Twitter has had a number of privacy issues recently, from failing to protect private tweets to surfacing deleted location information. Now, it appears Twitter may be holding on to data it claims it deletes.
TechCrunch reported Friday that it was able to dig up direct messages dating back years that were associated with deactivated or suspended accounts. The revelation, flagged by security researcher Karan Saini, indicates that attempting to scrub yourself from its servers may be futile, even if the site’s Privacy Policy claims that user-deactivated accounts will be “deleted.”
When asked by Gizmodo to clarify the insinuation that user data will be, in fact, be scrubbed if users deactivate their accounts, a spokesperson declined to comment.
As TechCrunch noted, Twitter states on its law enforcement guidelines page that after it or a user deactivates an account, “there is a very brief period in which we may be able to access account information, including Tweets.” But that TechCrunch was able to fetch messages from long-since deactivated or suspended accounts indicates that at least where direct messages are concerned, that data may be retained.
A spokesperson for the social media site told TechCrunch that it was looking into the matter.
It’s not a great look for a company that just last month said it “recognise[s] and appreciate[s] the trust you place in us, and are committed to earning that trust every day.” That was Twitter’s official response after it revealed that the tweets of some of its Android users who had the “Protect your Tweets” setting enabled may have in fact been public, thanks to a bug that disabled the privacy feature if some account changes were made.
Twitter also states in its Privacy Policy that it “believe[s] you should always know what data we collect from you and how we use it, and that you should have meaningful control over both.” But failing to delete data that it leads users to believe is wiped is, well, not that.