Tell HN: Discord Ignores Right to Erasure | Hacker News Reader

Tell HN: Discord Ignores Right to Erasure

248 pointsbtdmaster89 comments

I have contacted Discord for right to erasure on 2022-02-26 and I have received no response. For context, they have stored metadata on almost all interaction with the following keys for over 4 years (i.e. since account creation) with no way to opt out:

['event_type', 'event_id', 'event_source', 'user_id', 'domain', 'freight_hostname', 'freight_id', 'ip', 'day', 'chosen_locale', 'detected_locale', 'user_is_authenticated', 'browser_user_agent', 'browser', 'browser_version', 'cfduid', 'os', 'client_build_number', 'release_channel', 'city', 'country_code', 'region_code', 'time_zone', 'isp', 'message_id', 'channel', 'channel_type', 'is_friend', 'private', 'num_attachments', 'max_attachment_size', 'length', 'word_count', 'mention_everyone', 'emoji_unicode', 'emoji_custom', 'emoji_custom_external', 'emoji_managed', 'emoji_managed_external', 'emoji_animated', 'emoji_only', 'num_embeds', 'attachment_ids', 'has_spoiler', 'probably_has_markdown', 'user_is_bot', 'sticker_ids', 'message_type', 'system_locale', 'components', 'is_first_message', 'cfduid_signed', '_source_job_id', '_ingest_ts', 'rendered_locale', 'accepted_languages', 'accepted_languages_weighted', 'primary_accepted_language', '_hour_pt', '_hour_utc', '_day_pt', '_day_utc', 'client_send_timestamp', 'client_track_timestamp', 'timestamp']

The actual files are 75 megabytes of text(!) data.

This, to me, is clearly not reasonable under CCPA or GDPR. Even if it were, they have not responded to my emails, even though the 30 day limit has long passed. What can I do?

The same Discord that told me to just use someone else's phone to verify my account when they kept saying my phone number was invalid?

This doesn't really surprise me.

I always thought phone numbers had to be unique per discord account: https://support.discord.com/hc/en-us/community/posts/3600524...

That's correct. They wanted me to use a phone of someone who doesn't otherwise use Discord (specifically they suggested using my wife's phone).

Was yours a VoIP/virtual number?

It was a cell phone number that was ported to Google Voice, so technically it is now a VoIP number. I'm aware they don't allow those, but they also have no workaround for people whose only number is virtual, like mine (other than suggesting I use my "roommate's" phone). They need to have a workaround, but they don't seem to care about people who don't have actual cell phone numbers.

Discord support is non-existent like every other digital company. Customer support in 2022 is a cost center.

I'm often surprised by how responsive dang is despite being an individual whenever I email HN.

The only thing you can do is complaint to relevant authority in your country.

> I'm often surprised by how responsive dang is despite being an individual whenever I email HN.

Dang is actually a General AI robot built by sama as a hobby.

I kid, he's actually just a really great person who cares deeply about HN and it's community. And also one of the nice things about HN is that it's not trying to make money, so WE are actually the customers.

This is why we need a TNG style star trek utopia. This nice thing exists because its not being monetised because it has patrons. If we remove the need for money and thus patrons, everything can be better.

I also want this and no one seems to be interested, unfortunately. An in-law recently told me it’s “never going to happen”. I’m not asking to be beamed to the Moon and I’m not asking for replicators to arrive in my kitchen tomorrow. I wouldn’t mind more focus on just trying for a world without “medicine or food?” being a challenge someone has to deal with each week.

This timeline is broken. I’d like to visit another, please.

It's that whole temporarily embarrassed millionaire mindset we all have. Hard to give up what we already have, especially when some people will definitely try to cheat.

Pretty sure he/she has a team that he/she only a public face of

Dang is a person, not a nickname: "Dan G." As far as I know there's no reason for a team to share that profile, the moderation team had separate profiles back when it was multi-person

The "comments" link in the top navigation takes you to all comments on HN, across all posts. It would be hard, but perhaps feasible to read through all the content that is posted.

On Discord it would be impossible for a person to read through just all newly created Discord channel names. It handles over a million messages per minute.

Contact your local data protection authority

Thank you for the suggestion, I have already done this as soon as I could (late March) and they have not yet responded either.

I had a similar experience with California prop 65 (requires business to add a label to products that contain carcinogens). The business itself was way more responsive than the government agency, nothing happened but it was surprising that even handed a trove of evidence & emails about a clear food safety violation they didn't really do anything. Well I guess not surprising haha.

Not really surprising at all. It's incredibly common for legislatures to pass laws requiring something that would take resources to enforce, but not budgeting for those enforcement resources. It's called an unfunded mandate.

My experience is that vague prop 65 warnings just ended up on virtually everything. I guess the CA legislature tried to address that, but I don't live in California so I have no idea how much improvement there's been, if any.

I assume you're in Calif based on the above? The ICO in the UK is usually pretty good if you report.

I had trouble getting Discord to respect the law regarding automated account termination. I contacted my local data protection authorities and then contacted Discord through several channels and informed them that I had contacted the authorities. Within a day, they reinstated my account without a word.

That is the default now for big companies, it seems. They think they are invincible, and that one measly user cannot harm them. You have to basically threaten them to get them in legal trouble with a bigger player like the EU, so that they listen. This is because all their incentives are tied to profit, instead of ethics of freedom and consent. Unless you have something, that could harm their profit, they will try to abuse you.

They wouldn't even tell me what I had supposedly done wrong when they terminated my account, and said that they investigated the claim and upheld the termination... That is, when they eventually responded.

I had to make a new account and set all the servers and such back up.

I suspect getting the word out on here etc is much more effective than any effort they're likely to put into it if you did.

Also had this issue with an old account. They "deleted" the account, but to this day I can still see (from a different account) that my name is tied to that account, and that account is then tied to messages I sent from it. Have contacted local authorities about it in the past, but it seems that they have limited jurisdiction/care.

Discord has been hoarding data like Smaug for years.

I wonder why. Maybe they have plans to train a neural network on it or something.

A couple of main reasons are:

1. Accumulate a large volume of data where its value is based on sheer size. Their "revenue model" could be a red herring for a later acquisition based on the monetary value of their datasets.

2. Analyze the data in-house and sell predictions, not the data itself which could skirt some privacy laws

Idk why but this visual made me giggle. I totally agree though, and have a hard time conversing with people who don't believe Discord is accumulating one of those most valuable, granular, personalized datasets in existence.

Valuable? To whom? To whoever wants to spy on millions of 14 years olds cursing each other over the most insignificant petty squabbles one can imagine?

Sure there are good communities in there but I don't imagine they are distributing illegal things or want their existence be secret?

But I can see a lot of value in the existence of the mountain of metadata, sure.

To imply that the user base is mostly 14 year olds taking part in petty squabbles is a direct contradiction to their stated revenue model which requires a credit card and money. I doubt that a majority of their nitro purchases are from 14 year olds who stole their mom's credit card. Are you being deliberately obtuse?

A server doesn't have to be communicating secret or illegal information for their data to be valuable.

What makes it valuable? You have millions of users age 20-40. They are conversing about their tastes, interests, and other personal identifying information through text and voice. Text is easy to parse. Voice isn't much harder. Just identify keywords and then start transcribing voice conversations. Now it's in text form. Run analysis for marketing purposes, sell to literally any company that does market analytics.

> Are you being deliberately obtuse?

Certainly not. I am being dismissive because that's what I mostly have seen Discord being used for -- game coordination.

I don't dismiss there's some valuable data there, I am just very skeptical that most companies are even able to capitalize on it the way you say they might. That requires competence, and time, and budget resourcing, and most companies suck super badly in that.

I know several people that use discord as their primary chat client. Aside from that lots of college kids use it for comms about classes, there are tons of discord groups for interests and hobbies. It seems like everyone I meet has a discord account nowadays. Anyhow, just wanted to point out that it’s not limited to game related chat.

I know it's not, I was a bit dismissive indeed. :D

It's a bit frightening how ubiquitous Discord is becoming.

I'm 45. Everyone on my Discord server is over thirty. I'm in multiple communities for adults.

Your vision of what Discord is, is flat out wrong.

Discord is particularly bad on erasure as they have a TOS that gives them a perpetual royalty-free license to your photos and use this license to allow leaving photos from users up in discords they have been banned from.

