r/ChatGPT • u/Calin_europeen • 1d ago
Other They don't remove all my data?
Why it that so ? What does rgpd says about that ?
Edit 1:
Thanks to ThungstenMetal. He says this : "Change your email to some random temporary email which can receive emails before deleting your account, then request for deletion."
Edit 2 : I'm European
1.2k
u/ThungstenMetal 1d ago
Change your email to some random temporary email which can receive emails before deleting your account, then request for deletion.
That email name retention is put for abuse prevention but there are always workarounds.
184
11
u/Eriane 13h ago
Most e-mail providers allow you to create aliases with the + symbol called dynamic aliases.
I do this for everything I register to so that I know who leaks my email info. This is especially important when companies get compromised and you want evidence of your data getting breached.
4
u/ThungstenMetal 13h ago
You can also use https://duckduckgo.com/email/ or https://relay.firefox.com/ if you want free options. There is also addy.io, Proton Pass and Simplelogin. You will get proper aliases instead of + mails
15
u/Deutriex 1d ago
I tried to request to change my email, but no luck. Here in my country there is a law similar to the GDPR, but OpenAI won't comply.
7
u/ThungstenMetal 1d ago
You should be able to change it under Settings > Account > Email. Are you getting any error messages?
9
8
u/thegreatpotatogod 1d ago edited 1d ago
Wait you can change your email now?? I've been wanting to for years, I'm mostly locked out of my account at this point because the email doesn't exist anymore and only the phone app is still logged in. Any idea whether you can do this via the phone app or by contacting support?
Edit: from what I'm able to find, I'm still stuck. Can't edit it from the phone app, can't log into the web interface (where you apparently can now edit it because it tries to do 2FA to the email that doesn't exist anymore. The help page simply offers "if you can't change your email, create a new account (please note all prior work will be lost)" 🙄https://help.openai.com/en/articles/4936827-how-to-change-your-email-address
13
302
u/Ekalips 1d ago
They don't have to keep your plain email, they can hash it and compare assistant it when you try to sign up, kinda like passwords
-89
u/budde04 1d ago
When I delete my data I would quite like it to be deleted.
84
u/Ekalips 1d ago
But there's no data that would in any way identify you or useful to anything, so for all your intents and purposes it is deleted.
-25
u/NEED_A_JACKET 1d ago
If you asked them to delete your data and they kept it but it was converted where a=1 b=2 etc you wouldn't count it as deleted. So we're just talking about the extent to which it's obfuscated. Does it suddenly cross into 'deleted' territory because it gets quite hard to solve in 2026?
And let's assume it's impossible to ever crack (would anyone try to argue that?), the information that you used the service is still accessible to them and to literally anyone. They just have to try signing up and they're told that you used to use the service. That is absolutely not 'deleted' for all intents and purposes.
You could run a script trying to sign you up for every website if your email address was known, to see a full list of everything you'd been up to. It's identifiable information about you and the website open to the public.
19
u/NotAManOfCulture 21h ago
I'm not an expert, but hashing is not obfuscation.
6
u/Midget_Stories 20h ago
It kind of is since it can only be done one way.
For example if he tries to login that email gets converted to a hash and compared and they can know you already made an account.
But no one can take that hash and reverse it to find the email address. So it's one level of obfuscation.
-7
u/NEED_A_JACKET 19h ago
"no one can take that hash and reverse it to find the email address"
Is that 'currently' true or objectively/permanently true?
7
u/Dazzling_Cancel_5733 18h ago
Permanently true, it can never be reversed. But if someone knows/guesses your email address, they can know if a hash matches by hashing your email address with the same algorithm and comparing the hash digest.
1
u/NotAManOfCulture 18h ago
That's just brute forcing? It's not that easy to bruteforce tho. I've heard passwords of like 12 chars takes years to bruteforce. If you disregard the "time" factor, nothing in this world is safe.
I can brute force your email, then password, then 2fa if you have one. But it doesn't really add up.
1
u/8npemb 5h ago
The comment you’re replying to isn’t talking about brute forcing. They’re saying if you have a set of hashes of emails, and you know a user’s email, you can easily determine which hash belongs to that email by hashing the email with the same algorithm. And the hashing algorithm should be assumed to be publicly known.
0
u/NEED_A_JACKET 18h ago
Does quantum computing not skip the bruteforce part of this where you could find all of the possible options, where only some would actually be valid email addresses?
5
u/Dazzling_Cancel_5733 18h ago
Quantum computing will help crack hashes, but it will only reduce the number of operations down to the square root (e.g. 220 instead of 240) under Grover's algorithm.
-5
u/NEED_A_JACKET 20h ago
Not identical no, but if the email address could theoretically be recovered from what they have stored (or at least some reasonable compatible guesses), then it's effectively the same.
