What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 127 Stack Exchange communities.

The current process for self-deletion of a user account has several problematic aspects, both in the process itself and in the end result. Some of these issues are:

  • The process requires manual intervention of a mod or SE employee, leading to delays and sometimes mistakes. It is more complicated than it has to be, which can lead to the impression that SE is imposing some rather arbitrary-looking restrictions and steps one has to take. This can give the impression that the user isn't really in control of his private data at SE.
  • It is irreversible once the account is deleted, although an account can be partially reconstructed with a lot of manual effort from an SE developer.
  • There is no real protection against mod/SE employee errors, if an account is deleted in error, there is no easy way to undo the damage.
  • Because it is manual, it consumes the time of SE employees that have to deal with it
  • Votes are deleted along with the account (unless a rather buggy process for high-rep users is used), removing useful voting information and annoying users that lose reputation that way.

I'm proposing an alternative way of handling self-deletion that would be automated, and also reversible to some extent, while still being pretty much a hard-delete (and not a soft-delete that would be problematic with respect to user privacy). The process would work roughly like this:

  1. The user clicks a "delete profile" button in his profile. There should be a way to indicate if you want to delete all profiles on all SE sites, only on this site and a way to select multiple sites from a list where the profile should be deleted.

  2. It is verified that the user has true access to the account in some way (confirmation mail?) and not just someone that found the unlocked computer of the user.

  3. A countdown until deletion is started (I'd go with 48h, but that could be different). The timer shouldn't be too long, but long enough to correct mistakes and leave users a bit of time to reconsider. Alternative options would be to enable users to override the countdown if they really want to nuke their account immediately. Another option would be to soft-delete the account immediately, and make the countdown only for hard-deletion of the user data.

  4. Upon deletion, the posts of the user and his votes are transferred to a newly created blank account, the original account itself is hard-deleted with all the remaining data it contains. The dummy account that holds the user's data should be flagged in some way as deleted, so that the profile links will be disabled, the profile won't be accessible and it won't appear in any user lists.

  5. The user receives a private code that can be used to claim ownership of the account. Other ways are not possible as all private information is removed about the account. This allows for an automatic way of reclaiming most of the important parts of a deleted account. The ability to restore a deleted account might have to be somewhat restricted to avoid misusing it to get rid of the account history. It is more meant as an additional safeguard so that account reconstruction is more easily possible in rare cases. Such additional safeguards might be necessary as the deletion itself would be automatic and without oversight from SE or moderators.

I personally think that the information which posts and votes were connected to a (now anonymized) account is not sensitive enough that it would have to be removed on account deletion. My idea is that this would be close enough to a hard-delete that it satisfies any privacy concerns, but still allow reassociation of posts with a recovered account. The partial reversibility would alleviate concerns about removing the manual oversight by mods and SE employees over the account deletion process.

share|improve this question
recent example of account deleted in error discussed at Skeptics Meta: All of a sudden my account dissapeared?. If I understand correctly, related MSO post is Delay user requests for account deletion by 24 hours –  gnat Nov 23 '12 at 12:00
I would rather worry about how complicated processes like current or proposed one are tested. Wouldn't it make sense ho have a model of some real site, with close enough simulation of votes flow, to just try and see how things work before doing it live –  gnat Nov 23 '12 at 12:38
@gnat The developers have a copy of the site they can try such stuff on, as far as I know. While I think it would be great to have a community-accessible site to test out more destructive stuff, it might be too much overhead for SE to maintain it. –  Mad Scientist Nov 23 '12 at 12:57
that's good to hear. Wonder if change like this has been tested and if yes, how the bug slipped through. BTW totally agree that maintaining a good enough "site simulator" is quite effort consuming, that's the thing to always keep in mind –  gnat Nov 23 '12 at 13:01
I like the idea of improving the process, but giving an option to "recover" one's deleted account isn't a good idea. If you delete your account and want to come back you should have to start over. This isn't like suspending the subscription to an MMO. –  Al E. Nov 23 '12 at 14:29
"The process requires manual intervention of a mod or SE employee" this isn't strictly true - users with no activity can already self-delete already via a link in the profile. Only actions which would impact other people require a third-party. –  Nick Craver Nov 23 '12 at 16:00
@NickCraver That feature helps people trim their proverbial 'tail', the context of this is more 'so long, and thanks for all the fish' –  Tim Post Nov 23 '12 at 16:26
There are so many useful feature requests out there—like mine, to improve "favorites"—I can't possibly see any benefit to the developers streamlining the delete process. This is something that affects a minute portion of (let's be honest, mostly whiny) users. –  Adam Rackis May 1 '13 at 15:40
@AdamRackis I'm not so much concerned about the users, but the time it takes for mods, the community team and SE devs to deal with user deletions. Having a delete profile button would eliminate most of the user deletion requests that SE receives. –  Mad Scientist May 1 '13 at 15:47
add comment

