Hacker News new | past | comments | ask | show | jobs | submit login
How to Set Your Google Data to Self-Destruct (nytimes.com)
137 points by feelthepress on Nov 5, 2019 | hide | past | favorite | 74 comments



> For those who don’t want Google to create a record of their location history at all, there’s a switch for that. On the My Activity page, click Activity controls and scroll to Location history and turn the switch to the off position.

Yes, that's what I do. But then Google Maps on the phone nags you constantly that it should be on.

Removing the nagging would be an immense improvement and proof of commitment to privacy on Google's part.


Be very careful about combining Inactive Account Manager with telling Google not to store activity data. I started getting countdown to deletion warnings telling me I needed to log in to show I wasn't inactive, but no matter how often I did it was ignored completely until I turned on activity tracking. I'm not sure if this is a rare bug or working as intended, but it could go badly. In the end I turned off Inactive account management and activity tracking, but it was a bit disturbing.


This sounds like The Monkey's Paw. They granted you your wish of tracking no personal data, now they can't even verify your account's identity, and their inactive account cleanup job has scheduled you for deletion. Very interesting! The line between necessary data and personal data is a finer one than I thought.


What counts as logging in? Do you check Gmail or drive weekly? Backup and Sync?

Can you set up an API key app that pings an API weekly?


If I recall correctly their documentation suggests that a single login to the Gmail web app or several other properties should count as well as the official Gmail apps, but no web logins I tested had any effect for me. Sadly I can't retest this without setting a new timer on an account.

If you end up in a position to tet this you'll want to keep an eye on multiple account logins as well since the link they send you in the warning doesn't go to a specific account. If you're logged in to more than one account and the first one isn't the one you got the warning about you'll end up looking at the manager for the wrong one and need to either log out entirely or find it manually. A minor design issue, but it can be confusing for a few minutes.


Sounds like a gdpr violation


Or an edge case they didn't consider, and will likely fix.


My bet was on a mix of just a predictable edge case and Google not prioritizing testing when users have stopped activity. I don't think they sat down and decided the kind of people who care about the inactive account manager were especially good targets for manipulation. I'm sort of surprised that they didn't use the info that they have on last logins instead of the web activity tracking, but there's probably some architectural reason it was easier.


Logins can occur without user interaction by a logged-in device, so it's not as meaningful as user activity.


That's true for apps & devices, but generally I think they can assume that a human is doing the logging in for one of their websites. If they can't assure themselves that it's mostly true they have a serious issue.


There are plenty of passwords managers that will do an auto-login. Anyway, the last time I've logged into my Google account is months ago - I only access it on trusted devices with long-lived sessions, and I suspect this is the case for most users.


Lucky! I get some kind of fleeting toast message (sub-quarter of a second) about some kind of permission missing, before the app closes itself entirely.


I have almost all my tracking options turned off (as of 2 years ago) and I still regularly get recommended YouTube videos based on my wife’s google searches


What is "constantly"?

Some amount of advertising is expected in a free app.


If they can't keep a cache of your recent locations, it would be difficult for them to apply optimization of your location, prediction of your car's path, etc. and Google Maps would be a much more jarring experience, akin to a GPS device. I think they do need the client to send recent locations per request if they want to deliver an optimal experience.

For example, what if I wanted to implement loading automatic nearby locations? Naively, I could fetch the results within a radius R of the current received location. However, that's not good if I'm on the highway. The smarter algorithm would take into account the car's position, velocity, and angular velocity to calculate a better spot to query around, or perhaps a different shape to query in other than a circle with radius R.


> if they want to deliver an optimal experience

I should be able to decide what "experience" I want. I don't want "more", I'm happy with "good enough".

Anyway, I'm very fine with how it works now, except for the nagging. I allow the app to know my location, of course, just not to store any history.


Nobody wants to use a maps app that feel like it's from 2004. There's a reason people put up with giving their data away -- because data drives machine intelligence, which makes your maps app smoother, more responsive, more useful, and overall a much better experience.

I, too, don't want to give my data away. But when I'm in my car, the most important thing is that I get to my destination safely and on time. That acute need vastly outweighs my own philosophy on who I think should have my data.

