
Ask HN: How to convince Airbnb to delete an account? - SamWhited
Hi all,<p>A friend created an Airbnb account a while back but never used it because Airbnb&#x27;s verification system can&#x27;t send texts to our phone provider apparently so they couldn&#x27;t verify the account.<p>They decided to ask them to delete it and remove all their personal info, and Airbnb refused (even though their website says to contact customer support), so they tried sending a GDPR request because they&#x27;re an EU resident, and got back a big email about how since they signed up with Airbnb US they&#x27;re not a resident and aren&#x27;t eligible for consideration under EU Laws (they did sign up while traveling here, but they&#x27;re still an EU resident).<p>Is there a trick for convincing them to delete (not just deactivate) an account?<p>Email that they forwarded me for reference (I did ask my friend if I could post this):<p>&gt; Data deletion is a right afforded by the General Data Protection Regulation. Only customers of Airbnb Ireland UC, Airbnb Payments UK Ltd. or Airbnb Global Services Limited (‘Airbnb’) are eligible to exercise their data subject rights under the GDPR.
&gt;
&gt; Because your country of residence and activity are related to the United States, you are contracting with Airbnb, Inc.
&gt;
&gt; GDPR generally does not apply to users of Airbnb Inc. Subsequently, we are unable to fulfil your deletion request.
======
SamWhited
I was just told support made them reactivate the account, log in, provide
their actual address and country of residence (even more personal information
that they had declined to provide the first time), and then asked them to get
back to them. Hopefully this results in deletion, I'll follow up in a bit.

~~~
SamWhited
Followup, support told them they'd have to log in from their home IP address
or they wouldn't delete the account. Except, apparently, when logging in
locally it won't let them log in (presumably because they're not using the
separate site for Europe? We're not sure) and just gives a generic error or
doesn't show the login popup at all (but it works fine as soon as they switch
to a VPN in the US, so presumably it's not just an adblock extension or
something).

~~~
SamWhited
Several days later, Airbnb stopped responding to customer support emails but
they can no longer log into their account (no one mentioned that they were
going to delete it though). However, they still got a terms of service update
email, but it came to "deleted-1234-theiremail@example.com", so airbnb
obviously still has their email. I don't even think they realize that they'll
actually get emails to them adding some random numbers before it.

So now airbnb still has their email, refused to delete it, but they don't have
an account they can file a GDPR request against even if they find a way to
make their IP address show up properly in geolocation tables to convince them
that they live where they say they do.

------
dazc
Maybe use another phone number to verify the account and change all the
details to something random. Then, if there was a data breach, the only
information anyone could obtain would be useless anyway?

~~~
SamWhited
That might help, but who knows if they're storing all your old info still
behind the scenes?

 _EDIT:_ I should also have said, as far as I know they don't have another
number to use for verification, but of course I may be wrong. I'll ask.

------
kelsette
Hi, I'm a lawyer (solicitor, England and Wales) and I specialise in privacy
and internet law. I'm obliged to say that I don't have all of the facts about
this matter, and so what I write is general guidance only.

"Only customers of Airbnb Ireland UC / UK Ltd. or Services Limited (‘Airbnb’)
are eligible to exercise their data subject rights under the GDPR. [...] GDPR
generally does not apply to users of Airbnb Inc."

As several other commentators have mentioned, this is wrong. The GDPR has
extra-territorial scope, meaning that it applies to a company in any country -
even those outside of the EU - if it processes personal data belonging to an
EU resident. For reference, see Article 3 GDPR. For further explanation, see
Recital 23 GDPR. The fact that your friend may have contracted with the US
entity of AirBnB does not (to my knowledge) have any bearing.

As an aside, remember that this is for EU _residents_ and not simply
_citizens_ \- so a French citizen who is resident in Washington D.C. would not
be covered, but an American citizen in France would be, if that makes sense.

If your friend was my client, I would suggest that they both 1) push back on
the request, as well as 2) file a complaint with the Information Commissioners
Office here in the UK (or, if Ireland is more relevant to them, the Irish
DPC).

I hope everything gets sorted out! If you or your friend would like to discuss
further, you can find me over on twitter @KelseyFarish

~~~
buboard
> for EU residents and not simply citizen

i think GDPR does not reference residents or citizens, but "data subjects in
the union"

------
who-knows95
with the GDPR, if you are a citizen of the EU then it doesn't matter if the
server is in america.

"Do you process EU residents’ personal data? If you do, then the GDPR probably
applies to you.

It doesn’t matter whether you are based in an EU state or not – if your
company processes, stores or transmits personal data belonging to EU
residents, then you will almost certainly be required to comply with it."

[https://www.itgovernance.eu/blog/en/does-the-gdpr-apply-
to-m...](https://www.itgovernance.eu/blog/en/does-the-gdpr-apply-to-me)

\--------------

this is air's GDPR's page, the fact that your account was able to be made on
the america site is their fault and doesn't invalidate your data protection.

[https://www.airbnb.co.uk/help/article/2273/i-am-an-airbnb-
us...](https://www.airbnb.co.uk/help/article/2273/i-am-an-airbnb-user--how-do-
i-exercise-my-data-subject-rights-under-the-general-data-protection-regulation
--gdpr)

------
jrowley
So is Airbnb misinterpreting GDPR then? I’m pretty sure GDPR rules apply to EU
citizens regardless of where they reside?

~~~
SamWhited
That was my understanding as well, but I'm not a lawyer of course.

They also seem to be misinterpreting their own support pages which say
accounts can be deleted and don't mention anything about GDPR or country of
residence ([https://www.airbnb.com/help/article/240/how-do-i-
deactivate-...](https://www.airbnb.com/help/article/240/how-do-i-deactivate-
or-delete-my-account)).

~~~
who-knows95
you are correct, they seem to misunderstand. GDPR comes into play, any time a
EU citizens data is being processed, for storage or identification.

if the server is in america, or France it doesn't matter. your data is
protected by the GDPR policies.