6 Answers

I agree this should be a self service process. Some thoughts below.

If a user wants to delete all network accounts, they should need to do it from stackexchange.com, not an individual site. This adds a deliberate step in that very destructive process, but that step is not at all inconvenient. They can delete per site accounts on the respective site.

I don't think we need a countdown to deletion. Requests to delete user accounts are handled as they come in, there's no delay except how long it takes for someone to respond to a request. There was an occasion where a user was e-mailed asking what SE could have done better, but the person sending that e-mail was certain the accounts had already been removed. It wasn't a barrier, to my knowledge.

If we're going to use a delay, give the user a choice:

  • Delete this account right now

  • Delete this account after (dropdown 24/48) hours.

We don't want to get in the way of it if the user doesn't want us slowing them down. They have a right under the license to be disassociated from their contributions at their discretion.

I agree with confirming the request for the sake of security, though. But still, it seems kind of ... silly ... to offer the two choices. We'd just be giving them another way to vent.

I don't know how I feel about the token to reclaim. I think that might cause people to put less thought into leaving, if they knew the process could be reversed. The prospect of deleting your account should come with a sense of finality.

Regarding votes, if the 'phantom' account that holds the votes is flagged as deleted, those votes are still gone unless someone reclaims their account. At that point they'd come back, which would be even more confusing than what we have if I'm reading it correctly. Still, the net loss / gain for other users as a result of the deletion should be lumped, not individual items.

I also agree that we need more guard rails and automation around the process, and we need to be able to correct a mistake. I don't like de-normalizing user accounts, and I've only had to do it on those that did not have an enormous amount of activity associated with them.

share|improve this answer
As it was explained to me a while ago, we should give users some time to reconsider before acting on the deletion request. This isn't really done anymore I think, but a relatively short delay would be a good way to prevent misclicks or mistakes and deletion requests that are done in the heat of the moment, and that the user regrets a short time afterwards. By "flagged as deleted" I mean a new state for a user profile, not actual deletion. It is essentially a soft-deleted user containing all the non-private data of the hard-deleted account. –  Mad Scientist Nov 23 '12 at 11:57
I wasn't sure if I should include the reclaim token, I have the same concerns. It might make sense to omit that, but still have the easier way to recover an account in those rare cases where it might be useful. –  Mad Scientist Nov 23 '12 at 11:59
@MadScientist As some kind of internal sanity check, yeah - definitely. As long as we make it clear that we're extremely reluctant to use it outside of correcting a mistake. Regarding the delay, I made an edit for a possible compromise. I don't want to get in the way of someone that wants to go away unless they want us in the way. –  Tim Post Nov 23 '12 at 12:07
reclaim token can serve as second chance to reconsider. Mail it a week (maybe month) after deletion, then expire a week (maybe month) after it has been sent. After token expired, dummy account merges into Community and user has to start over if they change their mind –  gnat Nov 23 '12 at 15:07
@gnat I'm having trouble finding a scenario where someone that actually went through with it would not be pissed off upon receiving such an e-mail. That's like a breakup where one calls the other a month later to say "I didn't really burn all your stuff, if you get back together with me you can have it back." ... creepy :) –  Tim Post Nov 23 '12 at 15:28
@TimPost it's a Q&A site, not a personal partnership. "User divorce" process can be structured formally and automatically (and preferably tested before applying live) to ensure there's as less as possible feelings involved. It's hard to get seriously pissed off over Retry/Abort/Cancel dialogs in programs –  gnat Nov 23 '12 at 15:49
@gnat Someone upset enough to delete their account isn't going to be so level headed, at least not the majority of the time. Telling someone "Hey, we can put everything back the way it was" after telling them that you parted ways and did the 'delete' thing is generally not a good idea. –  Tim Post Nov 23 '12 at 16:12
@TimPost well, yeah, if the reclaim token mail pops up unexpectedly for ex-user, that could do more harm than good. I was rather thinking about process where it would be mentioned in account deletion confirmation message. "Month later you will receive second email with reclaim token. Token will expire month after this mail was sent. Ignore this mail if you don't want to reconsider..." stuff like that –  gnat Nov 23 '12 at 16:22
add comment

A few points on why we don't do this, and probably won't:

Upon deletion, the posts of the user and his votes are transferred to a newly created blank account, the original account itself is hard-deleted with all the remaining data it contains. The dummy account that holds the user's data should be flagged in some way as deleted, so that the profile links will be disabled, the profile won't be accessible and it won't appear in any user lists.

That's an extremely large change to code throughout the system for comparably very little benefit. You're talking about every SQL query with a user, all code that loads a user, all APIs that list a user and anything else related to account for a "shouldn't be shown" case. That's a *HUGE* ask, and I'm just not seeing the payoff.

Secondly, we don't want to make undeletion easy. If it's easy to toggle the switch on and off then deletion doesn't mean anything, then what's the point of being "deleted" at all? Either you want to be deleted or not, if you do then okay, we'll delete your users and say good luck.

If we allow undeletion then we have to account for it with everything your user can possibly be tied to. That means additional development time on every new user-related feature for all time. That's a huge waste of development effort compared to the very rare occurrence of someone wanting their account back, effort that could make other things better instead.

There's also the votes, for several reasons we delete votes along with the account (unless it's an extreme case then we take some measures to not impact hundreds of users by the delete). This self-service system would have to imply that votes stay around, otherwise you're giving users the ability to mass-revoke votes with a few clicks. If we didn't do that, then you're opening another sock-puppet avenue for people to re-vote by just deleting the old user, having the votes stay and voting on the same content again. The only way for us to ensure this didn't happen is to continue to store your IP address or other information to ensure against vote fraud...again defeating the point of deletion.

Keep in mind the above applies to not only votes, but any action in the system such as spam, post vandalism, etc. Deletion isn't just about posts and votes, there are many things in play and there's good reason it's a non-reversible destructive action.

share|improve this answer
I'm not so sure about the undeletion process either, but what about the more self-managed deletion process, making it less visible (via votes) to the community? That seems to be the main sticking point with real deletions, I'm not really sure the undeletion issues is a common request, but easier deletions certainly are (directly or indirectly). –  Ben Brocka Nov 23 '12 at 23:48
My main points are stopping the removal of all votes and allowing the user to delete themselves, instead of a mod/SE-initiated process. I shouldn't have brought up the reversibility, as I agree with your concerns about making undeletion too easy. But if deleting the votes is wrong in the case of a prominent high-rep users, it is just as wrong as for a rather unknown 1k-2k user, it is just a matter of scale. I agree that there have to be some limits to prevent abuse, but with some rep and time limits I think it would make sense to stop removing all the votes by default. –  Mad Scientist Nov 24 '12 at 0:20
add comment

I'm not convinced there's a solution to this that'll make everyone happy.