I'm just being honest with myself. I can't deny that I make heavy use of products that make heavy use of my personal data. People in this community seem to think of personal data collection as a form of parasitism, but in reality, it is far closer to mutualism.


>I should be able to decide what "experience" I want.

You can. You can use their 'free' app that you pay for with your location data or you can pay a one time fee for a road atlas with no updates.


Or you can use the Navigator app by someone else, that has a free option, nothing feeds to the Google monster, and behaves pretty much exactly like an old style GPS device with some modern additions.

Good enough indeed.


My concern about these deletion request is that you are totally at the will of the platforms, that they actually will delete your data. This already imply trust towards them. And if you have trust they handling data with responsibility, why would you need to ask for delete?


This is how I feel about it.

I don’t have any faith that I’m going to be protected from current / future persecution because I ticked / didn’t tick some box on some control panel on some service provided by Morally Bankrupt MegaCorp.


That's a bit pessimistic/paranoid and off the bat doesn't make a whole lot of sense.

If your data is supposed to have been deleted but they ignored it, they have it illegally.

If someone from the state wants to prosecute you and requests the data, the company wouldn't own up to having it, because they're not allowed have it.

Why would they lie to you, and then sell themselves out to the state?

Fine, they might keep it, but not in order to assist in prosecutions lol


The way Google acts with regard to privacy law is similar to how they act with regard to tax law.

That is they look for loopholes and places they can use dark patterns to nudge users into giving up more data. They stay within the rules but push the envelope of what’s acceptable to the legal limit.

It’s not that they are holding onto data specifically to support prosecutions it’s that they hold onto data because that’s what Google do.

They’d hand that over because they have it and to not cooperate would unnecessarily cause them business friction they could easily avoid.


So the conspiracy is rather that the delete button simply doesn't do anything?

I don't think that would go down well for the prosecution if you ever ended up in court.

The reality is that 99.99% of users never even open their account settings, let alone micromanage their identity's state across dozens of platforms. Google wouldn't even notice if all hn readers deleted all of their data and deactivated their accounts tomorrow.

The most reasonable thing for them to do is to actually delete the data, and avoid all headaches. It's the more profitable move. You look like good guys and avoid legal problems.


Nope that’s not the conspiracy. The conspiracy is that you’ve pressed the wrong button because the UI is deliberately confusing.

If you could find the right button I’m sure it would delete the data...

except that it’s down the UI equivalent three flights of stairs to the basement, behind a filing cabinet in front of a locked door with a sign on saying “Beware of the leopard”.

Oh and every tracking feature is on by default even if you’re not logged in.


Well, maybe for you. I'm in the EU. I don't have to navigate a UI. I can go the UI route, or I can email them instead for a surefire approach.

Even then, the UI's for these things usually aren't actually that darkpatterned. Once you get down the first dark tunnel, it tends to open up quite well.


Parallel construction. Advanced Persistent Threat. State Level Actor.

I think we ought to assume Big Corp doesn't delete anything and shares that not-deleted data with, at least, the Five Eyes.


I feel the same way brother.


I feel I can trust Google today. What if Larry and Sergey sell the company tomorrow? What if I decide to go into politics and a written record of me saying the sky is blue and 2+2=4 becomes a problem?

As someone who supported a major database in Google some five years ago: the amount of development effort that went into the GDPR compliance (we haven't even heard that name then, only that the EU is brewing a law that requires us to be able to delete data) was very surprising. So at least one corp does actually delete the data correctly.


Yandex' open source ClickHouse analytics database also had significant engineering effort applied to enable selective and permanent deletion of data in what used to be an append-only database that could only drop whole partitions. Regulation works, and the large tech companies are the most likely to be compliant, since they have the most to lose and have mature compliance and legal processes. Google is particularly good about this - consumer trust is their #1 asset.


if you feel you can trust Google today, you'll probably feel the same way in the future, regardless of what happens


This just ... isn't true. People can and do evolve their opinions, feelings and levels of trust over time. I.e. people change. Particularly in response to external changes as you imply ("regardless of what happens").


people are like slowly boiling frogs, google stopped not being evil a long time ago


Not arguing on the point of whether google is evil or not, or when that happened.

But the boiling frog analogy is something that just isn't true:

> "According to Dr. George R. Zug, curator of reptiles and amphibians, the National Museum of Natural History, 'Well that's, may I say, bullshit. If a frog had a means of getting out, it certainly would get out. And I cannot imagine that anything dropped in boiling water would not be scalded and die from the injuries.'"

> "Professor Doug Melton, Harvard University Biology Department, says, 'If you put a frog in boiling water, it won't jump out. It will die. If you put it in cold water, it will jump before it gets hot -- they don't sit still for you.'"

> "Vic's (Dr. Victor Hutchison of the University of Oklahoma) answer was as follows: 'The legend is entirely incorrect! The 'critical thermal maxima' of many species of frogs have been determined by several investigators. In this procedure, the water in which a frog is submerged is heated gradually at about 2 degrees Fahrenheit per minute. As the temperature of the water is gradually increased, the frog will eventually become more and more active in attempts to escape the heated water. If the container size and opening allow the frog to jump out, it will do so. Naturally, if the frog were not allowed to escape it would eventually begin to show signs of heat stress, muscular spasms, heat rigor, and death.'"

Quotes from: http://answers.google.com/answers/threadview?id=758865

Additional info: https://www.theatlantic.com/technology/archive/2006/09/the-b...


factual frog behavior is irrelevant to that analogy, but I appreciate new frog facts nonetheless


I re-evaluate my stances rather regularly. I've switched on brands, politics, climate change approach, even countries to live. I don't think Google has some kind of magic stranglehold, it's just a company I like right now.


Well users imply trust towards a platform when they hand them their location data in the first place, right?

I imagine that even if you trust the platform holder to handle the data responsibly, you might still worry what someone could do to you if it fell into the wrong hands due to a hack, or some future government that might abuse it.


"How to auto-delete your search history Most of Google’s new privacy controls are in a web tool called My Activity. (Here’s the URL: https://myactivity.google.com.)

Once you get into the tool and click on Activity Controls, you will see an option called Web & App Activity. Click Manage Activity and then the button under the calendar icon. Here, you can set your activity history on several Google products to automatically erase itself after three months or after 18 months. This data includes searches made on Google.com, voice requests made with Google Assistant, destinations that you looked up on Maps and searches in Google’s Play app store."


Weren't a lot of people on Twitter complaining that this is basically insufficient? Most of the information about you that can be profitably mined to create "insights" about you expire in less than a month, these people claim. By having Google auto-delete them in three months, it could provide some peace of mind to you, but it doesn't really affect Google's ability to target you in ads.


I don't think that's what Google is trying to advertise with this, the threat model is "I don't want google having 10+ years of my browsing history in case they are compromised or some G employee goes looking through my history". My point is that it isn't misleading, of course they're not going to intentionally harm their Ad business unless you really go though the trouble: https://youtu.be/NQ6-DP6DIiU


Link is a little buried in the article: https://myactivity.google.com/



Only flaw I see with this and stuff like FB saying they "deleted" your account is:

"It's deleted" is (or could be) another term for "You can't see it anymore, but it's there somewhere"

Haven't gone into ToS, but regardless, there's no way we can determine if it's really gone.


that's exactly what happened to the people who requested (and PAID mind you) to have their Ashley Madison accounts deleted. All they did was mark a deleted bit in the database and from what I remember these PAID $70 USD to have their account deleted.


I think I had read that Amazon TOS said employees wouldn't have access to your data if you closed your account. I'm sure they have some right to make temporary (we hope) backups but I thought it was a fair clause.


Regardless of company, I don't want them to keep any "backups" of what I delete.

In my view, if I say I want to "delete" my account, I don't want a single trace of my existence on that platform from then on. No emails, no backups, nothing.


By definition, any really effective backup (off site, offline) can't simply be modified instantly when you click a button in a web UI. The reason it takes months for backups to clear out your deleted data is that's how long it takes for the entire backup to be discarded and replaced by a new backup that reflects your deletions.

While the data is likely inaccessible forever in this case, the reason the company can't just say it's been deleted is if they actually do need to restore one of these backups, the data you deleted will come back.