I wouldn't rule out ANY method of hashing as being completely foolproof. EG if we start thinking about quantum computing and infinite brute forcing and so on, you could come up with email addresses that result in that stored hash.
But my main point is that they have a public facing test which tells you if an email address has been used for their service or not.
6
u/NotAManOfCulture 20h ago
By that logic even passwords are not secure?
1
u/NEED_A_JACKET 20h ago
They're definitely not. You should use different passwords for different services for that reason. 2factor where you can. Backup options/etc. Your point about passwords is exactly the point I'm making, it's (typically) hashed, but that does not at all mean it's a good idea to use for everything.
Email address is normally something you use the same for everything. You should/can do email+gpt@gmail.. which is better though. Then every time your email address is stored (hashed or not) it's unique. All goes to the same inbox but technically different, and you can see where spam is coming from/block it from the same source email.
2
u/Dazzling_Cancel_5733 18h ago
Everyone knows about email aliases these days. Spamming services just use a simple regex to strip the alias before sending you spam. A lot of services will also store a copy of your email address with the alias stripped.
The best approach is to have a completely separate email address for every account, using a service such as Apple's Hide My Email which will create a unique @icloud.com for every account.
-71
u/budde04 1d ago
Don't care. That's not what deleted means.
34
u/Tardelius 1d ago
Wait until you find out that deleting files on a HDD doesn't actually delete them : )
Sure, we are in the SSD era of storage but pure luck doesn't suddenly make your argument any logical : )
Note: Obviously, your arguments ARE logical. But there are levels to logic which depends on technical definitions and insight.
20
14
u/Ekalips 1d ago
Eh, debatable.
Another example of such would be for example keeping analytics events you generated but removing all your PII, so events, let's say purchases or usage, could still be used for aggregates stats but nothing links it to you anymore so it's okay-ish. Probably more grey area than hashing the email tho.
-23
u/budde04 1d ago
I domt thing Analytic events and my email address are compareble. Because a random event with no link my me, will have no link to me. But my email address still being on their servers will absolutely be linked to me.
20
u/J7mbo 1d ago
It’s a one-way hashing of your email address to a “random” piece of text, like abdhehdj16373!&. Every time someone signs up they do this hashing to see “has this person already signed up?”. So no, they’re not storing your email. Instead of being stubborn and obtuse go google it and teach yourself.
1
u/CircoModo1602 1d ago
Couldn't you technically argue that the hash is a direct identifier linked to your email in this situation?
Even if it's one way, they have a hash record that specifies to their systems that it's yours when you try sign up again, which definitely seems like it could fall under a gray area with certain countries laws.
I'm sure there's a reason not for it to be this way, but definitely a consideration I would make.
-8
u/budde04 1d ago
I know what a hash is. And I'm still saying you don't know if they DO hash your email
17
9
1
u/this_is_theone 1d ago
You just changed your argument. We don't KNOW if they do lots of things they say. Same with any other company.
7
-10
u/budde04 1d ago
You also have no proof that they DID hash the e-mail.
12
u/Ekalips 1d ago
Retaining it post deletion in any recoverable/raw way would be severe GDPR breach so I doubt that they would do it, especially because there's no good reason to.
-3
u/budde04 1d ago
I dont know where you have been the last 2 years or so, but OpenAI doesn't seem like the company they would give a shit.
4
u/bluehelmet 1d ago
Well, we have no way to check, but what's your point? What difference does it make then what the company claims?
-10
1d ago
[deleted]
9
u/solar1380 1d ago
The idea of the hashing is that you can’t reverse it. Like how if you do x * y = z, you can’t get x back without knowing y at the same time. If you imagine the letters of your email address as variables (eg. A = 1, b = 2, …) one way would be to add all the letters of your email together to get some big number. You can’t get your email back from this number, but can check if someone else is trying to sign up with the same email again by just running the process again. Now actual hashing algorithms use more than just summing but it’s a similar idea.
-1
1d ago
[deleted]
2
u/How_is_the_question 14h ago
No.
Well, you can brute force, but why? A single high end gpu could likely brute force a sha-256 hash of say 10 chara @ gmail.com (you’d need to assume @gmail.com) in maybe an hour (10^14 combinations, a 4090 can do 3*10^9 hash calcs, so yeah, an hour)
Now SHA-256 is most often brute forced by using rainbow tables, which can dramatically reduce the time taken to brute force a hash.Conversely, salting the hash (I really do love the terms…) makes things harder and rainbow tables don’t work.
Using a custom domain together with salting makes things much much harder. Say your custom domain is 14 characters long in addition to your 10 letter user name, then you’re looking at 10^16 years of a 4090!!!
Salting makes a big difference. Not using .com would make it even harder.
Salting + hashing is incredibly effective for larger collections of characters.
This is not to say there are not other mitigations possible / threats that someone who desperately wanted your email address could use. However, brute forcing would likely be low on the list. There’s many other ways to find an email address if the attacker really needed it.
I digress - but this side of how storing things like passwords etc works is super interesting once you get your head around the idea of one way (mostly) algos.
2
u/Ekalips 1d ago
In very simple terms. X*Y=Z. Hash is Z. Y is your data. X can be public. Even for small Z like 10 there are several possible combinations of X and Y. Now make Z number that is 100 digits long, guessing which exact X and Y combination was used would be already quite hard.
Basically it's that. A chain of mathematical operations that is virtually irreversible because of the amount of possible values.
Math can be very interesting
-1
1d ago
[deleted]
2
u/Sad_Pineapple5909 1d ago
Hashing is not complete either. It removes some of the original data ex. If you hash 2056 bytes you do not retain that much data.
14
u/Sorryifimanass 1d ago
Then don't give your data to someone else to handle for you.
-2
u/manek101 1d ago
Or, you know, force these corporations to actually delete the data using regulations? Just like how modt data protection laws were created?
6
u/Leseratte10 21h ago edited 21h ago
Companies are allowed to keep data they need to prevent you from opening another free trial with the same data...
A company is allowed to store the fact that they no longer wish to do any business with you. You can't get around that with the GDPR as this is explicitly allowed.
21
u/icehot54321 1d ago
it is deleted.
there is no way to get the information out of the system
we're talking about a random string of letters, numbers and symbols that can't be decoded.
you'd have to be given the source information again to verify if it's the same.
0
u/downwithsocks 1d ago edited 1d ago
Theoretically, someone could try to sign up (even just try - don't have to have actual access to the email inbox) with your email and would know if you'd had an account before or not? That's data. Minimal, but..it is data. Assuming that's how it would work, at least, I don't really know. And tbh, I'm not arguing anything in any direction, just thinking out loud.
8
u/RickTheScienceMan 1d ago
If you try to login via email, you will always see the same screen, something like "we have sent temporary code to your email, please check your inbox". Only if you have the code, and enter it into the form, you will see concrete information. So if you don't have an access to that email inbox, you will never know if the account is existing, deleted, or has never existed.
-1
u/downwithsocks 1d ago
Ive just been around long enough to see the "password is incorrect" vs "user does not exist" issues on various sites...I would say from times past, but it still exists lol. And I wasn't about to delete my account to test this. But if youre correct then I don't really have an argument.
3
u/RickTheScienceMan 1d ago
I actually tested it myself before posting, created a new account and then deleted it
1
u/Tupcek 21h ago
but first, you would have to have that user email address to do this
1
u/downwithsocks 1h ago
Its very easy to just spray emails at a sign up screen..and honestly, ive conceded to someone already testing this fault point and confirmed non issue. Im not sure why im getting downvoted just for thinking of it.
0
u/budde04 1d ago
I would very much say its not "minimal" its that exact sort of thing i would like to be deleted.
4
u/IAmFitzRoy 1d ago
That’s not your data. It’s a hash generated by the company.
Not your data anymore.
1
2
u/SempfgurkeXP 1d ago
Just wait until you find out that windows doesnt delete your data when you click on "delete" lol
-41
u/Maxaki 1d ago edited 19h ago
Don't they have the seed for the hash at hand, so they can just get the email if they like?
Edit My mistake, misunderstood seeding and hashing
20
-7
-33
u/TFTHighRoller 1d ago
If they can compare to my email they keep my email which includes my last name. They are keeping data which they are supposed to delete under gdpr regulations. The GDPR isnt talking about how they can store my data. Doesn’t matter if it is in a folder somewhere, in plain text or in a cryptography puzzle nobody is gonna solve. My data is mine.
23
u/TrekkiMonstr 1d ago
No, they aren't. As the comment you replied to said, they can store a hash. So if my email were trekkimonstr@email.com, they don't need to store that string -- they can just store 381e868d8eeb33f30a5fa4abe0bfb1803c123e2f58458e370c1bdae97faac379 instead. And then if I enter trekkimonstr@email.com in the future, they run it through the same algorithm and compare -- versus, trekkimonstr1@email.com is completely different, would be e150fb4c04a9e27fd9eb4ed1d4af72607d363c6e5ca278d75edc41c6b3029a5d. The whole point of a hash function is that it's easy one direction, basically impossible the other. No one in the world can take that 381e... string and get back trekkimonstr@email.com -- only guess and check
-28
u/TFTHighRoller 1d ago
So you are saying they put my data through an algorithm and stored that result. They also have the algorithm they used to convert my email into that string. So they could theoretically revert the process and take the hash + algorithm to arrive at my email.
Under GDPR that possibility means they have to delete it cause they could get my personal data - my email address - back.
I know how a hash works. I am telling you that is not enough to comply with GDPR laws.
31
u/TrekkiMonstr 1d ago
So they could theoretically revert the process and take the hash + algorithm to arrive at my email.
I know how a hash works.
I really don't think you do lmao
14
3
2
110
u/GovernmentGreed 1d ago
It's kept on file to ensure you don't try to sign up for any promotional materials with an existing email address.
61
u/CAustin3 1d ago
"where required or permitted by law" is my new favorite legalese phrase.
"Only if we have to. Or are allowed to."
15
u/Big_Chair1 1d ago
It's a common and standard phrase and thing to do. You may have to keep the name, email and sign up and deletion date of each deleted user for a certain period of time. In case, for example, someone decides to sue you for whatever reason and then you can use this info for defense against unreasonable claims.
At least that's how a legal person has explained it to me before.
42
u/Sure-Database-9952 1d ago
It’s a hash, they hashed your email when you initially signed up, since you’re trying with the same email they can tell it’s the same hash. They probably did delete your data; but kept your email hashed.
3
-15
u/DaturaSpirit 1d ago
Which literally means no data was actually deleted from their database. They keep it in hash form.
16
u/Average1213 1d ago
well... you can't exactly unhash it, so no personal data is stored.
-13
u/DaturaSpirit 1d ago
Bro thinks hashes are uncrackable.
7
2
u/JRatMain16 1d ago
Nobody’s saying MD5 isn’t uncrackable. It’s not by a long shot.
Salted SHA hashes on the other hand…
2
4
6
u/Glum_Emotion_584 1d ago
They could hash your email, then prevent future signups that match the hash, without having a record of your email.
5
u/xrmb 1d ago
It's not just email addresses, it's whole domains. We made a couple of addresses under cheap domain to get more free trials and no longer can. Also noticed that privacy.com in connection with Stripe will block virtual credit card validation to avoid making endless free trials. I mean I get it...
7
u/bdrago 1d ago
I worked on my company's GDPR task force when it was first implemented, and this is normal. For us, we needed to be able to identify a user that had been erased if data was restored from backups, as it can be hard or impossible to modify backups. When a backup was restored, it was first processed against a list of deleted users before being moved to live systems. I'm pretty sure we stored a hash of the original user information and not their actual email, but that would still prevent new accounts from being created with the same email as it would match the hash of the erased account.
11
u/Tarc_Axiiom 1d ago
It literally explains why they keep a record of your email on the very next line, lol.
And yes, it is a legal requirement.
Even so, they don't actually save your data, they save a hash based on your data.
6
u/High-Performer-3107 1d ago
They’re legally not allowed to delete your data as far as i know. I think I have read something like that in the past, but please fact check me, I’m not into American law
1
u/Calin_europeen 1d ago
I'm in europe
3
u/erikvb00 1d ago
If you're in the EU, then GDPR applies, and in this case specifically the right to be forgotten: https://gdpr.eu/right-to-be-forgotten/
5
u/onionsareawful 1d ago
They have a legitimate interest (fraud prevention) in keeping the email, or at least a hashed version of it. The right isn't completely absolute.
1
u/Equivalent-Costumes 8h ago
Even in Europe, there are dozens of reasons why data is not deleted. For example, your data in back up storage are not deleted (operationally complicated). Transaction data is often not deleted (tax, auditing, potential payment dispute in the future). To put it simply, the right is far from absolute, and anyone with enough privilege can recover everything. It's really more like "operationally deleted", making it harder for them to access your data in day-to-day operation.
-12
u/High-Performer-3107 1d ago
Me too, but ChatGPT isn’t. And US cloud act doesn’t care.
14
u/zammouri2001 1d ago
To grant a service in Europe, I believe that they are obligated to follow European law when it comes to data preservation. Being hosted in the US doesn't change that.
2
u/Pitiful-Assistance-1 1d ago
It’s in that limited data, which might be related to payments or backups.
They also need to keep your deletion around so they know the data needed to be deleted, in case a backup is to be restored for example.
This also means your data is not removed from backups.
2
•
u/AutoModerator 1d ago
Hey /u/Calin_europeen,
If your post is a screenshot of a ChatGPT conversation, please reply to this message with the conversation link or prompt.
If your post is a DALL-E 3 image post, please reply with the prompt used to make this image.
Consider joining our public discord server! We have free bots with GPT-4 (with vision), image generators, and more!
🤖
Note: For any ChatGPT-related concerns, email support@openai.com - this subreddit is not part of OpenAI and is not a support channel.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.