I'm in favor of a short waiting period, but I've no illusions that that won't generate complaints as well, even if it's limited to 24 hours.

The process you're describing, at a high level, amounts to this:

  1. Anonymize content. Technically, you can already do this, any time you want, just by changing your name and clearing out your bio. Most people don't do this - possibly because the system doesn't make it clear that you can, probably because it's just not very interesting by itself. I suppose we could add a button that did this instantly and see if anyone used it.

  2. Disassociate content. From an external perspective, this is really all "soft deletion" accomplishes. Can't click through to figure out what else was posted, so the profile might as well have been deleted. As Nick mentions, this adds a lot of overhead to the system for those rare cases where it's actually needed.

  3. Disassociate other accounts. This was possible at one time, on a self-service basis. It was removed because it was complicated, confusing, didn't work particularly well and wasn't widely used anyway.

#2 and #3 both suffer because they require significant resources to implement and operate and benefit very few people who are actually using the system. If you're leaving, you're leaving - why are we creating a shrine for you?

Which brings me to what I feel is the crux of this issue:

Two types of deletions

I've seen a lot of requests for deletion now, and a lot of weird edge-cases. But by and large, they tend to fall into one of two categories:

Neat freak

SERIOUS about cleanliness

Some folks just don't like loose ends. An account they haven't used in 6 months? Get rid of it! Googling yourself shows clutter? Into the trash! Potential for old email addresses or IP addresses to hang around? Shred them all! Code that reflects a less-experienced programmer? Wipe the slate!

There are myriad reasons such a person asks for deletion, but what they all have in common is: the account isn't useful to them, and something about it strikes them as a potential liability. Occasionally, someone will come out and ask specifically for a laundry-list of specific items to be scrubbed, but usually that's too much work, since keeping the account buys them nothing and just asking for deletion is simple. Making self-service deletion easier helps here - and that's why you can already just delete your account yourself if you've never used it for anything.

Anything that makes it less simple - double-confirmations, waiting periods, bait-and-switch soft-deletions - are gonna change that formula somehow, probably not in a way that makes anyone happy.

Rage quitter

My unhappiness is your unhappiness

This person may not actually be angry, but for whatever reason they want to Send A Message and deletion sounds like the perfect way to do this.

Delays actually seem to be somewhat effective here, since often these folks do want their accounts, and after a good night's rest they retract the request (whereas deleting too quickly gets you into the mess that is trying to recover an account post-deletion).

Everything else is a waste though. Tools to help someone leave quietly aren't interesting when you really want to slam the door loudly.

share|improve this answer
With regards to your two types of deletions, I don't have much sympathy myself for most of the deletions I saw (which is a biased sample, of course). I don't want to make it easier for rage-quitters, but I do agree with the argument that the user should be in control of the personal information he leaves on the site. I hold SE to a higher standard, and I think SE can and should do this better than most of the large websites. Being able to remove all personal information isn't possible for all websites today, making sure SE users have this option is a good idea, I think. –  Mad Scientist Nov 24 '12 at 0:14
Making it easier for the rage quitters to quit would eliminate a lot of drama we don't need. If they don't need to ask for help, then there's less of a need for them to come to MSO, announce their intent to quit, and then shake up the community with declarations of tyranny and corruption. If there's a button for deletion, then anyone posting about wanting to rage quit is just vying for attention. Seems like this could reduce some noise on MSO. –  jmort253 Nov 24 '12 at 5:06
add comment

It shouldn't be easy to delete your account. When you delete your account, you take all your votes with it.

If you do not wish to log in to Stack Overflow for a while, or ever again, then you are certainly not obligated to do so.

