOK, just because you launch version 2.0.whatever of the insert-feature-here, that doesn't mean the default setting for all previous versions of that system should flip to PUBLIC "magically".

Fuck Facebook.

I would not want to first hear of my friend's death via an automated Facebook notification, still less in the form of an invitation to vote on whether to honour a family member's request to remove the profile.

Maybe this is how we find out if Facebook really deletes user data, or if it just hides it.

The change.org petition had 850 signatures over the year or so before the article was written - it is up to 1150 now.

Side note - change.org has an interesting UX there - roughly they replay the last ten minutes of sign ups as you visit the site (so I went twice and saw the same people "sign up"). It gave me a real sense of momentum the first time I went ... had to readjust as I realised.

I kind of feel sad for person that feels like loosing someone for second time. Where "kind of" means what kind of universe person is living in where FB posts or messages mean something. I am too cynical or and too technical. Maybe totally different person who thinks while loosing someone "it is sad, but after couple weeks I accept it".

So am I bad person?

Or is it just clickbait article trying to get attention on Facebook bad publicity?

Full disclosure, I just removed my FB account after GDPR went into effect, still have to see people crying over it.

I agree. After a reasonable period of mourning, the mentally healthy thing to do is move on. It's not good to ruminate over old letters, Facebook posts, photographs, or whatever of a dead person. OK to a keep a few things as fond mementos, but keeping and revisiting every scrap of history is unhealthy.

While reading the article, I was struck by not only the impact that Facebooks actions had, but also on how the presence of the online content changes how someone is remembered and grieved. I could see in some cases how it might range from unproductive to unhealthy--like a digital equivalent of keeping a shrine and living in denial. I don't believe that's true in this case as 6 months is no time to get to grips with such loss.

The more I see this sort of thing, the more I'm heartened that individuals are fighting back against Facebook.

I don't necessarily thing Facebook was in the wrong here. Sure maybe somebody made that request to delete the profile against the family wishes but Facebook doxing someone also isn't very acceptable.

It's a court ordering it, they have the ability to require those sorts of things, it isn't doxxing someone if that person committed fraud.

I'm not against the court order. I read the parent's comment as though Facebook was in the wrong for not giving the name to the family before the court order.

Fair. You also said you're not sure Facebook was wrong, and made reference to doxing. Let's see if we can clear up those points.

Providing the identity (or some approximation) of this person, to the family, is not the same as releasing his home address on 4chan. The term "dox" does not apply.

(It might apply if Facebook blindly obeyed the request to restore the page, and it turns out the page has personal information on someone who doesn't want it there. Technically the information was already public, and actually listed in the same place, so I still wouldn't use the term "dox".)

I wouldn't expect them to unquestioningly restore the page upon request, but refusing to talk to someone who says their dead family member's profile was taken down by mistake is shitty behavior. Legal, maybe, but I wouldn't go so far as "not wrong". It's pretty wrong. Right?

Sorry, but if you're not family it next-of-kin, and you requested for Facebook to delete someone's profile, you should be identified to their family, and the profile restored.

What if you have power of attorney? Even if you were family, Facebook should not be help responsible for having to provide you with a name. The person who made the request has a right to their privacy and if Facebook acted in good-faith (which is questionable, I know) and validated the person making the request had the right to do so then I don't see any issue with Facebook's actions so far.

That's what the court order is about - determining whether Facebook acted in good faith, or whether there was a process for determining power of attorney.

You even said that whole point was questionable - enough of a question to have a court legally compel Facebook to answer these questions.

I don't see any issues with the court case pressing forward to get some answers, do you?

OK, next-of-kin and/or power of attorney, I should have added. Yes, I agree. I'm sure the court would, as well.

But not some random person, fan, or acquaintance, as it appears in this case.

Even assuming their action was purely malicious (and not, say, an extended family member or friend or even fan of the band that was a bit surprised to see a still active profile for someone they were well aware was no longer around and thought they were fixing things), it's a weird world where Facebook has some sort of moral duty to disclose their identity to people apparently obsessed with pursuing them.