You can delete user data from backups much more quickly than that:

* Encrypt each user's data to a user-specific key

* Keep the key in hot replicated storage

* When you get a deletion request, delete the key


You still need to back up the keys? How does this solve anything?

Backups aren't just about replication/redundancy, they also protect you from bugs and other sources of corrupted data.


You can back up the keys in ways where it's very easy to purge them: no tapes, easy to recall and edit.


The fact that backups can't be accessed and modified easily for a long period of time is a feature, not a bug, regardless of the actual mechanism of implementation (like tapes). That's what stops e.g. ransomware from affecting backups in addition to the primary storage.

A backup that can be edited to delete data like an encryption key instantly when the user tells it do is also a backup that can be easily lost or corrupted.


That's a reasonable reason for my data to be on their servers. However, what validates that they actually do it?


The only way in my mind to grant your wish would be if you owned the storage of your credentials. Otherwise you're just moving trust to another entity. I'm not an expert.

Either way that clause showed a hint accountability from Amazon that I haven't seen too often. Not that I've spent much time comparing ToS either.



Thank you for this.


Usually, as with turning off location history, I feel this only hurts the user, as I don't believe any relevant parties won't have access to the deleted entries if the need arises.

The only person who doesn't have access to that data will be the subject the data originated from.


This is what it boils down to for me.

Plausible deniability.

“We don’t have your data because you told us to delete it. Chortled chortle.”


Does anyone have any insight on what actually happens to this data? Is it really deleted or just stored in a warehouse somewhere inaccessible to me but accessible to some snooping government or hacker?


Many time discussed before on HN with some input by Google SREs. It is totally deleted (with some delay because of backups)

https://policies.google.com/technologies/retention?hl=en


If Google didn't want to delete your data, they wouldn't lie about it, they just wouldn't give you the option.


I set this, even though I've blacklisted Google on Firefox. (I just use Chromium if I need to use Gmail). But, how can I stop Google collecting data on my phone? I was initially blocking Google because of censorship, but I can't find any way to control my phone, and it's feeling really personal now.


Three months is a hilarious joke. The value of analytics data decays steeply; they let you delete the stuff that's not particularly valuable to them.

If Google actually cared about your privacy you'd be able to delete the info for shorter intervals, or even have it not stored at all.


They do. You can turn it off entirely in most (all?) cases.


This does not change Googles behavioral profile on you. In fact, it just adds another data point on your profile that implies that you don't trust Google to protect you data.


A few months ago someone posted a tool that cleared this and old tweets as well, but I can’t remember the name.

I wish there was a tool that regularly nuked my Facebook history as well, from comments in random groups to likes across the site. I have no use for things I commented 10 years ago.


> I have no use for things I commented 10 years ago.

This attitude confuses me. Looking back at things I wrote ten years ago makes me think "huh, I used to believe X and now I don't, why did I change my mind?" and "X used to be really important to me and now it's not, what happened?". If I'm writing something today I'll often look back at what I've said about it previously (and I like having most of what I've written as blog posts so that's easy).

Then there's the benefit to others: being able to look back at what people were thinking in the past is super useful for understanding how the world has changed, and textual comments are great for that.


I’ll be honest. I used to preserve everything and I also was surprised at a friend who’d reset his Twitter profile every so often.

But it feels like everything can cause outrage these days and I don’t want to know what will look bad in 10 more years, out of context.

I’ll take out the archive and keep the memory on my computer, not online, for everyone to see.


"Twitter Archive Deleter" is a Glitch app that walks you through deleting your whole Twitter archive without having to give access to a 3rd party service. I haven't used it myself.

https://twitter-archive-deleter.glitch.me/


Perfect. Twitter have been ignoring my request to delete my data.


> ...it will begin rolling out a new private mode for when you’re navigating to a destination with its Google Maps app, which could come in handy if you’re going somewhere you want to keep secret, like a therapist’s office.

There we go again, shaming mental health :(


Is there an automated way to get it to self-destruct sooner? Like every 12 or 24 hours?


You're right Odysseus that would be awesome


the data will be deleted from the front end but it'll still stay at google servers for like 2 to 3 years. So basically a useless thing to do.


any source for that claim ?




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: