Improve the user self-deletion process

Question

The current process for self-deletion of a user account has several problematic aspects, both in the process itself and in the end result. Some of these issues are:

• The process requires manual intervention of a mod or SE employee, leading to delays and sometimes mistakes. It is more complicated than it has to be, which can lead to the impression that SE is imposing some rather arbitrary-looking restrictions and steps one has to take. This can give the impression that the user isn't really in control of his private data at SE.
• It is irreversible once the account is deleted, although an account can be partially reconstructed with a lot of manual effort from an SE developer.
• There is no real protection against mod/SE employee errors, if an account is deleted in error, there is no easy way to undo the damage.
• Because it is manual, it consumes the time of SE employees that have to deal with it
• Votes are deleted along with the account (unless a rather buggy process for high-rep users is used), removing useful voting information and annoying users that lose reputation that way.

I'm proposing an alternative way of handling self-deletion that would be automated, and also reversible to some extent, while still being pretty much a hard-delete (and not a soft-delete that would be problematic with respect to user privacy). The process would work roughly like this:

1. The user clicks a "delete profile" button in his profile. There should be a way to indicate if you want to delete all profiles on all SE sites, only on this site and a way to select multiple sites from a list where the profile should be deleted.

2. It is verified that the user has true access to the account in some way (confirmation mail?) and not just someone that found the unlocked computer of the user.

3. A countdown until deletion is started (I'd go with 48h, but that could be different). The timer shouldn't be too long, but long enough to correct mistakes and leave users a bit of time to reconsider. Alternative options would be to enable users to override the countdown if they really want to nuke their account immediately. Another option would be to soft-delete the account immediately, and make the countdown only for hard-deletion of the user data.

4. Upon deletion, the posts of the user and his votes are transferred to a newly created blank account, the original account itself is hard-deleted with all the remaining data it contains. The dummy account that holds the user's data should be flagged in some way as deleted, so that the profile links will be disabled, the profile won't be accessible and it won't appear in any user lists.

5. The user receives a private code that can be used to claim ownership of the account. Other ways are not possible as all private information is removed about the account. This allows for an automatic way of reclaiming most of the important parts of a deleted account. The ability to restore a deleted account might have to be somewhat restricted to avoid misusing it to get rid of the account history. It is more meant as an additional safeguard so that account reconstruction is more easily possible in rare cases. Such additional safeguards might be necessary as the deletion itself would be automatic and without oversight from SE or moderators.

I personally think that the information which posts and votes were connected to a (now anonymized) account is not sensitive enough that it would have to be removed on account deletion. My idea is that this would be close enough to a hard-delete that it satisfies any privacy concerns, but still allow reassociation of posts with a recovered account. The partial reversibility would alleviate concerns about removing the manual oversight by mods and SE employees over the account deletion process.

Answer 1

I agree this should be a self service process. Some thoughts below.

If a user wants to delete all network accounts, they should need to do it from stackexchange.com, not an individual site. This adds a deliberate step in that very destructive process, but that step is not at all inconvenient. They can delete per site accounts on the respective site.

I don't think we need a countdown to deletion. Requests to delete user accounts are handled as they come in, there's no delay except how long it takes for someone to respond to a request. There was an occasion where a user was e-mailed asking what SE could have done better, but the person sending that e-mail was certain the accounts had already been removed. It wasn't a barrier, to my knowledge.

If we're going to use a delay, give the user a choice:

• Delete this account right now

• Delete this account after (dropdown 24/48) hours.

We don't want to get in the way of it if the user doesn't want us slowing them down. They have a right under the license to be disassociated from their contributions at their discretion.

I agree with confirming the request for the sake of security, though. But still, it seems kind of ... silly ... to offer the two choices. We'd just be giving them another way to vent.

I don't know how I feel about the token to reclaim. I think that might cause people to put less thought into leaving, if they knew the process could be reversed. The prospect of deleting your account should come with a sense of finality.

Regarding votes, if the 'phantom' account that holds the votes is flagged as deleted, those votes are still gone unless someone reclaims their account. At that point they'd come back, which would be even more confusing than what we have if I'm reading it correctly. Still, the net loss / gain for other users as a result of the deletion should be lumped, not individual items.

I also agree that we need more guard rails and automation around the process, and we need to be able to correct a mistake. I don't like de-normalizing user accounts, and I've only had to do it on those that did not have an enormous amount of activity associated with them.

Answer 2

A few points on why we don't do this, and probably won't:

Upon deletion, the posts of the user and his votes are transferred to a newly created blank account, the original account itself is hard-deleted with all the remaining data it contains. The dummy account that holds the user's data should be flagged in some way as deleted, so that the profile links will be disabled, the profile won't be accessible and it won't appear in any user lists.

That's an extremely large change to code throughout the system for comparably very little benefit. You're talking about every SQL query with a user, all code that loads a user, all APIs that list a user and anything else related to account for a "shouldn't be shown" case. That's a ****HUGE**** ask, and I'm just not seeing the payoff.

Secondly, we don't want to make undeletion easy. If it's easy to toggle the switch on and off then deletion doesn't mean anything, then what's the point of being "deleted" at all? Either you want to be deleted or not, if you do then okay, we'll delete your users and say good luck.

If we allow undeletion then we have to account for it with everything your user can possibly be tied to. That means additional development time on every new user-related feature for all time. That's a huge waste of development effort compared to the very rare occurrence of someone wanting their account back, effort that could make other things better instead.

There's also the votes, for several reasons we delete votes along with the account (unless it's an extreme case then we take some measures to not impact hundreds of users by the delete). This self-service system would have to imply that votes stay around, otherwise you're giving users the ability to mass-revoke votes with a few clicks. If we didn't do that, then you're opening another sock-puppet avenue for people to re-vote by just deleting the old user, having the votes stay and voting on the same content again. The only way for us to ensure this didn't happen is to continue to store your IP address or other information to ensure against vote fraud...again defeating the point of deletion.

Keep in mind the above applies to not only votes, but any action in the system such as spam, post vandalism, etc. Deletion isn't just about posts and votes, there are many things in play and there's good reason it's a non-reversible destructive action.

Answer 3

I'm not convinced there's a solution to this that'll make everyone happy.

I'm in favor of a short waiting period, but I've no illusions that that won't generate complaints as well, even if it's limited to 24 hours.

The process you're describing, at a high level, amounts to this:

1. Anonymize content. Technically, you can already do this, any time you want, just by changing your name and clearing out your bio. Most people don't do this - possibly because the system doesn't make it clear that you can, probably because it's just not very interesting by itself. I suppose we could add a button that did this instantly and see if anyone used it.

2. Disassociate content. From an external perspective, this is really all "soft deletion" accomplishes. Can't click through to figure out what else was posted, so the profile might as well have been deleted. As Nick mentions, this adds a lot of overhead to the system for those rare cases where it's actually needed.

3. Disassociate other accounts. This was possible at one time, on a self-service basis. It was removed because it was complicated, confusing, didn't work particularly well and wasn't widely used anyway.

#2 and #3 both suffer because they require significant resources to implement and operate and benefit very few people who are actually using the system. If you're leaving, you're leaving - why are we creating a shrine for you?

Which brings me to what I feel is the crux of this issue:

Two types of deletions

I've seen a lot of requests for deletion now, and a lot of weird edge-cases. But by and large, they tend to fall into one of two categories:

Neat freak

Some folks just don't like loose ends. An account they haven't used in 6 months? Get rid of it! Googling yourself shows clutter? Into the trash! Potential for old email addresses or IP addresses to hang around? Shred them all! Code that reflects a less-experienced programmer? Wipe the slate!

There are myriad reasons such a person asks for deletion, but what they all have in common is: the account isn't useful to them, and something about it strikes them as a potential liability. Occasionally, someone will come out and ask specifically for a laundry-list of specific items to be scrubbed, but usually that's too much work, since keeping the account buys them nothing and just asking for deletion is simple. Making self-service deletion easier helps here - and that's why you can already just delete your account yourself if you've never used it for anything.

Anything that makes it less simple - double-confirmations, waiting periods, bait-and-switch soft-deletions - are gonna change that formula somehow, probably not in a way that makes anyone happy.

Rage quitter

This person may not actually be angry, but for whatever reason they want to Send A Message and deletion sounds like the perfect way to do this.

Delays actually seem to be somewhat effective here, since often these folks do want their accounts, and after a good night's rest they retract the request (whereas deleting too quickly gets you into the mess that is trying to recover an account post-deletion).

Everything else is a waste though. Tools to help someone leave quietly aren't interesting when you really want to slam the door loudly.

Answer 4

It shouldn't be easy to delete your account. When you delete your account, you take all your votes with it.

If you do not wish to log in to Stack Overflow for a while, or ever again, then you are certainly not obligated to do so.

If you're worried about "private data" ... well, there isn't any. You agreed to licence it under Creative Commons when you posted it.

Answer 5

I strongly oppose an option to nuke an account without delay.

If this concept gets implemented at all, then the user should be able to change the countdown value to whatever (within bounds) they want. After setting, one should not be able to significantly lower this value until the countdown has ended - to avoid bypassing the countdown by setting it to zero before requesting a deletion.

Answer 6

Another way to do this is have a Deleted flag in the database. If this is set to 1 or True, it would simply hide the user from the site.

This would allow the user to come back at any time, and also not frag the database (thus laving holes) where the account was. This will also prevent any new accounts from being created.

Due to the Deleted flag, Developers could just use it to decide what will remain after the 'Deletion' - such as, they can set weather posts will be hidden, user rep / votes disappear etc.