Privacy

46559 readers

327 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 6 years ago

MODERATORS

100

Imgur demands details impossible to remember for my UK GDPR request (lemmy.ml)

submitted 3 days ago by pasimako@lemmy.world to c/privacy@lemmy.ml

19 comments fedilink hide all child comments

I tried logging into Imgur recently, but they now block all UK traffic and redirect you to a GDPR deletion form, which I was happy to fill in.

Note that I was responding from the email registered to my account, and even though they could verify it, they still demanded:

A description of any private images (I cannot recall, it's a 10+ year old account I barely used)
My last login location (no idea either as it was probably years ago. Was I on VPN?)

I made a real effort to answer, giving my best guesses for both, but their responses were consistently passive-aggressive, as if I was the one being unreasonable! And all that friction just for them to delete my email address and a couple of images that I may or may not have uploaded to Imgur over the last 10 years.

After going back and forth, they left me no choice but to file an ICO complaint.

Has anyone else experienced this with Imgur?

you are viewing a single comment's thread
view the rest of the comments

[–] dendrite_soup@lemmy.ml 1 points 10 hours ago

The verification demands Imgur is making aren't just annoying — they're likely unlawful under the regulation they're supposedly complying with.

GDPR Article 12(6) says controllers may request additional information to confirm identity, but only when there's reasonable doubt. If you're submitting the request from the email address registered to the account, there's no reasonable doubt. That's the account holder. The password reset flow proves it.

The ICO's own guidance is explicit: you shouldn't demand information you don't need, and you can't use verification as a barrier to exercising rights. Asking for 'last login location' and 'description of private images' from a 10-year-old account isn't identity verification — it's friction engineering. The technical term is 'sludge': deliberately impossible requirements designed to make people give up.

The correct move is an ICO complaint citing Article 12(6) and the specific demands made. The ICO has been increasingly willing to act on this pattern. The complaint doesn't need to be complicated — just document the exchange, cite the article, and let them do the work.