If you're worried about "private data" ... well, there isn't any. You agreed to licence it under Creative Commons when you posted it.

share|improve this answer
There is private data associated with an account, it is just not visible to other, regular users. –  Mad Scientist May 1 '13 at 14:06
As far as I know, normal account deletion does not delete all the posts. They are still there just not associated with any account anymore. for example there was account here on Meta named "Mr. Lister" with lots of good posts. The account is deleted but all the posts are still here, e.g. this one –  Shadow Wizard May 1 '13 at 14:07
@ShaWizDowArd Correct; the 'normal' account deletion (the one that would come with a request) does not delete the content, only the account's data. –  Andrew's a Unitato May 1 '13 at 14:58
Okie doke then. Just the votes. Still. –  Lightness Races in Orbit May 1 '13 at 15:30
@MadScientist: For example? –  Lightness Races in Orbit May 1 '13 at 15:30
IP addresses, mail addresses and associated OpenID accounts –  Mad Scientist May 1 '13 at 15:32
@MadScientist: Thanks for the examples. –  Lightness Races in Orbit May 1 '13 at 15:34
add comment

I strongly oppose an option to nuke an account without delay.

If this concept gets implemented at all, then the user should be able to change the countdown value to whatever (within bounds) they want. After setting, one should not be able to significantly lower this value until the countdown has ended - to avoid bypassing the countdown by setting it to zero before requesting a deletion.

share|improve this answer
Feedback please: Why is it a bad idea to counter abuse by allowing the original owner to set a deletion delay? When deletion becomes as easy as proposed, I don't want to have my account deleted when I'm gone for a week. –  Rob W Nov 23 '12 at 16:18
It's not a terrible idea, but... I got a feeling the folks who'd need this would also be the folks who wouldn't set it. Would have to set a default (at which point this is pretty similar to Tim's suggestion), and then have some way to handle folks wanting to change it (which is probably a manual process and solves nothing). –  Shog9 Nov 23 '12 at 22:12
@Shog9 In part of Tims suggestion, the user is allowed to delete an account right away. I strongly oppose this: Sending a confirmation mail does not add a notable security level, because mail & Stack Overflow is often active at the same time. That's why I propose a minimum delay. –  Rob W Nov 23 '12 at 22:22
Sorry, I meant Mad Scientist's suggestion. Read the wrong name off scrolling! –  Shog9 Nov 23 '12 at 22:31
add comment

Another way to do this is have a Deleted flag in the database. If this is set to 1 or True, it would simply hide the user from the site.

This would allow the user to come back at any time, and also not frag the database (thus laving holes) where the account was. This will also prevent any new accounts from being created.

Due to the Deleted flag, Developers could just use it to decide what will remain after the 'Deletion' - such as, they can set weather posts will be hidden, user rep / votes disappear etc.

share|improve this answer
The problem with that is that one major reason to actually delete your account is to remove all private data associated with that account. Only soft-deleting would fail to remove private data, that isn't an option in my opinion. –  Mad Scientist Nov 23 '12 at 12:19
It will be on the database - yes - but no one will be able to see it or access it at all. And when you come back, you can still get everything as it was. –  NewAmbition Nov 23 '12 at 12:23
@NewAmbition That's how Facebook does it, and I think they're evil for doing it that way. –  Tim Post Nov 23 '12 at 12:32
@All... Then Alter the tables to clear all private information, and leave the rest as how i described it? –  NewAmbition Nov 23 '12 at 12:34
This is also extremely non-trivial, you're talking about changing hundreds of queries and lots of code to account for soft-deletion. –  Nick Craver Nov 23 '12 at 15:59
@NickCraver - So maybe this would have been a better suggestion 4 years ago, when you guys were all originally designing the database? Anyway, I won't dispute the technical challenges, and I don't really respect Facebook's practices, but I also think that once you put any data on the Internet, you can never erase it all. –  jmort253 Nov 24 '12 at 5:09
I dont get how people can -1 an answer, especially if its just an idea :/ –  NewAmbition Nov 24 '12 at 9:18
@NewAmbition: On meta, -1 means disagreement, not "bad post". It means, "thanks for your idea; however, I don't share it". –  Lightness Races in Orbit May 1 '13 at 15:31
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .