What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 128 Stack Exchange communities.

With the exception of spammers, who either just get their posts spam-flagged to death or are destroyed by a moderator, the by far most common reason for deleting a user is that the user requests himself that his account be deleted.

The guidelines from SE used to be that we moderators should wait for 24 hours and not immediately delete the account. This is supposed to give the users some time to reconsider, as the request for deletion is often made during some heated dispute. And deletion is not reversible, SE developers can piece together most parts of a deleted account, but that is a manual and incomplete process.

I propose to hardcode this delay into the user deletion mechanism. When a moderator hits the delete user button, a countdown is started until the deletion. This countdown is visible to the user (at least on his profile, also elsewhere if it would be easy to implement), and contains a link to contact the moderators and abort the deletion.

This would not only make sure that users have a chance to reconsider the deletion, but it would also help against mistakes by moderators when deleting accounts. As the recovery of a deleted account is a rather involved procedure, I think it would be worth it to try to minimize the chance of this being necessary.

Doing the whole delay manually has two problems: Moderators actually have to know about this, which is not the case for a large number of moderators, I think. And we have to remember to delete the account later, which can easily be forgotten, especially if one mod thinks another one will handle it.

Deletion of spammers would not be affected, as moderators use the "destroy" feature for them, which not only deletes the account, but also all associated posts.

share|improve this question
14  
As a moderator, I don't usually delete user accounts by their request; I point them to the official process, which requires them to edit the "About Me" section of their profile to say "please delete me", and to fill out an online form. That form has ample warning that the action is permanent. –  Robert Harvey Oct 18 '12 at 20:22
2  
Also, I don't always use the "destroy" option for troublemakers, as that deletes everything they've posted. There are cases when I want to remove a troublesome account, but they've posted one or two answers worth saving. This most often comes into play with sock puppets that I don't want to risk merging. –  Brad Larson Oct 18 '12 at 20:26
1  
Would it be possible to ban the user and start the deletion process for troublesome users? That would prevent them from causing trouble in the 24 hour delay, but still leave time for them to appeal, revert mistakes, or possibly review content that should be deleted vs. kept. –  Servy Oct 18 '12 at 20:33
1  
@BradLarson It might make sense to add a checkbox to the delete option that allows a mod to immediately delete. But I think that the whole sock-puppet thing would deserve some dedicated tools anyway, merging users is just too damn dangerous. –  Mad Scientist Oct 18 '12 at 20:48
    
Maybe we could do it like Facebook does... 2 week delay with daily emails saying "<Insert Friend Name> and <Insert Friend Name> will miss you. Click here to cancel...". (Of course, rather than friends, we could use the OP from questions where the user-to-be-deleted has answered a question.) –  JDB Dec 9 '13 at 16:28
1  
This idea leaves open the possibility for a big red spaceballs-esque "abort self destruct" button. –  Jamiec Dec 9 '13 at 16:37

3 Answers 3

up vote 30 down vote accepted

I like this idea. The current process works pretty well most of the time, but let's face it: it's error-prone, and pretty difficult review even when deletions are appropriate.

We now have selectable reasons for user deletion, which makes this even easier. If "User requested deletion" is selected...

User requested deletion

...then set a flag on the profile. A scheduled task can check for this flag and delete any accounts where it has been active for more than 24 hours.

Implementing this for only one deletion reason simplifies the cancellation process as well: the countdown could allow the user themselves to cancel deletion, rather than requiring them to contact a moderator:

deletion pending banner

Such a banner, visible on the user's profile page to only moderators and the user themselves, would provide a quick and easy way to undo mistakes and provide a frictionless way for users with second thoughts to cancel the deletion without having to contact a moderator or the team.

scary confirmation dialog for no good reason

Finally, both the deletion scheduling and cancellation should be logged, so as to avoid confusion over what happened and who was responsible.

share|improve this answer
11  
If we were to do the list of pending deletions, it might be nice to be able to enter a description to appear on that list: "User requested deletion", "Suspected sock puppet", etc. That would help with review of pending deletions by other moderators. –  Brad Larson Oct 18 '12 at 20:39
4  
Just a thought, in addition to the "your account will be permanently removed in 24 hours" countdown, why not add a button to "cancel" the process? Suppose in the last hour the user changes his or her mind and it just happens to be during a time when no mods are around? For spam deletions and deletions where the user didn't request it, don't make the cancel button available, of course. –  jmort253 Oct 19 '12 at 1:39
    
Um, I hope the actual dialogue has a YES/NO choice. –  badp Jan 30 at 9:47

Is this really necessary? It feels awfully patronizing. Couldn't we just hold users to the expectation that they act like professional adults?

Users have to make this request to another person, so that affords some protection already. It's not as if someone can accidentally click the "delete account" button. A moderator can always ask them why they want their account deleted and suggest that they sleep on it if it seems like they'll regret the decision later.

Similarly, the easiest way to avoid the difficulty of reconstructing an account that a user requested deleted is to say, "Sorry, deletion is permanent." I'm somewhat aghast at the idea that developers are spending time reconstructing accounts that people requested be deleted. Spending more development cycles to better support protecting users from themselves isn't tempting.

