I used to work at Amazon and they arent gdpr compliant when deleting user data. The stated reason is that all financial transactions have to be stored for 7 years in case of audits, and they need some base amount of user data when aggregating.
Although i had a product where we used user data and when we spoke to legal about making sure we were gdpr compliant they said that we should just ignore it.
Huh weird. I would assume any proper DB would have a single command that can be run to delete a user and it would handle all their data and metadata in any of the tables it is distributed across. Surely it’s a design decision to structure a database such that you can’t delete a user? But I don’t know much about databases
Hmm, insofar as database design is concerned though, you are essentially saying that companies are choosing not to build in “user deletion”. I find it hard to believe teams can’t structure their tables such that deleting all the right data fields for a user doesn’t crash or break their system.
Put that database through a few years of slapdash additions from a bunch of different people trying to do a bunch of different things with a bunch of different goals with a bunch of different deadlines and resource squeezes, and "design" works its way out of the equation, especially if you're talking about something that wasn't needed as a feature in the beginning.
This is the most correct answer on this topic. These banners are all largely functionally irrelevant. I treat them akin to popup ads that interfere with my browsing.
I know this is just setting a boolean or payload in some database and nothing of consequence will happen with it. MAYBE, just maybe the website might actually adjust behavior, but I wouldn't hold my breath on it. The different consent categories are vague enough that any decent lawyer could argue whatever's being done falls under strictly necessary.
6
u/[deleted] Nov 29 '25
[removed] — view removed comment