Your Data is Strewn Across the Internet

This morning I started tackling a todo that I’ve been meaning to handle for a while: going through my LastPass account manager and checking on the ~600 sites and 900ish entries that I have. This is after some regular small cleanups in the past to satisfy their vault password challenge requirements.

I don’t want to just go through and delete old account logins, though I admit that would be much easier than what I got myself into. Instead, I decided that I should go to old accounts that I no longer use and actually delete them and their associated data before removing account information.

I have accounts with highly personal information, beyond my name and even address, up to information for my parents, finances, schooling, and more, all with various levels of account deletion abilities. This isn’t the kind of information that I want to purposefully leave in databases that I don’t have control of after having put the information there myself.

All of that considered, I began the slog of working through that long list, looking for sites that I still use, are for clients, I no longer need, or aren’t even online anymore (more than I’d have suspected at the start).

How Hard is This?

For many websites it’s not terrible. You may have to navigate multiple screens, but the delete feature is available to you. Even Facebook, which I finally got rid of a couple of months ago, has a self-delete tool, though I question how much that actually deletes, and that is still harder than it should be to find.

Several websites require you contact support, which is a pain but not entirely surprising. What is a pain is how hard it is to contact support on these sites. Several sites offer phone support only, or chat support that often won’t load with an ad-blocker on.

The sites that are most infuriating are the sites that don’t allow you to access your account details at all after logging in without extending your subscription. Intuit and AgileCRM are two examples of this type of site, which allow me to login to my account, but won’t allow me to progress beyond a “give us more money because you’re expired” interstitial. This means that even if I’m signing in solely to get rid of the highly personal data that they have stored on me, I can’t. Both have received emails from me, along with the other sites that I can’t delete myself from.

A Barnes and Noble support person directly told me twice that they do not delete accounts, even after I questioned whether that option would become available after 25 May.

What about WordPress?

Funny enough, for as long as I used WordPress on hundreds of accounts, many of them administrators, I didn’t realize that standard users don’t have the ability to delete their own accounts. Thanks to the forthcoming General Data Protection Regulation taking affect in the EU in under two weeks, WordPress core has been considering how to comply and addressing those issues, albeit slower than a project of this size should be taking it up.

While I don’t know how it’ll work, it does look like the idea of being able to delete your own data and anonymize it is being worked on (#43637 (Add filters and ajax support for personal data erasure) โ€“ WordPress Trac). It’s yet to be seen how this will work for an end user, but I hope that it becomes as easy as many other features of WordPress have become.

Who are the Winners?

Some services deserve to get called out, but for being easy to delete as opposed to challenging or impossible. Simplenote and Firefox are two examples that place the delete account button directly on your account page, without the need to hunt around.

Firefox account page with delete account button
It’s not that I don’t like you Firefox, this is just an email that I no longer use!

Why Does this Matter?

Maybe it doesn’t to you. It probably won’t be an issue for me either, but like subscriptions to newsletters that I am unwittingly added to, old accounts quickly pile up.

Some accounts I forget exist because they were created for a one time purpose, like a document signing website that I had to sign up for to sign for a lease on an old apartment. That site does not have a self-delete tool, yet it maintains my previous and current address, contact information, and financial information that was used to verify my lease elligibility.

It should be unacceptable that we cannot control accounts that we create on websites that we supply with our data. If I choose to no longer use that website I should have better recourse than just forgetting that my data is out there in a place that is specifically unwilling to let me manage and remove it.