Updated: Reddit is quietly restoring deleted AND overwritten posts and comments
chri5@kbin.social to 
Reddit Migration@kbin.social – 503 points – 
Another update and possibly a solution for some case where posts were not properly deleted. Seems I jumped the gun on this and the restores haven't been intentional - at least not in this particular case.
There is a limitation in the popular Powerdelete that apparently prevents mass editing. Here is a link to a new version with a build-in delay and some other alternatives:
https://www.reddit.com/r/ModCoord/comments/145fico/comment/jnl4xmr/
There are other reported cases where manually deleted post reappeared or other scripts have been used, so this doesn't solve all issues but explains how posts that were both edited and deleted withPowerdelete weren't properly deleted and reappeared after subs went back live.
Update: As some have pointed out: the restores can be rollbacks from the server issues or post haven't been properly deleted due to subs being private during blackouts. Many have experienced the same issue, I can't explain how this happens. I'll just run the script again, try the GDPR request and delete my account.
Also worth noting: according to the ToS Reddit can actually do whatever they want with existing content, apparently we agreed to this when signing up.
Worth noting is that a number of US states also have strong protection laws. So, delete you comments manually and then, if you're really trying to ensure that they delete your data, submit a data removal request that cites your locale's law on data removal.
Theeeeeen in 6 months or so, send a data retrieval request to make sure they followed through... and report them if they did not comply. Might as well make them pay for that data if they can't follow the rules.
Assuming that this is, in fact, not legal and if they have money that can be gone after, I assume that someone may start a class action suit. In theory, they're worth multiple billions, so...
An individual probably doesn't care much about whatever harm is done, as the damage is too small. But this is the kind of thing where a lawyer can walk away with a big payday by aggregating cases of many users and then getting a percentage of any payout.
I am not at all certain that it is not legal, though.
undefined> In theory, they’re worth multiple billions, so…
wen Lambo?
In the US, indicate that you’re in California for the strongest legal option.
This could be worse than anything else they've done. If they claim they own the data, are they then not responsible for it like newspapers? Is it in their terms and conditions they are free to do whatever with posted information, do they have the rights to edit users comments but in doing so become a content provider and therefore responsible. Kicking mods out doesn't land you in court this seems high risk to be manipulating content. Doesn't matter why it was deleted or edited it was deleted or edited who gets to decide what version to restore. Either you are hands off or you own the data and are responsible for it and upheld to media standards.
Edit: found a snippit of the terms and conditions in a German GDPR thread, It appears it is their terms and conditions that after you post it they can do with it what they like, even adapt it. Either way that's not a reason to be gone.
ToS like that does often not mean anything, they can write whatever they like but it doesn't mean they can legally enforce it. So if you are an artist posting a painting you made, reddit can't just say 'oop, it's ours now' same with text
I picked up a permanent ban, after 15 years for saying 'Go outside fatso' to someone who said I couldnt read. Not my proudest moment, but there you go.
The reason I mention it, is that it adds a different dynamic if they are trying retain (and prevent me from editing) data which they hold about me. They might argue that doesn't extend to post where I've written "cats > dogs" - but anything where I've refered to where I live, whether I have kids, what my political views are, are all clearly personal details which they are not allowed to hold without retaining my consent.
Clear contraventions on GDPR in EU.
https://commission.europa.eu/law/law-topic/data-protection/eu-data-protection-rules_en
There was that kerfuffle ages ago about u/spez editing comments in r/thedonald, iirc. It's not like it would be that much of a stretch for him at least.
But it looks like from OP's edits it may be unintentional. I'll withhold my rage for now.
This is shitty of them to do but this is what people have been trying to tell us since the dawn of the internet. Nothing on the internet is EVER truly deleted
I think they may underestimate EU's response here.
DSGVO take the wheel
While this is true, it's sort of like being in a car accident. The other person may be in the wrong, but that doesn't exactly unwreck your car.
Barbara Streisand ♫
That is such a shitty move. Forcing subreddits to go back up is one thing, but as a european this feels very wrong from a data ownership standpoint and I'm not sure it's ok in the GDPR rules?
I think we should actively keep track of Reddit restoring user's content without people's permission. Screenshots, timestamps, everything. Monitor it all.
