Hacker News Reader

Comment by jjbinx007 | Hacker News Reader

I can't think of a single rationale for this. A user account isn't much more than a database entry. What possible reason could a company use to justify this?

View on HN

Maybe they updated their TOS to allow them to do something new with the users data (selling it, storing it in another region, etc) and they want to get rid of accounts that haven't accepted the change.

Its just a guess on my side what a possible rationale may be. Its equally likely that someone just put in a feature request for account expiry without really having a good reason and fully understanding the consequences.

> Maybe they updated their TOS to allow them to do something new with the users data (selling it, storing it in another region, etc) and they want to get rid of accounts that haven't accepted the change.

My Yahoo! Mail account is from about 2001 and I still select “I’ll do this later” when I sign in on a new device. I think whatever new owner buys us next has to continue this.

while im 95% sure you know, Yahoo's web client is or at least used to be open to a lot of exploits. Be safe with these dinosaur email providers :)

Yahoo will also clear your entire account if you don't log in for a while.

Happened to me. Lost all my old emails from high school. Sure, that's on me for not having my own local backup, but they still did it with no warning that I ever saw.

I'm so sorry to hear that.

I tried it out on an alternate Yahoo! email address that I don't need and sure enough I got this message

> Setting up your mailbox

> A fresh mailbox is being created, since the old one was inactive for more than 12 months.

https://i.imgur.com/VMHxeyH.png

thank you for the heads up

Remember that EA had EA downloader around the time steam came around. However, their packaged goods division, who made most of the profit, saw it as infringing at their KPIs and someone pushed the inane idea it could make more money if it just allowed you to download the games you bought a fixed number of times to keep the project from getting killed.

The EA Downloader was released 3 years after Steam.

I think that counts as “around”. steam took a while to materialize on everyone’s radar as more than an orange box installer and it took a while to get downloader off the ground

Long term everyone is dead. If these companies continue to exist, how do they handle this? Will Valve maintain your steam login waiting hundreds of years for a user who will never login?

It’s an interesting question and it has never been directly addressed, though Facebook and similar have enabled memorial pages.

I could see a service like steam allowing a death certificate and closure resulting in a $10 refund so they don’t have to maintain the database entry.

Why not? It's not like they'll accumulate many billions of users in that timeframe, so the costs won't skyrocket or anything Facebook is different on that an account can have a lot of data

Data for a million accounts takes up about as much space as maybe a single long YouTube video.

I mean, you can move inactive accounts to a separate table or something if you really want a small performance optimization. Delete them after 20 years. This is a very slow, very long-term problem.

The cost to maintain the database is actually a small part of it; a large question is reducing the "surface area" against attacks as best you can. Perhaps for steam this doesn't matter, but forums, etc have issues with old unused accounts being hacked and used for spam, etc.

You could lock the account and require a higher standard of proof of identity to recover it (e.g. you prove who you are and steam runs a credit report on you and validates your prior phone numbers and addresses against authorization and billing information that they have for the account--that would increase the barrier to require identity theft which is unlikely to be used just to take over steam accounts and spam).

This isn’t really an engineering issue. It’s a legal and financial issue.

If it's about dead people and true long-term, I still don't see the big technical issue, but why not give people 30 years or similar to prevent deletion? People backpacking in the Andes, in jail, in a coma or whatever would be able to respond.

> Long term everyone is dead. If these companies continue to exist, how do they handle this? Will Valve maintain your steam login waiting hundreds of years for a user who will never login?

A typical human lifespan is in the realm of ~80 years.

Maybe they just enable this "feature" only for ~80 year old accounts.

> I can't think of a single rationale for this.

I can: MAU

This. Some middle manager is salivating at the KPI boost they can put in some monthly report as a result of this.

Billing information = PII, so it is subject to privacy regulations. In many jurisdictions the law allows to store and process PII no longer than needed. If an account becomes inactive and all other retention deadlines expire, keeping the data may be a violation.

To be on the safe side and to satisfy users I would allow users in such cases to download the digitally signed account data and offer the possibility to upload it again.

This doesn't make any sense. This makes sense if the account is inactive and has no active licenses to it, but like, if you buy game X with whatever the industry-current licensing is, and the expectation is that you have a license as long as you have an account, termination is silly. You have an active agreement (i.e., the license) to use the product. That's a contractual/business relationship.

You could just as easily delete all of the PII in the account by sending someone an email saying "your licenses are now attached to these codes, please use them to reactivate your licenses with a new account if you want to access them" but they don't. They just delete them. There are many ways to square this circle.

If you can prove that there is a person with the access to the account and it was the intent of the buyer for this person to have access, then fine, account can be kept. The email notification they send is proving exactly that.

You have it backwards.

Only if you can prove that there is not a person with access to the account and intention to access it can the account be deleted.

This proof is technically impossible and thus does not make sense as a solution. We are living in the world where zero trust is default and bad things happen, so the ONLY right way to protect customer data is to verify the identity regularly, rather than declaring it valid once and forever until proven otherwise.

We aren't living in this world, that's your imagination. Rather than making the users suffer by default, identify a more specific "bad thing" and address only that with the min user inconvenience

Dude... come off it.

You're wrong here, both legally and technically (and in my opinion, also ethically).

In the bluntest possible way, even if you were correct (and you're not...): They could have just deleted the billing information and not the account.

Ubisoft designed products that require an online account to use - Ubisoft is on the hook for providing that online access for account holders because they paid for that product. Alternatively - in any region with good consumer protection laws, they're about to issue a lot of full refunds.

A digital purchase is often the purchase of a license to download and execute the product. If that's the contract, then it is necessary to keep some PI on file in order to respect the terms of the contract: offer a download upon request to a particular person. No need to keep PI on file indefinitely: the purchaser is enabled to take their wares and the store to remove accounts if dealing with PI laws is too much hassle.

If this is too much hassle, they could instead sell a license to execute the software, regardless of how it is obtained (but offering a way to download for now, putting the purchaser in charge of backing up those files). Similar to what GOG are doing.

But no, that's not enough control for them either. They want to have their cake and eat it too.

Precisely. Storefronts want their cake and eat it too: they want to take control they have over the license from the user, but without the obligation of actually keeping it accessible forever to the user.

The GDPR has no rules around "activity", and lots of justifications available for "necessary to the business", in this case to continue to allow people to play the games they've paid for.

Only angle I can see that this might work for is reducing the number of people you have to email when you get breached.

Billing information isn't the same as game access, they can always delete the billing information and keep everything else. There's nowhere in the world that a list of owned games is considered as PII.

I'm almost certain this is the reason. A lawyer somewhere in the company has seen "PII retained indefinitely" and lost their shit over it without ever looking at the context around that. No doubt a bunch of people internally have been hammering them with "but this will look terrible when we remove people's access to products they bought".

Any lawyer even vaguely familar with GPDR wouldn't be worried about this. There is a text that states: "processing is necessary for the performance of a contract to which the data subject is party.." and "processing is necessary for compliance with a legal obligation to which the controller is subject".

It could be easily argued that providing an end customer with access to digital products they bought is part of the service that data subjects signed up for, so retaining PII indefintely is 100% allowed (unless the data subject explicitly requets their account to be permanently deleted).

[1] https://gdpr-info.eu/art-6-gdpr/

You are probably right. Most of my experience with corporate lawyers has been all about minimizing risk even if it means losing out on substantial business while there has been zero interest to find a solution. The root cause, as usual, is terrible incentive design where lawyers get punished when a legal problem occurs, but don't get rewarded when they consulted on finding a good solution that allowed the business to thrive.

If that's the case then it would be simpler to just put that as the reason accounts can be closed. It would shift the blame to some government and at least give an air of transparency to the whole thing.

I’m in Europe so I’m more familiar with GDPR than privacy regulations for other jurisdictions but it would be a gross abuse/misinterpretation of GDPR to use it as an excuse for closing down accounts of customers who have already paid for their games. GDPR does require data controllers to remove data subjects from their database but only if there is no legitimate reason to keep their account information.

Active account is a legitimate reason. Inactive account and no explicit consent to keep the data -> no evidence that customer still wants to keep the data -> no legitimate reason -> better be deleted.

As a child you may leave your toy in playground, return back in 1 hour and it may still be there. If you come back in 10 years it would be an unjustified expectation to find it there. As an adult you buy a property, abandon it and in 30-40 years it is no longer yours. Why in the digital world it should not be the same?

The answer is pretty obvious - because the digital world is fundamentally different, and you toy doesn't occupy any playground space, and also it's not publicly accessible, and you haven't paid for your toy to stay they, etc

Except I never abandoned my copy of Far Cry 4. A better analogy would be a book on a shelf. I may not complete a book I bought 10 years ago but I may revisit it anytime.

If you can't hold billing information just delete it.

If you can't keep first/last name, or birthday, just delete it.

However in pretty much every jurisdiction, keeping any kind of information FOR THE BENEFIT OF THE CUSTOMER is 100% allowed, encoded in the law, used as examples and is within the spirit of the law.

Any judge, lawyer or layman would laugh at the idea that GDPR can be used as an excuse to force users to re-buy products.

If you are no longer certain that customer has access to their account, indefinite data storage becomes a liability, not a service.

„For the benefit of the customer“ is too vague justification for it, you need a more specific reason.

Then just delete the offending information. No need to delete the account and the game they contain.

Nope. It's not really vague at all, and is quite clear in the law in several places.

You can keep data in your servers without consent if that data is there to serve the interests of user. In this case, the interest of the user is getting access to the games they purchased and paid for (!!!). This is called "legitimate interest".

A company can keep the address and phone of their customers if they're providing services that require address and phone. Package delivers don't even have to ask for consent to deliver a package to someone, for example. If you need email to guarantee that the user can access the games, it's fine to keep it. The law is not as stupid as Silicon Valley tries to paint it.

I'm pretty certain that Ubisoft is breaking GDPR and other similar laws in several places, but "keeping data to provide a service" is the one place they're not.

Given an inactive account that does not respond to emails and the risk of PII theft, what is the best interest of a customer? Now add the costs of maintaining such accounts, which did not accept the latest ToS, did not migrate to the latest version of software etc, what is the best interest of the business? I do not think that the answer "keep the data" is obvious.

In real world nearly everything has an expiry date, beyond which product is no longer usable if you do not invest in maintenance. Who said that in digital world it should be different?

What is the expiration date of US constitution? Reasonable expectation for personal account of a human being would be maximum life expectancy of a human or notification of death of the user.

US constitution has already expired in my opinion as an external observer. ,) It is not a good example, anyway, because it is not a product and not something in possession.

Reasonable expectation of account life time is the period when the user needs it, no more and no less, and it is not the same period as the life of the user.

Privacy laws are not about the best interest of the business.

As pointed out above, you are allowed to keep all data necessary to provide your customer what they purchased. Losing that data is not the customer's problem, but yours. If you cannot keep your customer data safe indefinitely, then maybe you should've settled on a business model that does not require keeping customer data indefinitely.

What “PII” has risk of theft?

Passwords should be properly hashed. Heck, just delete the password and let the user ask for another if need be.

If there is ANY unnecessary data that was collected but that doesn’t need to be there, or that needs consent to be stored, just delete it. Easy peasy.

List of games owned? Email address? That doesn’t need consent, because it’s legitimate interest. It is 100% in the customer’s interest to have game ownership information long term, and deleting it would cause actual loss to the customer. That’s probably as bad as having PII leak!

And what's that “cost of maintaining accounts”? Less than a kb of data per customer, on average? Probably just a few database tables?

Once again, if there's unnecessary PII, just delete it.

This whole thing is just to force customers to re-purchase games.

> In real world nearly everything has an expiry date, beyond which product is no longer usable

That’s clearly not true. There are several products that don’t have it.

But in the case of games/software it is worse, because the expiration date is 100% artificial: since the games need authorization servers to run, the expiration is under control of the company.

> In many jurisdictions the law allows to store and process PII no longer than needed.

1. I think this is a misunderstanding of the GDPR. You are allowed to keep and process PII, as long as you have a justification. Keeping the user‘s purchases around would be such a justification, as would be consent. 2. Even if you were right, they could still keep your account and games around, and just delete the billing info.

Steam did something similar a while back. You had to log in and choose a new account name when they decided email addresses weren't suited as account names anymore, if you didn't your account got purged.

Didn't that just park your account until you changed it? I don't remember seeing anything about it deleting your account, and I can't find it now.

When did that happen? I still have my OG Steam account with an email address as username which is now 19 years old.

I was never prompted to change that, even though I would definitely like to. I would appreciate any insights you might have.

I can't remember any specifics I'm afraid, it was probably 10+ years ago. I remember being prompted to change it (either by mail or in the client), I never did and I never logged in either. The account is gone. Since it was that long ago I can't rule out simply misremembering.

Steam account names are immutable. I don't recall them ever offering to let you change the login name.

Change the username? Sure. Change the email associated with the account? Yeah.

But if you've got a near 20 year old steam account, you're still logging in with whatever email address you had near 20 years ago.

From their support page[1],

> we may immediately close inactive accounts to comply with local data protection legislation

I'm not sure if that's actually what their lawyers think, or if blaming GDPR is a convenient excuse. The fact that no other company seems to do this makes me think they know its BS.

[1] https://www.ubisoft.com/en-us/help/account/article/closure-o...

Cloud saves maybe? Those can take up a lot of space.

Then expire just those, that would be a lot less controversial.

Reply on news.ycombinator.com