Comment by stareatgoats | Hacker News Reader

Comment by stareatgoats | Hacker News Reader

Parent Full thread

I'm currently in much the same limbo: some geezer with an IP from the other side of the world logged into my fb account, changed password and phone number and likely did a bunch of unsavory stuff that broke the fb "community guidelines".

My account has now been "under review" since Saturday which means I can't log in, and my messenger, my fb profile and the associated businesses and groups that I manage have all disappeared from fb.

Having googled around my initial hopes that it will soon be resolved has flatlined: there seems to have been a surge of this lately and nobody that I have seen have had their access back (the reviewers have been fired?). I will likely loose my WhatsApp as well, judging by the reports.

Of course I realize that as an unpaying user of Meta products people might say "serves you right for being stupid". But I don't buy that. Fb is the de facto online directory of ordinary people (not counting much of the HN crowd as "ordinary" here).

It's totally unreasonable (understatement) that fb can effectively erase me and my online history and business without recourse because their systems leak and they don't have manpower who can do a human review of the facts in the case.

In the short term I'll be looking for other solutions, in the longer term I'll be supporting calls for making services like fb a public utility, with certain legal obligations (like not erasing online presences).

If you live in the EU or the UK, this might also be a personal data breach that Facebook must report to the relevant national data protection authority, because it gave your private data to an unauthorised third party (if the release of that data could risk your rights or freedoms). Failure to notify so can result in fines of up to 2% of global turnover. You may need to contact your national data protection authority directly if Facebook has not notified them.

I've been locked out of Facebook for so long (due to 2FA issues), I'd just like to delete my account. But that's not possible if I can't log in.

I've always wondered how someone who is locked out of a service like Facebook is supposed to delete their content.

Let's say that I'm a resident of some location with better-than-average digital privacy rights. If I can't log in to Facebook, how can I get my stuff deleted?

How do people handle this in places like the EU (or maybe California)?

> How do people handle this in places like the EU (or maybe California)?

Written requests to their privacy officer. datarequests@support.facebook.com

It can be a bit of a pain; https://ruben.verborgh.org/facebook/emails/2019-02-15-dpo/

I’ve tried this, they indeed illegally stonewall you.

Good. If anyone can get access to all my info by merely sending a photo of my passport, I would be very disappointed. Anyone could forge that with minimal effort.

That’s how they rack up fines for GDPR violations. Apparently still cheaper than it is to remedy anything?

Reddit is worse. They will just flat out ignore you.

HN isn't much better. I've emailed them asking for my data to be removed, as is my right as an EU citizen and dang simply refused saying it wouldn't be fair to other users. As if that overrides the law.

If I were dang, I would disable your account so you can no longer log in and post. But the moment you’ve made an intentional public post on a public forum hosted in a foreign country, from my perspective you have lost any and all moral right to demand anything whatsoever in regards to your previous posts, no matter the absurd overreaching of your domestic regulators.

This seems so extreme.

I think the part that bothers me most is that you seem to have firmly decided the EU regulators aren't real human beings trying to solve a legitimate problem in a way you disagree with. That'd be too respectful and humanizing. They're pure evil?

Something tells me there is an untold story behind...

Nah. Had the same thing happen to me. I once asked dang to delete my account, and he stated much the same to me. In his defence, he was polite, and offered to rename my account to a random name, dissociating me from it. He also

On the other hand, I agree with GP. It's surprising that you cannot delete an account. That HN stay "readable" without the [deleted] is clearly secondary to the possibility of having an account be deleteable. Imagine if I were part of an at-risk group.

The law is the law. Your perspective is irrelevant.

Yes, I’m pointing out that you are acting in bad faith and your continued presence on this site shouldn’t be tolerated given your repeated outbursts against the admins. Your perspective on my viewpoint is irrelevant.

Asking for the law to be followed is an "outburst"? Okay buddy. You americans are really far gone.

Is HN hosted in the EU? If not, then the law is in fact not the law.

> HN isn't much better. I've emailed them asking for my data to be removed, as is my right as an EU citizen and dang simply refused saying it wouldn't be fair to other users. As if that overrides the law.

Please read this in good faith: If you want your data gone, why do you keep sending more (posting)? Is it about retention time?

It's personal. And also regarding a different account than this one.

And the idea that the EU has any jurisdiction is California is completely outside the law.

I think dang might be covered under legitimate interest (unlike pretty much everyone who tries to claim the "legitimate interest" basis). Personal data, yeah, your interests probably override it – but blanket deletion of your posts, probably not.

dang is not subject to EU law.

He's likely subject to California law, though. California residents might get a different answer to such a request.

https://oag.ca.gov/privacy/ccpa

> Right to delete: You can request that businesses delete personal information they collected from you and tell their service providers to do the same, subject to certain exceptions (such as if the business is legally required to keep the information).

Yes, this is how legal jurisdictions work. He can receive one request from someone in Mississippi, one from someone in California, and one from someone in the EU, and provide three completely different responses.

Yes, but he doesn't have to.

One of my clients willingly applies GDPR to everyone, regardless of jurisdiction. If you want your data, you can get it. If you want your stuff deleted, you can do so. I think this is the ethical approach.