Maybe if Reddit go ahead with their API change whilst treating their users like such disposable crap, we could reach out to the EU to inform them of Reddit's GDPR breaches. Maybe that'd lead to their new revenue from API charges disappearing into hefty EU fines.
Update: Maybe there's going to be some loophole about actually having to use the data deletion request via Reddit's UI for there to be an actually GDPR breach though thinking about it. Going to ask around some Law friends for advise
That's an excellent idea! EU regulations on the digital rights of users are not to be trifled with, and "the right to be forgotten" is a big one.
Mightily envious of you guys over there.
That would probably be related to "right to erasure".
But even this has limits, since sometimes the data can be necessary for a service (for example, you might be unable to get invoice data erased before X years, as a legal requirement)
Since messages on forums can be considered "needed" to understand a thread, it's usually advised to make all messages anonymous if a user requests complete deletion.
I guess here it's a little different, since the messages were removed by users, so it's not a gdpr request. Not sure how it works in that case.
Other issue is if the messages themselves contain personal information... Someone going through my old reddit profile could probably figure out my identity since I mentioned one of my (very uncommon) previous job a few times.
Best way to figure out how it works here would probably be to contact the gdpr authority for your country... And they might have trouble with it too.
But then it still needs to be marked as a "DO NOT TOUCH". you aren't allowed to use it then for any other purpose.
@Anahkiasen @chri5 almost certainly no bueno under GDPR.
Post content being deemed PII at user digression is already a... questionable stance to take with GDPR but probably grey enough to the point where a DPA won't bother with it while they have bigger fish to fry.
Outright going against user requested data removal tho? Yeah that's a good way to net you GDPR complaints. If the user requests their info removed, you're required to oblige unless you have a reason that amounts to something like "we need this to keep the service operational", which post content almost certainly isn't.
(ie. You're not gonna be able to GDPR your IP address or email off of the banlist.)
Earlier this week I deleted all of my comments except for some in a private sub. I just checked and all the posts I deleted are back 🤬
Same
They really want to fuck around GDPR? Are they really Musk level morons?
There's certainly no chance this will backfire...
That's beyond fucked up.
But also very predictable.
I think it's safe to say this fiasco isn't going anywhere without a class action lawsuit or something.
There is EU and GDRP which reddit have to comply with.
Reddit CEO is a moron thinking they can avoid getting slapped with a fine.
That's awful. I wonder if there's a way to automate deleting all of our posts and replies—and repeatedly run it on a schedule via a cron job or something, maybe once an hour or something. And let it run until their API becomes locked down.
And then replace it with a Selenium script afterwards.
If only I know enough about programming to do it.
Right now, I'm looking at an option that I can run via command line here which I can add to my cron job queue.
@megane_kun I was thinking something very similar. I'm sure there are keywords they're looking for too, like "third party apps" and "fuck /u/spez" which trigger the restore.
Probably, though from what I've seen in the linked thread, there's no such keywords present.
What I suspect is that Reddit admins saw a rise in deletions, and put two and two together and thought it's part of the protest. They're not wrong, but still a dick move.
That's not a bad idea actually. The Powerdelete script I used is based on Javascript and needs to be started manually in the browser window, I'll just run the script once a day. But maybe someone with more knowledge can come up with a more automated solution. They can't restore user accounts forever.
I've been using this for the last few years and letting it run once a month via cronjob:
https://github.com/jdbassa/Shreddit
https://aur.archlinux.org/packages/python-shreddit-git
I'm sure there are other and probably newer scripts out there, though.
I used Redact to schedule a daily deletion of my comments and posts. Hope it works. Also, I will report it.
Wow, out of everything that’s happened involving Reddit over the past few weeks, this to me is the most damning and deserves the most attention.
I’m really curious to see how they try to spin this in the next PR piece and what the reactions will be.
@9Volt @chri5 Reddit at this point doesn't care about PR.
They only care about sweet user data money. Like Google, Facebook, TikTok...
Thats messed up! fuck spez!
Would this actually be a GDPR breach? I was thinking about the right to erasure/to be forgotten earlier in relation to a post I saw about how your posts aren't deleted on other federated instances, if you delete them on your home server. But I figured it wasn't applicable because it's not personal data and I'm thinking the same about this Reddit issue. Can anyone set me straight?