This effectively means it any private server admin decides to ban a user they get to keep their content up without their consent as the user no longer has access to delete it. Discord will support the server admins in this. I’m pretty sure this is illegal under GDPR as the necessity of collecting such data is very unclear and the argument for deleting it is quite strong. Lots of servers have all kinds of selfie posts and some adult servers even encourage sharing adult selfies. The idea that they get to keep this content against the will of the user is extremely suspect.

> The idea that they get to keep this content against the will of the user is extremely suspect.

Discord relies on basic posts and basic channels to host things like community rules and bot-powered role assignment questions.

When the person who sets those up leaves, transfers ownership, or is booted... they all still remain on the Discord Server. (Arguably if they were deleted it would cause some chaos. But that's solved with better features, like the "Community" feature that lets you put rules in welcome splash page.)

While a user can always delete their own content (likely it's not actually deleted, but deleted from public eyes), once they leave a chat, or are removed from a Discord Server, they lose the ability to interact with messages they posted. I can see a problem if I post something in what was marked "private channel" and then after I'm booted the admin makes it a "public channel" -- or changes the "see chat history" flag that allows new users to see messages from before they were members.

Anyway I get it creates problems for Discord, but it's all all solved by building out a "community rule channel" type, as they've started to do with their "Communities" -- separating the server management content from the individual user-generated content is a good first step.

I'm going to fire off a delete my data request and see how it goes. Guessing 3-4 months before I have any sort of update. =P

Instead of a "community rule channel", I would love to see shared-ownership (or no ownership, however you would like to look at it) posts. A post that users of a certain role can all edit and isn't bound to a single account. This is currently generally done by using a bot to make and edit posts with, but the UX of using a bot versus normal discord editing is very poor.

ive tried several times. nothing will happen. just run the discord delete monkeyscripts etc

There are general bots available for anyone that will repost any deleted or differences in edited messages in (usually) admin only channels. I once got banned (by a server/group/guild admin) for mass deleting messages because I was “spamming their admin log channel”.

Needless to say the deletes only highlighted my activity and put all messages into view again… for less people but still. Part of me things maybe those types of bots should be forbidden? I’m not sure though. I come from the IRC era where everyone logged everything and there was no edit or delete.

Oh really good point. The admin logs for each server... you can never really delete those, even though it's all full of what you say and even images you post. Kind of filthy to think about all that. Just a bot copying everything you send Discord and re-posting it just so the admins have copies no matter what you do. Sure it's not "your" posts, but if you really wanted to delete all the data those should be included in the delete. Oof. It just gets messy fast.

The Right to Erasure is not absolute. There are a large number of reasons why they may not be required, or even allowed, to erase some or all of those data points.

They are required to explain themselves. Per GDPR Article 12 Paragraph 4, even if they do not delete any data they owe you a response. This would include the legal justifications for not erasing the data.

I suspect btdmaster is American and, as such, has no GDPR rights wrt Discord, an American company. I don't believe in that case that Discord is required to explain themselves.

Separately, OP starts with a complaint about deletion; then complaints about not being able to opt-out (a different discussion than deletion); then states that OP finds this unreasonable under GDPR and CCPA -- which, given Discord is an American company, I struggle to figure out how both would ever apply. Only zero or one will apply to OP.

And finally, as you point out, the GDPR right to deletion is not absolute. The data subject has rights, but companies have a legitimate interest in keeping the context of a discussion around, and are also allowed to consider the legitimate interests of others. An analysis would be required to figure out if it is an overriding interest.

> The data subject has rights, but companies have a legitimate interest in keeping the context of a discussion around, and are also allowed to consider the legitimate interests of others. An analysis would be required to figure out if it is an overriding interest.

Yes, but (at least under GDPR) it is reasonable to demand that Discord removes everything not needed for following legitimate interest of others (e.g. IP address, browser user agent).

Those can likely be maintained for anti-abuse purposes as well, particularly if OP got blocked. Separately, (1) Discord claims some of this is deleted at 14 days; and (2) good luck getting an overwhelmed DPA to take seriously your complaint that a company stores browser user agent longer than they ought to.

There is no need to assume that, I am covered by GDPR. I listed what the data in question is - tens of megabytes of text providing IP address, location, ISP, etc. is sufficient to personally identify perhaps even better than a name or similar, in entropy-bit terms.

Then why are you rambling about CCPA? Why are you not clearly stating which country you are in and which DPA you are covered by?

Why are you discussing the size of the data -- it makes no difference if you record an IP address once or a billion times?