It is also, from what I know, the legal approach. The EU perhaps doesn't have jurisdiction over a service, but what they can do is ask all the ISPs in Europe to block access to it, for example.

If I'm not mistaking if your site operates in the EU as in it's accessible from the EU, you have to comply with GDPR. It's the reason I can't read some American websites. The infamous:

> Unfortunately, our website is currently unavailable in most European countries. We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market.

Being accessible from the EU doesn't make your business subject to EU law. The EU doesn't claim universal jurisdiction.

Those US newspaper sites you can't access: well, you can access them via archive.org.

From this point of view, can the entire freedom of speech in the US be solved if a company simply moves the headquarters to the EU because at that point US laws no longer apply?

> Being accessible from the EU doesn't make your business subject to EU law. The EU doesn't claim universal jurisdiction.

Collecting data related to EU individuals does make you subject to the specific GDPR law though, unless I'm mistaken.

This, and also ycombinator has investments in the EU

I believe he does have a cop-out if HN isn't selling to or marketed towards the EU, but I thank you for sharing your experience because I'm looking to shut my account in the near future.

>I believe he does have a cop-out if HN isn't selling to or marketed towards the EU

Nope, GDPR attaches regardless of whether you market in the EU/to EU residents, as long as you provide goods or services to people in the EU you're beholden to their rules.

Theoretically, a company that only offers services to US residents (mortgage/banking/legal) could still be beholden to GDPR, since their cardholders might access their website (i.e. be provided services) while in Europe, though as far as I know it's never been tested in court.

Respectfully, this is utter nonsense.

The EU has full jurisdiction within the EU, and zero without. The EU has no ability to demand action or inaction from an entity in the United States. They can ask all they want but it's just that - a request.

Respectfully, this is also not correct. "The EU has full jurisdiction within the EU, and zero without" like in software there are always corner cases, as with e.g. Norway or Liechtenstein. Also on some more specific stuff via bilateral agreements. Has nothing to do with this case, but still your statement is false

Is it though? Isn't the enforcement authority in Norway still the Norwegian government and not the EU? Can't Norway vote to rescind that bilateral agreement?

EU/US laws aside, do you think, from a human perspective, to be unreasonable for me, as a human beign, to have the power to ask for my data to be deleted?

What data have you asked to be removed?

If it is PII then EU laws like GDPR apply, but if it is posts more generally then they are not covered, and it would be unfair to people who have responded to them and those reading those responses later (sans context, if your post were removed). The right to be forgotten covers information about you, not information by you (with an edge-case that if somehow your words in a post unambiguously identify you, that post falls into the first category as well as the second so is covered).

I've got locked out of my instagram. Out of the blue after years & years, their algo detected "suspicious" activity. Not sure what, but they sent a recovery email, which I couldn't get to because I used some old gmail account to register long ago and lost access to that gmail account. And there is no way to recover without it, even though they have my telephone number, a facebook account is linked to it. And so, after a while I gave up and created a new instagram (and lost a bunch of followers), but the old one is still there, I have no way of taking it down.

A written letter to their legal department, perhaps?

You can probably send a GDPR request for your data to be deleted, with your identity proof (e.g. an ID Card). They have to take the profile down.

reminds me of how the most effective and quickest way to delete a facebook account is to post porn

lol

Since you're admitting that there's lots and lots of people on Facebook, from where do you expect it to get the manpower required to review (properly) all the many cases that might appear?

I believe there should be a law that if a companies makes money from their users, be it by showing ads, selling data, subs or sales, they should offer mandatory human support. If they don’t, hardcore fines. It will kill ads and data sales (they are hampered by every increasing privacy demands), which suck anyway. If your business cannot survive by treating people like people, then you have no business in my view.

And meta (etc) make more than enough profit to not be this bad. It’s just that view ‘if I don’t pay, I deserve nothing’; that really should only be true if the company makes nothing from the service (aka a charity).

> should offer mandatory human support

"All of our agents are currently busy. Please hold and we will answer your call as soon as possible."

from where do you expect it to get the manpower required to review (properly) all the many cases that might appear?

Meta had $116,610,000,000 in revenue last year. It can find a way.

It's always so baffling to see people on HN rush to defend these massive companies, pretending that they're resource-strapped like two guys in a startup working out of a garage.

It's always so baffling to see people on HN not understanding that the sole purpose of a business is to make money, lots of money. Also why are you talking about revenue and not profit? Last, but not least, let's not forget the recent lay offs.

It's always so baffling to see people on HN not understanding that the sole purpose of business is to make money, lots of money.

It's always so baffling to see people on HN parrot this line as if it was fact or truth, when it's far from either.

Yes, there are lots of businesses that exist only to make money. But there are millions more businesses that exist for other reasons. And, no, I'm not talking about non-profits. Kelloggs, for example, was founded to improve the nutrition of people at a health retreat.

The whole moustache-twirling moneybag-hoarding billionaire thing used to be a cartoon, because it was so misaligned with the reality of society. But in the Silicon Valley bubble, this has been turned on its head and elevated into some desirable goal, as if the only way to judge a company's value is by dollar signs. It is not.

(It wasn't even Silicon Valley that started this flip. It goes back to the 80's, as parodied by the character Gordon Gekko in the film Wall Street.)

Facebook was supposedly founded to get students laid.

Dinosaurs probably looked more like ducks than alligators.

1. Yes, businesses exist to make money, but if they can't provide good enough service then they will soon be out of business.

2. Revenue is how much money company can spend on various things, they just need to prioritize which things are the most important for them. Facebook obviously do not prioritize customer support.

3. Recent layoffs mean then now have more free cash to hire support people :)

Facebook reported $23.1 billion net profit in 2022, my guess is that reviewing people who went to the trouble of uploading a photo of the national id as requested might cost them $100 grand, tops. Plus they wouldn't risk the badwill and loss of business that sites like the linked one surely will lead to.

If you can’t support your users, your business model is broken.

The business model is fine¹ in that they can support their customers: the advertisers. Their users and their customers are very different populations.

--

[1] For now at least. It is failing a bit and likely to fall off worse over time, that is why they are scrabbling for the next big thing (pinning their hopes on VR until something less “meh” comes along)

The person writing the article IS an advertiser, so now what?

Hm. Perhaps their priority is people who are _just_ advertisers, maybe those who use their products for anything else are such a risk that they get rid at the slightest whim even if they are both sorts of user.

What business model, the one where people and businesses don't have to pay (with cash) in order to communicate with friends or customers or advertise (present) themselves? You can't expect premium support when you haven't paid anything.

FB sure makes a lot of money in spite of not charging for their service.

Their users are advertisers.

Most tech giants can't support their users and they are doing fine.

I would create a Emergency Appeal Service, it will be paid. The giants should offer this, offer many ways to pay and refund you if it was their moderators or AI mistake but take your money if you were the issue. The company could recover the mistakes money lost form the team that caused the mistake, this could insentivise those teams to do a better job instead of playing with latest cool shit.

Imagine how much scammers would use such a service with stolen credit card info.

I do not understand. Someone uses a stolen credit card to get support and a competent human to look into his issue and maybe verify his identity?

What is the issue?

I am always sad when there are comments like this

Meta has announced a 40 Billion dollar stock buyback.

It's not like Meta is unprofitable or a starving scrappy small startup.

Their profits?

It's negligent if any service has more customers than they can adequately support.

Sure, but are the customers willing to pay for that support? By the way see someone else's idea on how to solve this https://news.ycombinator.com/item?id=34803691

There is more than one sort of support. If the support is of the nature of "I need help using your service", there's nothing wrong with charging for it.

If, however, the support is of the "you've modified or cancelled my account" type, that should just be counted as part of the cost of doing business.

They must not be allowed to monopolize speech and just shut people down at random. If they can't get enough money, then the governments of the impacted people should just press them until they are bankrupt.

It's their problem to solve.

Maybe from the $5-10B they print in pure profit, every single quarter.

That sounds like a "them" problem.

> It's totally unreasonable (understatement) that fb can effectively erase me and my online history and business without recourse because their systems leak and they don't have manpower who can do a human review of the facts in the case.

What prevents you from recreating a new account? When I left facebook I did a backup of it. Why aren't you making regular backups if your business depend on it?

> In the short term I'll be looking for other solutions, in the loger term I'll be supporting calls for making services like fb a public utility, with certain legal obligations (like not erasing online presences).

Public utility? Really?

If anything it is contamination and pollution that prevent decent options of having room to be the public utility of choice.

Read the article. You get banned again if you make a new account. They likely have some complex digital fingerprinting that lets them re-id you. Maybe if you used entirely new hardware etc you might be able to pull it off, but the average user is just hosed if this happens to then.

A fingerprint built by globe spanning spyware.

lol so they can identify/verify that but somehow fail to fingerprint login from Vietnam and account hijacking.

The irony is not lost on me!

I don't think the fingerprinting is that great. Maybe he used the same name, places and so on?

I used a different phone number, a different email address, profile picture where you can't see my face, and used my middle name instead of my first name. It's likely that they use some combination of IP's that I logged in from, common friends, maybe cookies on one of my devices that I didn't think to clear first.

I don't think anyone is suggesting facebook gets government funding.

Just that they're held to certain expectations with regards to service, as critical infrastructure basically.

They shouldn't be able to terminate an actual human's account unless they can provide a damn good reason

this

Facebook, based on various opaque signals that they have, will ask new accounts to verify their identity with ID.

Can we please stop blaming the victim?

Can we call a victim someone who decide to agree to stupid rules (Term of services)? Like we say, play stupid games, win stupid prizes. If my business rely on a service, I need a name for an account manager that can hear my complaints and activate whatever workflow to fix my problems.

When the power dynamic is one where one party is a multibillion corporation with tens of thousands of employees and the other is an individual, I would almost in every case call the individual the victim.

Simply put every business will behave in this manner eventually if not subjugated by monetary penalty of state regulation.

That or you can scurry around every year to a new provider as the company you're doing business with is bought up by monopoly movers in the market leaving an ever decreasing pool of choices.

Reply on news.ycombinator.com