Well, people have reported Twitter for failing to remove their tweets and places like the ICO are now actively investigating Twitter over this failure, see https://www.wired.co.uk/article/delete-twitter-dms-gdpr
Someone posted not too long ago that a person who was part of Twitter’s group over the GDPR - pre Musk - said the lawyers came to the conclusion that tweets were protected under the GDPR.
Thanks, that's a good point and sets a precedent. I had a reply in another thread with the definition of personal data from GDPR and it would seem to include social media posts:
https://kbin.social/m/reddit@lemmy.ml/t/34167/Reddit-is-restoring-deleted-posts#entry-comment-141186
I believe this is illegal for European (under GDPR).
I deleted all my content but I did it over the span of a few days, to let the different caches around reddit to update with the new void, and my content is still deleted (so far).
I said it before and I say it again: if you have the patience to do so then make sure you overwrite your content with chatgpt generated content, as the future AI that will feed on your post HATE feeding on already AI generated stuff. It makes the AI diverge.
edit: Filling your previous content with random generated content also make it harder to restore because it is harder to spot, compared with the comments which are simply "deleted". Also, if all of it is really true, congratulation to reddit for demonstrating to everyone and specially the USA how useful the GDPR is for the citizen.
Motherfucker! I just checked my profile, and they DID restore the posts I edited+deleted with PowerDeleteSuite. Thankfully it's just the posts from the past week or so, I had deleted my entire 8 year history before that, and that stayed deleted. I'm assuming they monitored other API access calls past the days where the blackout started to restore those.
Same here. I’m a 12 year account on Reddit and I had been in the habit of deleting my history regularly due to an ex that likes to stalk my posts. Everything recent that I deleted this week is back but the stuff I deleted prior to that is still gone.
I just went back and edited it all again to state it’s been removed in protest in favor of moving to the fediverse.
wow I just checked and all my deleted comments are restored (used the power delete suite)
jokes on them, I’m petty enough to sit here and manually delete everything
Do you really think there is a difference between deletion through api or manual? In both cases they don't really delete the content.
Quick and dirty Google search says GDPR law is complicated when it comes to backups https://www.itgovernance.eu/blog/en/the-gdpr-how-the-right-to-be-forgotten-affects-backups-2
Even if having backups of the data is legal, it seems highly doubtful that restoring data that a user intentionally deleted would be allowed.
Has anyone tried phoning a GDPR focused lawyer firm? I just did a google and they offer a "free consultation" I would like to get the facts 100% before raising my pitchfork.
Noyb.eu is the nonprofit you are looking for.
I recently made a browser extension that deletes your reddit posts or comments. It's not quite as advanced as PowerDelete yet but it's easier to install and I'm actively developing it: https://chrome.google.com/webstore/detail/bulk-delete-reddit-posts/nbfdoajmaaohkohdnbpjakamhcaaleco?hl=en&authuser=0
Let me know if you try it!
Nice work!
I manually deleted most of my comments but left a few and decided to go and edit them with AI rephrasing as someone suggested. I mostly deleted the older comments and got confused when I saw 2 comments reappear. This makes sense now.
Likely not the popular opinion here; but I’m not going to go through the trouble of re-deleting any posts they might have restored. That’s just additional frustration for me. I’m not going to go over to Reddit and provide them additional traffic to go look at something I did write on their platform at one point. I’m just moving on.
I think they're creating enough trouble for themselves anyway just by constantly shooting themselves in the head. Also moving on is probably the least good thing for them. Losing users gradually will bleed them to death.
Nah I get it. I haven't even deleted my 11 years of contributions yet. I don't mind it existing as it wasn't particularly helpful stuff anyway, but part of me did wanna replace all text with "Redacted due to API" or something but feel that will just flag content restores on their side.
Redacted due to fuck u/spez
This just feels really shitty to me at like a basic level. The rest of the shenanigans were just your typical shitty corporate stuff. This feels a bit more like it could have pretty large ramifications.
I’ve seen comments suggesting it’s something to do with PowerDelete. I used Shreddit to overwrite and delete mine and they’re still gone.
I deleted mine manually using the edit > delete on each comment individually and mine came back.
How do you know they came back? Do you see them agin in your profile? I used Power Delete Suite and except for 2 subreddits I can see no posts I made over the 14 last years in my profile? How do I make sure they have actually been deleted?
stop spamming the same question
Sorry my comment got posted twice, it was not my intention, I think it's due to a bug.
It's pretty easy to double post on kbin.
I used Redacted and posts and comments are reappearing after I confirmed they were gone on the website. I then manually deleted and some have come back.
I used shreddit and mine are all back.
If this is not a bug, it's pretty wild. I don't think this is even compliant to GDPR as for European users unless there is legal obligation or for archiving in public interest, scientific progress etc. I have a hard time seeing protection for Reddit here as it's just a social news site, there's no way around that. It's not a bundle of research papers and the police hasn't come knocking on their door asking them to recover content.
See The right to erasure (Article 17 & 19).
The Lord of Snoo, spez has unleashed a dick move towards the platform.
Gonna love the Snoo Platform, Inc. panic mode in action.
So, so, so glad I deleted my entire account. This is so unethical.
As I understand it (and I may not!) deleting your account leaves all your comments in place, but without your username.
That should be the policy but Reddit states it can take up to 90 days to disconnect content from a user profile and personally - I wouldn't bet on it if it seems they are doing this manually (why else would this take 90 days?).
I'm sorry to say this but, they probably restored all of your posts too. It will just say "deleted" as your username but the posts and comments will be in their old place.
It makes me wonder if they would restore wiped comments from accounts that have been deleted?
Warning, someone on reddit mentioned this is a known bug of the application used
So yeah I removed all my messages and deleted my account at the beginning of the month. I deleted everything and kept the account for a week or and no messages where visible.
Guess what I found? All my messages are back and the account is still deleted.
I found some of my (assumed deleted) messages today that weren't actually listed under my profile any longer. But they were still on the post with my name on it.
"Their" content.
EDIT: I mean, I agree that this is a new low even for social media. I think Stack Overflow made a similar statement when they stopped exporting to the internet archive, "their" content, not the user's content on their site. The users disagreed and I think the export has restarted, but it definitely shows you what the new group of CEOs think of their communities.
I'm definitely sticking to using only federated social media going forward, even for marketing.
Does anyone know if we have similar rights under PIPEDA here in Canada? Can we use that to legally enforce deletion in the same way?
https://blog.rsisecurity.com/canadas-pipeda-vs-eus-gdpr-whats-the-difference/amp/
GDPR laws take the wheel
Just wait a bit then delete your data. They can't keep an eye on it forever.
Holy damn. I deleted all my comments and my account ~a week ago. I don't even know how to check if they restored something. 😠
Check a thread you know you wrote something in?
looks like my comments deleted before blackout started are still deleted, so did they restore only more recent deletions?
Possibly, but several people reported some old post have been restored as well, some deleted a long time ago.
Holy damn. I deleted all my comments and my account ~a week ago. I don't even know how to check if they restored something. 😠
I overwrote and then deleted all of my 14 year comment/post history and it came back complete. I hate to say it, but my guess is that it'll all get restored.
That's ok. I am petty enough to constantly delete my stuff.
You'll have to do it manually for July.
"Manually" just means without the API.
I hope Reddit likes scraper bots consuming full webpages instead; surely that's cheaper for them. /s
They are going full send on pissing everyone off at this point
Perhaps delete and replace the comment with text that explicitly claims copyright on the deleted message and denies Reddit a license to use the deleted content? It would be good to get a legal eagle willing to look at the Reddit user agreement and content licensing and see if there is a legally literate way of denying them use deleted content once it has been submitted.
If you're in the EU, submit a request to have it purged. If they refuse, that's a violation of the GDPR.
Under the law, they also HAVE to respond to all requests within a month, regardless of whether they intend to comply. So it seems like it would be possible to completely overwhelm them with GDPR erasure requests and let them panic.
That link is just too request the bulk of your data. It's not a form to request deletion of all your data. Technically you could request that, but if they deny out ignore that, then there's not a whole lot you can do unless you're ready to take it to court.
If you're in the EU, report it to the Data Protection Authority in your country. They must provide you with a copy of your data and also purge it upon request.
The EU or the UK. The Information Commissioners Office would take an exceptionally dim view of this shit.
I'm not sure whether under GDPR your posts would be classified as Personal Identifiable Information - which is what the GDPR is mainly about
What the actual fuck?
This really is getting worse by the minute..
My money is on this being a big due to the huge influx of comment updates and deletions. I can’t imagine they would do something this blatant on purpose.
We are at the peak of the "AI" hype cycle, where training data is a huge asset. Never underestimate the power of $$$ (or the illusion of it) being waved under somebody's nose.
Been thinking about that. I don't think that overrules laws like the GDPR though - law triumphs over ToS. And under GDPR, consent can be withdrawn, you can't give an irrevokable consent.
IANAL but wouldn't this be on par with creating a contract or NDA with illegal elements? Wherein the contract/NDA are no longer considered valid/become void as a result. Obviously this wouldn't apply to the US and several other countries, and Reddit also has lawyers. Realistically I'm also just some dingus so someone smarter may know
It's probably the case that the rest of the ToS applies except for that one specific element, which is severable. This what I've usually read in contracts (IANAL either but I used to work in a business that required a lot of proofing of contracts).
Totally. When quitting, make sure to file a GDPR takedown request on your account. If reddit doesn't comply, they could be fined quite handsomely.
So they will delete your email address, and still freely use your content for whatever uses. Oh no!
Currently I only have 2 comments still visible which for some reason the Power Delete tool couldn't remove. I will check back in a week though if someone can remind me, and see if any of mine have magically reappeared.
!RemindMe .... oh, no.
I feel ya... Put in a feature request?
wait if the account is deleted can they still restore the comments?
When an account is deleted, all the comments still exist, the author's name just changes to "[deleted]". You'd need to use a third-party tool that deletes all the comments individually, or potentially send them a GDPR or CCPA "right to be forgotten" request (although I'm unsure as to if this actually deletes the comments).
I had done that, but now I'm concerned they'll somehow pull the comments up even though the account is removed
In practice, it's hard to know exactly how Reddit structures the data they have and what exactly a delete actually does and what backups they have.
That being said, it's not out of the question that you could delete your post history, then your account, and reddit only restores your post history and not your account, leaving you unable to delete it again.
Hijacking the top comment to say: PowerDeleteSuite doesn't get everything. It can only see what's in your reddit profile under New, Top, Hot & Controversial - there will be numerous posts that are too old with only 1 or a few karma that aren't displayed in these lists. In particular, if you go through your top posts of all time, you might find some replies to these posts that you made that the script did not see.
The GDPR archive gives a full list of all the comments. What we need is a FOSS script that can use these csv files to get everything. Apparently Shreddit can take the csv files, however you have to pay $15 to use this feature.
I've already given $30 to kbin as a fuck you to Reddit what's $15 more
So... They've basically just admitted that deleting your posts is bad for Reddit.
Keep going, guys.
And spezi (as we lovingly refer to you in our household), expect lawyers.
@chri5 @Rairii jerk move. Can confirm a smattering of my edited and removed comments have been restored as well as removed submissions.
Probably better to replace your comments with some gibberish generated by chatgtp instead of deleting them. It will be much harder to figure out on mass scale if the edit was legit or not compared to them just looking for recently deleted comments or comments that mention something like “comment deleted by x tool”.
Wow, that's really shitty on Reddit's part.
You should bear in mind, PowerDeleteSuite doesn't get everything. It can only see what's in your reddit profile under New, Top, Hot & Controversial - there will be numerous posts that are too old with only 1 or a few karma that aren't displayed in these lists. In particular, if you go through your top posts of all time, you might find some replies to these posts that you made that the script did not see.
The GDPR archive gives a full list of all the comments. What we need is a FOSS script that can use these csv files to get everything. Apparently Shreddit can take the csv files, however you have to pay $15 to use this feature.
While there's some value in old threads, the real value is in new ones. Deleting old comments won't amount to much.
I regularly find old threads when Google searching. There is absolutely value in old comments.
💯
Most people who use reddit or have used reddit tend to Google everything by putting "Reddit" somewhere in their searches now.
I'd be willing to bet a lot of traffic is driven to Reddit via Google queries (Lord knows that Reddit's own search engine can't find shit). Removing data will reduce hits or, if Google doesn't update their cached database, will result in people avoiding reddit because every time they go there it's just deleted comments.