At the very least, this must be a rare enough occurrence that it shouldn't be high priority. I assume that users aren't frequently requesting deletions, aren't there more important things to do?

share|improve this answer
1  
Even though we're dealing with professional adults, some people are still learning to be good professional adults. Even those in their 20's and 30's are sometimes a bit impulsive. Then again, sometimes those in their 50's act like children too, so there is that. But while I see your point and agree this is a bit patronizing, it's not harmful to make sure that there are tools to make this process go smoother and help avoid mistakes or lose good users who were just having a bad day. –  jmort253 Oct 19 '12 at 1:41
1  
@jmort253 This is harmful. Developer time is limited; adding this feature means not adding some other feature. I'm not even convinced that we're doing these users a big favor. I'd rather they learn that actions have consequences by saying "To hell with this, I quit!" on SO than saying it at work. –  blahdiblah Oct 19 '12 at 1:52
    
Well, if I were SE, I'd definitely weight the cost of doing this against the benefit. If it's going to take a lot of work to do this, then it might not be worth doing. But if it's easy to do, when why not. –  jmort253 Oct 19 '12 at 1:54
5  
Well, moderators can accidentally click that button. Not that this happens... often... But it is possible. And it's one of a handful of moderator actions that are currently rather hard to reverse. But yes, account reconstruction is (thankfully) very rare, and I wouldn't consider this a worthwhile feature if that were the only benefit. Honestly, the biggest advantage I can think of is simply philosophical: destructive actions should be either easy to reverse, or reviewed by multiple people before taking effect - currently, this is neither. –  Shog9 Oct 19 '12 at 3:16
1  
@Shog9 That sounds like a good philosophy, but wouldn't the better change be to just explicitly require two (or more) mods to delete an account? –  blahdiblah Oct 19 '12 at 3:23
    
That's certainly another option. There are advantages to each. –  Shog9 Oct 19 '12 at 3:24

What about making deletion undoable, or "soft deletes"? Surely an easy way to correct mistakes beats simply making it unlikely (but difficult to undo).

If there is a concern regarding PII*, the following simple workflow would maintain privacy:

  1. the user requests undeletion (e.g. on meta) and provides an account name.
  2. a moderator locates the deleted user page by account name.
  3. them moderator presses the "undelete" button on the deleted account page, without being able to access PII. The page does not show any PII and is conveniently anonymised.
  4. the user receives an automatic confirmation email with a link from SEI.
  5. the user clicks on the link thus approving the undeletion explicitly

Alternatively, all PII could be purged (name, surname, profile).

* PII is Personally Identifiable Information

share|improve this answer
4  
Deleting an account is, among other things, a privacy issue: it should not be easily (if at all) undone, much less "soft deleted". Facebook gets a lot of deserved flak for how resilient accounts are in the face of requested account deletions: it would be disconcerting to see SE go that that road as well. –  user149432 Oct 18 '12 at 21:58
    
From that point of view, it wouldn't be different from now, Mark. Accounts can already be undeleted by a dev, so clearly the data is there. –  Sklivvz Oct 18 '12 at 22:01
1  
Devs are employees of SE: users, by agreeing to the privacy policy, know and accept that SE retains records for the specific purpose of complying with safe harbor provisions. Moderators are not, and they should have no access to deleted personally-identifiable information without the consent of the user. I trust SE a lot more than I do 200+ volunteer moderators, many of whom aren't even within the US jurisdiction. –  user149432 Oct 18 '12 at 22:04
    
But they already do (e.g. in their browser cache) –  Sklivvz Oct 18 '12 at 22:07
    
If your argument is that, because browser caches exist, you should be able to see and undelete deleted user accounts, I'm not really sure what I can say to that. Why have privacy measures at all in that case, or for that matter, allow people to delete their accounts? Someone's browser cache could already have it. –  user149432 Oct 18 '12 at 22:09
    
My argument is: I can already see PII and delete users as a mod. Preventing me to undelete does not give me any extra information. And if the concern is that it does, simply mail a link to click to the user before any deleted data is restored. –  Sklivvz Oct 18 '12 at 22:12
    
Privacy is a contract: when a user requests deletion, they do so under the agreement from SE that the only people who would have access to that information is SE and they will only use it for the purposes of complying with safe harbor provisions. SE, by giving that information to moderators to make fixing accidental deletions slightly more convenient, would be breaking that contract. There's no reason for this: users are warned that deletion is permanent. SE likely couldn't even amend their privacy policy to allow for it, as all past deleted users couldn't agree to the change. –  user149432 Oct 18 '12 at 22:23
    
"they do so under the agreement from SE that the only people who would have access to that information is SE". This is not correct, they do so under the agreement from SE that the only new people who would have access to that information is SE. SE can't undo the past or control where the info went before the deletion. As a mod I can keep a copy of all PII of my site if I so choose (not that it would be legal, but SE is not preventing me from doing so). Also, according to EU privacy law, PII has to be hard deleted entirely from SE DBs, FWIW. –  Sklivvz Oct 18 '12 at 22:27
1  
No, you can't. You agreed to a moderator agreement that prevents you from copying that PII. But the fact that you think you're entitled to keep a copy of all the PII you see is perhaps the strongest and most compelling argument as to why giving moderators more access to PII is a very, very bad idea: you don't need this to do your duty, and it shouldn't be added precisely to help mitigate abuses of PII. –  user149432 Oct 18 '12 at 22:29
    
@MarkTrapp re-read my comment. I can do it if I choose. I would be in breach of my moderator agreement but there is no programmatic barrier preventing me from doing so. I never said that I am entitled! –  Sklivvz Oct 18 '12 at 22:31
    
@Sklivvz, I'm not sure your argument supports the idea of doing soft-deletions. The fact is that as moderators, we're supposed to follow the rules outlined in the moderator agreement. It doesn't really matter if we can siphon off data to a third party or our browser cache or not, we still must operate within the guidelines/rules. If we're not doing that, then that's a completely different issue altogether. Also, I'm not 100% sure, but I suspect that when devs undelete data, they're not just hitting a button, they're probably piecing it together from offline backups... –  jmort253 Oct 19 '12 at 1:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .