
Google Gmail purchase history can't be deleted - walterbell
https://www.cnbc.com/2019/07/05/google-gmail-purchase-history-cant-be-deleted.html
======
captn3m0
This sounds weird. When CNBC broke the story a month back, I'd :

1\. gone around deleting every invoice from my GMail inbox

2\. Noticed it wasn't getting removed after waiting for 24 hours.

3\. Reached out to the reporter mentioning google might be not deleting it
properly.

4\. Waiting a couple more days and calling off the alarm when google did
finally delete it.

I wrote about it at [https://captnemo.in/blog/2019/06/01/cleaning-google-
purchase...](https://captnemo.in/blog/2019/06/01/cleaning-google-purchases/).
My purchase history still shows 0 results, more than a month after my cleaning
spree.

3 weeks still sounds too long for this information to linger around.

~~~
giancarlostoro
I always assume there's a backup somewhere in Google or Facebook that's old as
hell but has the old emails, I would assume some of these places have cold
storage options for backing up legacy data, but then again, there's the time
myspace wiped a bunch of old data and nobody seemed to have cared.

Surprised to this day that many other sites have shut down, but MySpace keeps
on kicking.

~~~
londons_explore
I can assure you that Google goes to great lengths to ensure ancient backups
of your user data do not still exist.

No backup of user data exists more than 30 days there, typically less.

------
crazygringo
The reporter never says they deleted the e-mails from their trash, and the "3
week" time period is less than the 30 days it takes for the trash to
automatically empty.

I wouldn't be surprised if that's the entire, innocent, explanation here.

(I still think you should be able to turn off purchase history separately...)

~~~
unilynx
If it was in the trash, then the link to the email the system provided should
probably have still worked instead of redirecting him to the inbox

------
C14L
That sounds pretty illegal over here in Europe.

Or did they fix it for European users?

 _Edit: Why am I being downvoted for asking this question?_

~~~
tantalor
Sounds vague... What law are you referring to? Why would it be illegal? Is
that reasonable in this case?

 _Please don 't comment about the voting on comments._
[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

~~~
C14L
> What law are you referring to?

GDPR. It requires that the person whose personal data is processed must give
explicit permission about what data is processed and allow the purpose for
which the data is processed. And it must be possible at any time to withdraw
that permission and to delete the data.

At least as far as I understand those rules, ianal.

~~~
DanBC
> It requires that the person whose personal data is processed must give
> explicit permission about what data is processed

> and allow the purpose for which the data is processed.

> And it must be possible at any time to withdraw that permission

> and to delete the data.

No it doesn't.

There are several lawful bases for storing and processing data. User
permission is only one of those bases. It's usually not the best one to use.
[https://ico.org.uk/for-organisations/gdpr-
resources/lawful-b...](https://ico.org.uk/for-organisations/gdpr-
resources/lawful-basis-resources/)

------
zht
I’ve seen this happen as well.

There’s purchases I’ve deleted emails (and emptied the trash for) only for it
to still be in the purchase list. Clicking on the purchase does not lead to
the email.

Similarly, I believe the gmail search cache also has some lingering cache
issues. There are emails referenced in the drop down in search that I’ve long
deleted.

It is frustrating

------
pfarnsworth
I have worked at well known tech companies and I personally dealt with some
less-valuable-but-still-PII. We didn't store the PII because we cared about
exploiting it or because we wanted to somehow sell this data to outsiders,
that's not how we made our money. We took and continue to take the security
and privacy of our customers very seriously. We made sure we were GDPR
compliant as well.

Instead, the small PII we had was used for fraud signals and for
logging/debugging. Very frequently we would get complaints about things not
working and we would have to go digging through logs to figure out exactly
what happened, and without that data it was hard to figure out exactly what
happened if something went wrong.

Most of the data was TTLed in our logs between 7 to 90 days so that took care
of most of the issues. Other data that got logged into a data warehouse needs
to be deleted via Spark jobs, which takes several days to scour all the data.

Like I said, the companies I've worked at don't need user data for its primary
product and even then it took time to fully delete a user's data upon request,
so I can imagine it taking a lot of time for a company like Google where
extensive use of user's data is widespread throughout the company.

------
dang
Previous thread on the previous article:
[https://news.ycombinator.com/item?id=19942219](https://news.ycombinator.com/item?id=19942219)

------
sys_64738
What does 'deleted' even mean? Deleting an email from all sources is non-
trivial.

------
xfitm3
Is Office 365 any better - or am I stuck running my own mail server if I
really want privacy?

~~~
samat
Fastmail

~~~
therein
I was going to recommend Fastmail as well. I'm a paying customer and very
happy with it.

~~~
hombre_fatal
Just don't miss a payment or your email address will be up for grabs again. :)

------
based2
gmail can also stay open for months without session expiration.

------
sirmike_
Yes but did they go in and perm delete the Trash label/folder? They still are
alive for 30 days. Three weeks is inside that window.

>It also says you can delete this log by deleting the email, but three weeks
after we deleted all email, the list is still there.

~~~
zenexer
Yes, otherwise the links to the emails would’ve worked.

~~~
jvolkman
The links don't work for trashed messages. They lead to a page that says "the
requested conversation has been deleted" and links to the inbox.

------
amelius
Sounds normal to me.

Is there any company that deletes their customers' purchase histories?

And doesn't the IRS prescribe that this kind of information should be in the
books?

~~~
itg
This is not the purchase history of Google product/services, it's anything you
buy and use your gmail address. Example, if you use your gmail account for
Amazon, your entire purchase history will be stored by Google and you can't
delete it.

And yours isn't the first comment in this thread who's question can be
answered if they bothered reading the article. Some are quick to defend the
actions of a corporation.

~~~
techslave
> Example, if you use your gmail account for Amazon, your entire purchase
> history will be stored by Google and you can't delete it.

not anymore. amazon has stopped putting product information in notification
emails for just this reason. Notifications are now generic, “your order
confirmation” etc. you have to login to amazon to discover the order that was
confirmed etc. makes email receipts much less useful but avoids the 3rd party
privacy issue.

and also, TFA is wrong. if you delete the email AND empty the trash, or wait
30 days for auto-empty, the purchase is forgotten by gmail.

even with this in mind, amazon chose to remove specifics from their
notifications.

EDIT: except for the first 1click notification.

~~~
singron
Amazon still lists the first item of a purchase for me (e.g. an order of X and
Y shows up as "X and 1 other item"). Google then lists that on my purchases
page.

------
lern_too_spel
This is silly. Of course Google still has your purchase information if you
haven't deleted the email. It's like complaining your email search index can't
be deleted without deleting the indexed emails.

~~~
C14L
They already deleted the emails. From the article

> _When I click on an individual purchase and try to remove it — it says I can
> do this by deleting the email, after all — it just redirects to my inbox and
> not to the original email message for me to delete, since that email no
> longer exists._

~~~
lern_too_spel
As the top comment already noted, the email still exists in Trash, where
messages get removed 30 days after they are deleted unless the user manually
empties their trash. Emails in trash are obviously still indexed. (They show
up when I search for "in:trash".) There are multiple other people who have
said that deleting emails removes them from their purchase history.

~~~
zenexer
In the test, the trash was certainly emptied; otherwise, the links to the
emails would’ve worked.