Discord is registered in California, so it would concern them even given limited GDPR enforcement. Data size matters since it changes, and there is information even in the knowledge of no change happening. I would rather not share my location, and I do not understand how that would help given I have already contacted my DPA.

CCPA applies to California residents. You are very unlikely to simultaneously be a California resident and an EU/UK resident. So discuss the law that applies.

If you are in the EU, your contract is with Discord Netherlands BV.

it's not like they'll have different user account behaviours for someone living in California at the moment, compared to someone living in the EU.

Many companies do, in fact, implement different rules and data retention for those two circumstances.

Source: I've helped several, and talked to peers who work in data protection.

This is one reason I never user their Desktop Apps and simply use browser.

Yes, Discord + uBlock origin on Firefox or Librewolf is the way I use Discord.

uBlock catches a lot of trackers, too.

I use TrackerControl [0] and DDG browser's tracker blocking feature. Discord is one of the worst offenders. I simply uninstalled the app.

[0]: https://trackercontrol.org/

I had a Discord account a couple of years ago. It was more than a year old when I lost it.

I had recently bought a new domain name, to migrate e-mail to and move away from GMail. When I changed my Discord account's e-mail address (which worked), I was booted out of Discord as soon as I clicked the confirmation link in the new inbox.

When I tried to login again, I was told that "something fishy is going on", and was prompted for my mobile phone number.

Unwilling to hand this over, or to deal with a company holding one of my accounts to ransom trying to extort yet more unnecessary information out of me, I asked them to delete my account. After all, I have no use for an account that I cannot use.

I had to ask three times in the ticket before they actually entertained the notion (I was one e-mail away from CCing the Information Commissioner's Office), and then had to reply in very specific employee-provided verbiage to the tune of that's what I actually wanted.

The ticket was updated to say that this would take up to 14 days. I then got an e-mail the following day saying that it would take up to 15 days.

This does not strike me as a company that gives a damn.

That seems to be common practice by now. Had nearly the exact same thing happen with a Microsoft account. I posted a technical question on their forums and did not give out my mobile number on account creation. Account was locked shortly after without any explanation. Then decided it was not worth it and tried to delete the account. I would have needed to give my mobile number again to even get the option to delete it...

Of course you cannot contact support without an account either. Well, their dead database entry then.

At this point I just buy new phone mobile number lines as an overhead cost

With voip numbers being basically banned in 7 out of 10 services, I’m too privileged to be trying these infinite workarounds aside from just adding another line

Since I’m not trying to be anonymous (to a subpoena) but nobody else can tell the user is the same and assume people won’t bother with paying for an additional phone number or device, so its fine, for now

Iphones have dual sims though

Yandex does a similar thing, after a certain period "a password leak" (bs) is detected and you have to provide a phone number.

Honest question: unless you're top 100 market cap companies in the world, what's actually the practical consequence of not following GDPR as a non-European company?

What's the most they can do in theory -- like issue a court order for a fine? (Practically are they doing this for >top 100 companies?)

And suppose a fine is issued, what's the enforcement? Do US courts or US banks actually enforce these orders? Are there historical cases of this?

In theory maybe they can apply to their local (European) ISP to block your site. Have they done this historically?

I'm asking because to a degree, some laws about the Internet feel like international law. That is, there's no good enforcement of it because the state (the monopolist on violence) doesn't generally care about these laws.

The European state can obviously enforce GDPR, but if you're outside the practical reach of the European state, what real incentive does that company have to care (beyond standard "moral" reasons).

https://politics.stackexchange.com/questions/30509/how-are-g...

Thanks that's useful. From the post:

> The GDPR requires non-EU entities handling EU data to appoint a representative in the EU

What if the non-EU entity fails to establish an EU representative?

> [Anticipating my comment] Basically, their method of non-EU enforcement seems to be "we'll figure it out".

Oh OK, that's what I thought.

Had the same issue. After like 6 months they finally got back to me. These companies should have account deletions automated.

How did that go? Did you get your data removed?

To whatever extent they allow.

FYI: You can use https://redact.dev to at least remove messages from DM's and all servers you are in. (disclaimer, im one of the team members behind it)

As per the GDPR they _must_ respond within 30 days and cannot ask for a fee.

If they didn't, you can file a complaint for CCPA or GDPR violation.

A company of that size shouldn't be fucking around with GDPR deletion requests, they're not "nice to have" features. They're must-have-or-else features.

I have to ask, or else what? In practice?

The fines for GDPR violations are a percentage of global revenue.

This is why every company takes it seriously. You can’t hide from the fines even with corporate restructuring.

If Google fucks up, the fine is based on the global revenue of Alphabet Inc.

I never understood why Discord servers keep messages indefinitely. Especially with no way to delete them in bulk. I also had an issue with support where I lost access to my email address, but still had username, password, and 2fa. Went to change email in my account and it sent the code to the old address.

Discord isn't ephemeral like IRC, that's a big part of why people like it. Why would they auto-delete old messages?

Why should they keep so much data that just raises their storage bills?

Text is very cheap.

Images, a little less so.

Video--I would expect them to eventually evict this.

Because it's great to be able to find that one link someone mentioned, or the thing talked about a year ago, etc. Same reason one might keep their texting history for as long as possible.

They even specifically make a powerful search function to make looking up things easy. You can make a combine query of something like `post by me` `contains image` `in certain channel` `before 2020/03` `contains certain text`. And it will filter out any matching result for you.

It's currently the most useful search function i ever seen in IMs

Both Twitter and Facebook keep messages/posts indefinitely with no (official) way to delete them in bulk.

You are thinking of Discord like IRC. It's not. Think of Discord like a forum/wiki instead. That better represents what Discord is, and how people generally use it.

This reminds me of that time I tried removing comments on HN...

And we can guarantee Discord has already sold your chat logs 200 shadier places. Why bother with an GDPR compliance in one area if they aren't going to in others. Guessing it's just a matter of time before they get sued into compliance.

Discord, and all free chat services, rely on selling data for their revenue. What makes them ultra-filthy, in my mind, is that even if you pay you don't get any special treatment. You are literally just giving them money to sell your data. "Hey guy breaking into my house to steal my TV, here's $5!" That's sort of what being a "booster" feels like.

I'm sure Discord knows which side of its bread is buttered. It wasn't architected to have deletion in mind. Like think about all the private messages, messages in public channels, message threads... (you can individually delete some of those, but not channels you no longer belong to), but it's really impossible to glue an export of one-user's messages back together in a way that has context.

Something like "SnapChat" or "Signal" where you could set messages to have expiration dates would have been a perfect move for Discord. Gamers don't need years of Meme Sharing history stored forever.

Having a business model like Slack... where users have to pay for their own groups. Discord deals with kids, and people for whom $5 is a blocker to entry.

I love a lot of things about Discord, I love Push To Talk, and I wish every service used this. (Microsoft Teams, Slack, Google Meet... why don't you have a Push To Talk option?!)

Anyway, Discord is convenient, has a ton of great UX features that Slack and Teams could learn from. But at the end of the day free is never worth it. You're the product.

EDIT: I ran a Discord server with 20k+ users at one point. And we came to find out that the "owner" of the Discord was someone who had set it up years back and just sort of faded away. Enough of us had Admin it didn't matter, but there are some things only the Owner can do. It took over 4 months to get Discord support to transfer ownership. I was a paying customer. Their support is really wanting. Impossible for it not to be, they don't have any sort of ID verification and nobody to default back to, "Well, it's my credit card..." total cluster fuck. With what I learned... I'm pretty sure I could get access to any Discord server whose owner had been gone for more than 30 days. Just create a fake account similar in name to the last one, "Yeah, I'm Bob, I lost access to my old account..." That's essentially all we had to do, that and wait for the email they sent the original "Bob" to not get a response. Pretty easy when so much of Discord messages go straight to a spam / updates folder nobody ever checks.

> And we can guarantee Discord has already sold your chat logs 200 shadier places.

[citation needed]

I wouldn't be surprised. And also, you should assume it, since Discord is not e2e encrypted.

I think the main problem most people have when deleting their discord accounts is that their public messages are still available to read for everyone just with the username "Deleted User" instead of your own. So it's still pretty identifiable the only way to get rid of them is to delete them by hand or with https://github.com/victornpb/undiscord . Discords rate limits are pretty harsh so with a lot of messages it's gonna take a while 1500 worked without getting timeouts.

What's worse is your unique ID is attached to the deleted user. The only thing you delete is the username which you could have done so by changing it to a generic one.

Reply on news.ycombinator.com