I had a strange thing happen where I received emails from an online service saying that I had subscribed to it. I hadn’t. I have no interest or need for their particular service, but it appears someone had supplied my google email address to them. I guess they didn’t check that the email address is valid, and they just created an account for someone using my email address. As far as I can tell, nobody has access to my google email account. I changed the password, and 2-factor authentication has long been enabled on it, so it seems unlikely (but not impossible) that someone is using my google account.
Step 1: “Hi, delete my account please”
I contacted them through their web support form:
Sun, 16 May 2021: Somehow someone appears to have subscribed my email address up to your service. They have used a very strange name ("Froylan"?) and the email address is email@example.com. Please unsubscribe me and delete the account. That account was not created by me.
A week later, they reply:
Mon, 24 May 2021: We received your [deletion] request. Your reference number is . We will process your request within 45 days, subject to verification and any applicable exceptions and extensions permitted by law up to an additional 45 days. If we need to exercise our right to an extension, we will send you an extension notice.
Step 2: Verify my identity?
Literally one minute after that form letter, I received this:
Dear Paco, You have made a request to delete your personal information from (redacted) on May 16th, 2021. In order to process your request, we will need to verify your identity and confirm your request. Please fill out the attached document and send it back to us in a maximum of 14 days from the receipt of this message. We recommend that you print out the document, fill it out by hand, then scan it and send it back to support@(redacted). Once we have verified your identity we will initiate the deletion procedure. Attachments: CCPA Verifying customers (1) (1) (1) (1) (1) (1).pdf
I’m tickled imagining that
(1) appears six times in the name of that PDF file because I’m the 6th person to request an account deletion.
Further, Declarant Sayeth Naught
I open the PDF file, which you can see below in all its redacted glory. This document contains a number of hilarious aspects that boggle the mind.
- It’s 2 pages, double-spaced, like a 1980s term paper. This is 2021, there is literally no reason this needs to be spaced out like that.
- In an effort to fill space with dubious pseudo-legal bullshit, they include this phrase having been duly sworn and cautioned. I doubt that anyone filling out this form has been sworn or cautioned and I wonder at the value of putting that in there. I’m no lawyer. Strikes me as both pointless and factually untrue.
- In order to process your deletion request, the company asks you to enter a bunch of tedious bullshit. The percentage complete of the profile you want them to delete? The date of an email that they sent to you? Why? What purpose does any of this serve?
- Further, Declarant Sayeth Naught Gadzooks! Consider that the CCPA was passed in 2018, not 1818. I can’t imagine why a document to exercise the rights granted by that law would need such an antiquated piece of legal nonsense.
They Have Violated the CCPA Trying to Obey It!
The reason I redacted the PDF above is because it actually contained a person’s name, home address, and phone number. It contained the silly details about their profile. I’m not a lawyer, but my reading of the State of California’s page on CCPA suggests there’s not much that person can do about the fact that the web site sent me their details. That’s a shame.
Step 3: Back to The Point
So remember the point of this whole thing is that I was trying to get them to delete an account that was made by someone who is not me. So they have asked me to verify my identity. They don’t know my identity.
So which details, exactly, would they like me to provide? I can’t guess at what some random internet person sent them.
I emailed them a plenty snarky reply pointing out that I couldn’t possibly verify the details, and also highlighting that they had shared someone else’s details with me.
Step 4: Exeunt
I got a really simple reply: we have deleted your account. :)