If the profile can't be restored, that sounds like a separate policy issue with Facebook defaulting to permanently deleting rather than simply hiding profiles in these circumstances.

Agreed. That's how every other claim against an estate works.

You missed the story. It was not about whether Facebook was allowed to delete the profile - it was about giving information to family members of the guy who died.

What causes outrage from companies such as Google or (here) FB is not what hey do - but that it is impossible for normal people to get any information about anything! Your Youtube video was deleted - why? No response. My dead partners data disappeared - why? No response. No response to anything. This IS outrageous! Not responding to reasonable requests - and that has nothing to do with "legal" - is one of the worst ways of humans to interact with one another. Try it at home. Their behavior of ignoring you - and again, this has nothing whatsoever to do with what is "legal" - is what gets to people. Psychologically that's just really, really bad, the worst way to treat someone. Which raises the issue to another level: How arrogant as well as stupid are this mega-companies that they think they can do that, that there will be no long-term repercussions? This can't go on forever, people don't accept that, so wouldn't it make business sense to treat your "data-providers" (if not customers) just a bit better? How mighty do they already think they are that they don't have to answer very reasonable questions of people impacted by things they do? Nobody says they can't do it, we just want to TALK! Give me a human, not a bot response!

What makes it especially bad is that the requests are tiny! They could be handled easily (yes yes - needs actual humans, i.e. "expensive", oh the horror for those mega-companies who don't know what to do with all their money - but it's easy).

> but that it is impossible for normal people to get any information about anything! .... Psychologically that's just really, really bad, the worst way to treat someone. Which raises the issue to another level: How arrogant as well as stupid are this mega-companies that they think they can do that

This problem has its origins in the big users-as-products companies wanting to totally eliminate their user support costs, but it's going to get worse. With all the hype around "machine learning," soon no one, not even insiders, may know why your stuff was deleted or your account banned, because it was all delegated to an inscrutable "AI" system that acts but can't expose it's "reasoning."

> This IS outrageous!

I know we are beating a dead horse here.

But why are people who are not customers expecting customer service.

You do get customer service from google if you are paying customer on their gsuite products. That seems reasonable to me.

Do you know how much Facebook makes, on average, off each of its members?

Doesn't matter. You don't pay any of that. You aren't the customer.

Not trying to be argumentative or anything, but newspapers and magazines have long had a similar model, but you have to pay for them. So does that 25 cents change you into the customer, even though they make way more from ads? I think it is a greyer area then people think.

We are entering what is called by some deep thinkers as "The Attention Economy" and you pay for stuff with your time and attention which clearly is worth money.

So according to this it would be ok for them to not provide any customer service if they were breaking even or running at a loss?

Are you asking my opinion? In my opinion all companies, as well as government agencies and most other organizations, should have polite, knowledgeable, trained, and responsive customer service.

At the very least, they could use email, which for me is actually better than talking on a phone (which I detest, especially if the rep has a strong accent). Email has many other good benefits and provides a documented trail that can be used to escalate cases by either party, or even in a court of law if necessary.

> In my opinion all companies, as well as government agencies and most other organizations, should have polite, knowledgeable, trained, and responsive customer service.

ok I understand but how does that relate to how much money they are making per customer?

Your question was about that.

it’s not easy.

it sounds trivial because you are trusting. fb has a duty to protect itself (and its users) against fraudulent requests. acheiving this with low wage factory-like processing by contractors not paid to think across many languages and cultures is in the realm of hard.

better to err on the side of caution. imagine the backlash from erring on the side of permissiveness.

to be clear, in this specific case i believe fb went too far in stonewalling the family.

I am not trusting!

I had a business myself, and I believe if humans are random. Depending on the environment they grow up in humans can end up torturing for fun. Anything bad that anyone can think of - somebody is doing it or going to do it, same as with anything good.

But none of that has anything to do with the basic request: TALK to people.

> imagine the backlash from erring on the side of permissiveness.

So what? Why is it better to manage the current outrage? It isn't. Same thing: You talk. That's what humans do. And as I wrote in another response: Scale is the problem of the business, which after all uses just that to make lots of money (in the case of those giants). They are always looking for was to improve and for what to invest their considerable wealth in - well, here is a good problem to solve!

What it seems we are facing here is pure, unadulterated greed. They want to rake in billions and do the bare minimum. We, The Human Race, cannot continue to reward this behavior.

You really think all the woes fb is going through now, from being too loose with data, is on the same level as managing criticism from being too tight?

TALKING to people is impossible when the people are in the large millions and even billions, and you are a corporate entity. You are just not going to get thousands of staff to communicate a consistent intelligent message and philosophy, across many hundreds of cultures. It's a good problem to look at if it would improve the bottom line. It won't.

I think you are also assuming fb actually cares. They don't. fb isn't a human.

Facebook's ad revenue per user is something like $5 a year: https://www.cnbc.com/2017/11/02/facebooks-revenue-topped-5-p...

Presumably their per user costs eat up most of that. That means that having any human manually do anything for you will almost certainly cost more than the value you bring to them.

Ad supported stuff generally cannot provide customer support, excepting perhaps paid customer support, which people tend to find horribly objectionable.

> Facebook's ad revenue per user is something like $5 a year

It looks like that's the global number, which includes people too poor to afford an internet connection (so FB subsidizes that for them to keep up its user growth statistics).

Your link also states:

> In the U.S. and Canada, ARPU rose 35 percent to $21.20.

I believe that figure is per quarter, not year, and globally. It is a little over 5 a month for the US and Canada, not per year - 20 something a quarter.

Their graphic is page 8 of this earnings report https://s21.q4cdn.com/399680738/files/doc_financials/2017/Q4...

which says to see SEC filings for the definition of ARPU.

I found

"We define ARPU as our total revenue in a given geography during a given quarter, divided by the average of the number of MAUs in the geography at the beginning and end of the quarter." p. 23

http://d18rn0p25nwr6d.cloudfront.net/CIK-0001326801/2309fab3...

Across 2.2 billion users, nothing is tiny. A team would have to sensitively handle thousands of requests around the clock (the worldwide mortality rate is 8.33/1000, which would suggest 18 million per year or 2000 per hour, but their user base might skew wealthier and younger for now).

Scale is the company's problem, after all, that is what it uses to make money!

The request of the person IS tiny - and so is each response.

Favebook’s policy for not giving information to family members came out of situations where the decreased was not on good terms with their family. When to give out information and to whom are not obvious or easy decisions when you have a billion users.

As I already wrote: Nobody (reasonable) asks them to do anything other than TALK. If that is the issue, then say so! Of course, they would also have to provide a way out if the issue can be shown to be invalid.

From the article: Ms Sabados said she spent a year talking to Facebook before pursuing legal action.

This. It is hard to imagine a situation in which providing information on the identity of person who requested the removal of a dead person's profile to an aggrieved party is going to result in anything other than the harassment of that person. Especially in circumstances like this when that person may well have felt they were acting reasonably, and does not appear to have committed any actual criminal or civil offence.

Facebook's responsibility to not promote the harassment of its users exceeds its responsibility to provide details of why they carried out a request.

Additionally, Facebook had some reason to believe that even if they wanted to doxx that person, disclosing their communication to a third party without that person's own permission may have been a breach of UK/EU data protection laws

Thank you!

I don't want my scumbag parents or extended family getting information about who is carrying out my affairs from random companies after I die. There's a reason why I'm planning on writing a will to specifically exclude them from any sort of inheritance if my husband and I died together.

Plus these were unmarried partners!! Unlike spouses, unmarried partners have no legal standing as next of kin in most of the world.

Thank you! Amount of insane comments here is deeply disturbing.

Deceased person could have "secret" lover whom he was going to marry. He could have secret son who had more right to decide what to do with the page than anyone else.

He wasn't married to person who harassed Facebook. He could have relations with dozen other women all of whom asked fb to erase all history of it including messages and photos. Grieving person might try to demand restoring profile and giving her access to it so she could identify them and make their life living hell. Yes this might sound farfetched and a little bit insane but stories like this really happen all over the globe thousands time a day.

Its easy to agree with fb here especially because "widow" couldn't possibly do anything good with requested information.

Not everything is "doxxing". In this case somebody made a request to Facebook under their own name, and there's no clear reason why they should be entitled to anonymity.

Kind of stupid to call this "doxing". It's not like they're requesting his SSN, addresses, and banking details get posted all over the web.

"We want Facebook to say exactly what their process is when they receive such a request - behind that profile was a human being and there are lots of people affected, a circle of friends who love that person." Seems like a legitimate request to facebook. Having transparent policies is a must imho

Did ever look how spam filtering or search results ranking algorithms work? They work exactly because companies keep their policies secret. Transparent policies would get abused instantly.

Facebook processes might change every month to react on actions of billion users. What good disclosing it could ever make? You could see examples of abuse of Facebook policy in other comments here.

If they figure out who did it then let me know. I'd pay to get my old profile deleted.

To Facebook, we are all just so much data. They just don't care. Who doesn't have a personal story or two about Facebook's indifference by now? Just...Delete Facebook. It is time.

Corporations are people only when it matters to them.

It doesn't matter if you delete Facebook, they will just maintain a "shadow profile" on you anyway. (See https://spideroak.com/articles/facebook-shadow-profiles-a-pr..., https://techcrunch.com/2018/04/11/facebook-shadow-profiles-h..., https://www.theverge.com/2018/4/11/17225482/facebook-shadow-...)

We flatter ourselves that just deleting the app will be enough to stop Facebook from tracking us. Their appetite for our data is much too voracious for that.

Doesn't GDPR require them to really delete?

Feel like it's a disgusting game of scratch our backs and we'll scratch yours with the data they both hold - spy on our people, we'll spy on yours.

If you look at the answers Facebook provided to the US Senate they say:

"When the person visiting a website featuring Facebook’s tools is not a registered Facebook user, Facebook does not have information identifying that individual, and it does not create profiles for this individual.

...

We do not create profiles for non-Facebook users, nor do we use browser and app logs for non-Facebook users to show targeted ads from our advertisers to them or otherwise seek to personalize the content they see. However, we may take the opportunity to show a general ad that is unrelated to the attributes of the person or an ad encouraging the non-user to sign up for Facebook."

https://www.judiciary.senate.gov/meetings/facebook-social-me...

It's conceivable that Facebook could deanonymize users/aggregate the data they get from like buttons etc, but they claim that they don't use that data for ad targeting and it's only used for security.

Not a lawyer but I'd dig into this:

> We do not create profiles for non-Facebook users

What is a "profile"? Is a shadow profile a profile? Not "creating a profile" may be very different from not tracking someone.

Even some of the ancient congressmen who know nothing about technology already have figured out that Zuckerburg lied to them extensively. I hope that our representatives will start to do their jobs. It has to be a crime to lie to Congress, no?

> "When the person visiting a website featuring Facebook’s tools is not a registered Facebook user, Facebook does not have information identifying that individual, and it does not create profiles for this individual.

I'm extremely skeptical of that. When I downloaded my Facebook data, there was a "contacts.html" file that contained data scraped from my phone's contact list aggregated with other contact information that I'd never seen before for people I'd never been Facebook friends with. Some people on that list have never had Facebook accounts. While I don't know if they had extra data aggregated into their entry, the fact that their data was scraped from my phone shows Facebook has the data to create a profile for them.

I'm guessing their statements are only true if you read them very narrowly in a misleadingly specific way. For instance, by understanding "profile" to mean a "the Facebook Profile that comes with a Facebook account," rather than a more generic "collection of data about a person."

Yeah, we don't create a profile, we create a _shadow user_ , it's _totally different_! ^_^

Oh totally, like for sure.

Yes, I've read all that stuff. But it is a step in the right direction. What happens if everyone does? Then who can they show ads too? They grew fast and they can shrink just as fast...it's happened before. You got AOL? Yahoo? Using Netscape much these days? Played with your Atari in the last few years? I'm sure all these companies thought it would never end...but it did. Facebook will too.

It does matter. It sends a message, and it frees your mind to use a cliché. If you don't have a Facebook account anymore, it's easier to get over the dopamine addiction because you can't log into an account that you don't have anymore.

> ...easier to get over the dopamine addiction because you can't log into an account that you don't have anymore.

What you say is only true if you can suppress your addiction for N days without logging in. Deleting a Facebook account takes N days to "process", but everyone knows its just a manipulative policy designed to prevent people from following through with deletion.

For all intents and purposes, when you try to delete your Facebook account, they basically say "Sorry, we won't let you do that until you can prove you won't use it again for N days". Logging in at any time before the Nth day will automatically abort the deletion.

On top of that, there's this practice of differentiating between suspension and deletion going around, which makes proper deletion an intentionally obfuscated task. I remember deleting my Quora account to be a strangely convoluted process.

There needs to be a distinction between "proper deletion" and "not even a deletion". The current account deletion feature is "not even a deletion". I hope one day "not even a deletion" is looked down upon enough to warrant change. Deletion means "proper deletion", it never meant anything else to anyone.

I'm a critic of FB, but to play Devil's advocate, they'd be criticized if they summarily deleted accounts too. This provides some protection against malicious deletion requests.

Right - leave your ipad on the table for a moment and your bratty little brother can irrevocably delete your facebook account? People would hit the roof.

Then pretend you're dead and request removal. Deceased people don't buy stuff so their data and purchase history is pretty much useless to advertisers.

No company cares about you, but Facebook probably cares more than other big tech companies (Google, Microsoft, etc.) if only because your feelings drive your usage of its services.

So, what they care about is making you feel like you should use their services more?

what? that could be said about every single company that wants to sell things to people.

Customer service is the way to people's hearts. Ultimately, Facebook and some of these other companies are using bad business practices and it has to come back and hurt them eventually.

Actually, you can reach actual human representatives at Microsoft. You absolutely cannot at Facebook. I don't wanna bore anyone with my most recent story but you really can't. And I was an advertising customer too, not just a regular member. They care so little that when I challenged my Paypal payment to them, trying to force a human response out of them, they let it default and I got my money back from Paypal. You gotta admit that is pretty remarkable.

>Actually, you can reach actual human representatives at Microsoft.

Maybe you can reach an outsourced rep from India after waiting a few hours.

It's something though. Don't they have a more responsive online chatting thing too?

So you can reach actual human representatives at Microsoft, as said.

That’s a poor generalization. A company, as a legal entity, is incapable of caring. But a company, as an organization comprised of people, can.

At Facebook’s scale, it would be very difficult for their employees to care particularly for any individual user, but collectively, it’s not out of the question.

This is what happens when you don't have many staff and your algorithms aren't nearly as good as a decent person. Facebook has no way out of this, as currently set up.

Would you believe it: If you want to have others vouch for you after losing credentials, you can't pick a single person, you're forced to pick 5. If you don't want to pick 5 you can't use the facility. What kind of mind comes up with a system like that?

The thing that may be bothering them is that this will reveal that they don't actually delete an account.

If they got out of the way as gatekeepers, let you use your own data, and that which you're permitted to see, on your own terms it would be better.

If they remain as gatekeepers they will suffer pain, potentially lethal pain.

I'm guessing they're checking some sort of database for recently-deceased automatically. I don't see why it'd trigger an automatic deletion rather than setting the account to some sort of inactive status, though.

Edit: I'm wrong, it has to be specifically requested. I wonder how they determine whether the requester is privileged.

Nope. You have to specifically request that an account be "memorialized", otherwise it stays there just like they've not logged in. I had to do it with my wife's when she passed away.

And "memorialization" just makes it so that the account can't post, log in, etc - but other people can still post to that account's "wall" - "we miss you" messages, etc.

I had to provide a picture of the death certificate and a link to an obit (IIRC, it's been nine years).

Reply on news.ycombinator.com