• Announcements

  • Forum account anonymization and data export is now available

We've added the new official Flarum GDPR extension providing support for account anonymization and data export. These are available in your user account's settings at the bottom as Erase Account and Export Data.

Erase Account takes 30 days to happen automatically but a subset of the mods can manually approve the requests earlier. We'll wait a few days to give people time to cancel. This will delete all the account data and reassign the public data including posts to an automatically created deleted user account to replace your account. We can choose to trigger full erasure for an account where all posts are deleted but will not do that in practice. Posts are public and crawled/archived elsewhere so it wouldn't accomplish much and would ruin a bunch of discussions, so we're using the anonymization method as the default.

    admin stickied the discussion .
    5 days later

    I had another account ("User910824"), I have lost the password and i can't use it again. I am wondering if it possible to delete it?

      DeletedUser32 I had another account ("User910824"), I have lost the password and i can't use it again. I am wondering if it possible to delete it?

      Since we have no way of verifying you're the owner of the account, we cannot delete it.

          a month later

          is it still possible to delete an account with the old method where they just get grouped in with the (deleted) shadow user? if this cant be done, its a huge downgrade because a specific user's posts can be grouped together by the generated deleted account.

          What happens to all the posts that account has made ?

            Alexmore
            It was already answered in the pinned post:

            We can choose to trigger full erasure for an account where all posts are deleted but will not do that in practice. Posts are public and crawled/archived elsewhere so it wouldn't accomplish much and would ruin a bunch of discussions, so we're using the anonymization method as the default.

              admin I requested exporting my data and shortly received a forum notification with the link. However, it leads to a page with the following message:

              The page you requested could not be found.

              Return to GrapheneOS Discussion Forum

                2 months later

                Just want to say, Flarum might be the best forum software out there. Really well designed.

                I'm interested to know what anonymisation means. A username isn't an identity unless it can be regarded as an alias. Changing a username has no effect on anonymity that I can deduce. GDPR personal information might be held by a forum or website as a legally recognized name or a traceable alias, or a phone number, or an address, or an ID code (NHS, NI, Passport etc). In that sense one could have a right to erasure, but surely not based on just a username. If anyone can cite an authority I'd be interested.
                It's a different matter if a user posts content clearly identifying themself or a third party, either of whom might well have a subsequent right of erasure.

                  spot Changing a username has no effect on anonymity

                  If I recall correctly, the extension creates a new user with a generic name, moves posts to that user, then deletes the old account. All data except the public posts ends up getting removed.

                    spot It doesn't keep the account but rather it deletes it completely. The public posts have already been repeatedly indexed by search engines and archived elsewhere regardless.

                    It's a different matter if a user posts content clearly identifying themself or a third party, either of whom might well have a subsequent right of erasure.

                    If someone wants content deleted, they'll have to ask and it can't simply be trivial posts not tied to them. It would waste far too much of our time. No one should post personal information but if someone does by mistake we can remove. Users also get 10 minutes to remove it themselves. Unfortunately, due to people abusing the deletion feature to go back and delete a whole bunch of their posts after they got an answer to a question or out of spite, we had to limit that to 10 minutes like edits.

                      Thank you both for clearing the terms of reference, that was helpful. I agree there's an edit window for second thoughts and it might be ten minutes, I've been known to set it as a day. You're left with a thread that can't change at the whim of a user, which is necessary if the author decides to want to look good a week later with an update.

                      Dealing months after the event with an irate threat of litigation is something any forum might be faced with, and doing the least amount of harm is balanced against the legislative framework. In practice the requirement is uncontentious.

                      The far side is when someone demands the removal of all their posts, at which I draw the line and there's no legal necessity. Twice I've been faced with an irate demand from a moderator with sufficient access rights to do it themself, and that's down to bad admin in my opinion when they go ahead before slamming the door. There is, as best I can see, no legal right to be forgotten any longer in a European/UK setting - the right of erasure extends to personal information and no further. And in the States, presumably, it's still the Wild West and a bonanza for lawyers.