One of the first things they could do is stop with the dark patterns. The original thread had many people mentioning that deleting an account was a ridiculous process, with a 30-day delay once you managed to start it.
"We're processing your request and should be done within 30 days.
We will verify your request using the information associated with your account. Government identification may be required and we may ask you for more information in order to verify your identify.
Any questions? Email us at privacy@triplebyte.com"
They didn't need "government identification" when I signed up for it. Never going back to this site again.
You built a company that's obviously valuable and lots of people rely on. Now you have a lot of responsibility. You're going through the "trough of sorrow" with respect to a new feature.
This is what inevitably happens when lots of people come to rely on you. The one thing I'd like to say, which may sounds strange at first, is think about why you really need each piece of data.
https://www.theguardian.com/technology/2019/jan/20/shoshana-...
There is now a growing movement including GDPR and California's privacy laws. You can see how duckduckgo is able to make money by advertising around keywords rather than personal data, etc.
You can help lead this movement, by allowing job candidates to have most of the data encrypted, and only reveal it to companies on a need-to-know basis. Push the point where they reveal it further back, and you'll have less friction for new signups. Every time people are asked for data, they'll already have a good reason: someone wants it. To be clear, that includes the candidate's Name, Age, Gender, and other private info.
These constraints are walked back almost immediately in practice, once companies learn that requiring a human touch for a deletion flow is not worth the hassle.
I think "legal" here meant what's the bare minimum to respect the letter of GDPR law, while not actually implementing a useful delete flow.
Appreciate the honesty here by admitting that account deletion relies on dark patterns, but it brings up two salient questions regarding how you approach product development.
1. Internally, do you at least have the equivalent of a “directly responsible individual" (DRI) for the product? It seems no one spoke up in the interests of users against legal’s overzealous decision to tack on lots of friction to the account deletion process?
2. It seems you could have also garnered some push back on the feature from your alumni Slack [0] but didn’t, perhaps due to the rush to ship quickly?
In addition to the changes you’ve pledged as part of rebuilding user trust, hopefully, you & your team will reassess your product development practices to add these checks so that such mistakes are not repeated in future.
[0] @hysan mentions that TB maintains an alumni Slack upthread: https://news.ycombinator.com/item?id=23304199