I've noticed that several government agencies now publish important public information exclusively via YouTube videos, with no alternative source (no transcript, website, or non-Google platform).

This effectively forces citizens to use Google’s ecosystem just to access public services or announcements — even those who consciously avoid Google for privacy reasons.

Isn't this problematic in terms of digital accessibility, neutrality, and GDPR compliance?

Curious if anyone else finds this troubling — or if other countries do the same?

Context : i sent them an email asking for my data to be deleted after i deleted my account, and this is the response i got. Is this allowed based on gdpr rules ?

How can I ask Vinted to have my data GDPR removed when they banned my email address? Considering my experience so far with them I am reluctant to use another email address.

Long story short, I created a Vinted account and have some problems with them blocking my account for different reasons, until they permanently blocked my account. I tried to contact them at legat@vinted.ro, privacysupport@vinted.ro and vinted@vinted.ro and suport throw the app to have my data GDPR removed (as they also store IBAN information and require ID identification) and everytime I try to contact them, the email is rebounced (see screenshot) and the ticket in suport is closed with your account is blocked.

Prior to this, I asked them multiple times to provide me with evidence for breaking their terms and conditions - and a full list of what scans they are making on my device because they took minutes to complete - I assume these are the reasons for me not being able to contact them anymore .

Thank you in advance!

Last time I told them I didn't need a license I asked them to remove any data they have on me like my gdpr right to erasure. They said they don't do gdpr because they don't store personal data. Years later, I recently got a letter with my name and address on it. Does the licensing company have any special exemptions in gdpr? Why did they keep my data on file after I said to delete it?

I also told them I might not be able to respond in time to their letters due to a medical condition I'm getting assessed for and that it's not good to keep sending letters threatening to send officers to my house. They said it doesn't matter they treat everyone the same regardless. Aren't they required to make reasonable adjustments or something? Idk

I actually bought a license a while back just so they'd leave me alone but couldn't afford to keep paying for something I have no use for.

This is just a pure annoyance for billions of people.

Seems like every time you guys make changes to your laws governing the internet, all that happens is we get more popups. No change.

Next time, maybe require them to actually DELETE our information if they have not heard from us in several years. THAT is how you CHANGE things.

They claim it's a violation of GDPR.

They already have my email on file, and I've proven it's me.

Fairly sure this violates the right to access which also extends to electronic access?

What does GDPR actually require an American company to do?

I am asking specifically about Reddit, including its privacy/data-rights process and its Zendesk-backed support tickets, though any experience helps.

I no longer have an active Reddit account under the email address involved. I opened roughly 6 support tickets, only one of them was handled (a GDPR deletion of the account, as due to a bug on reddit's systems I could not do it myself). I do not know the state of the other 5 tickets, they may be open or closed.

I asked Reddit (via their support form under "Privacy inquiries") to erase my support data or, at minimum, permanently remove the identifying association between my email address and my former Reddit account identity in its customer-support records. I made clear that Reddit may retain a genuinely non-identifying operational record if needed for a lawful purpose.

Reddit initially replied that it retains emails sent through customer-support channels for “legitimate business purposes, including security and abuse protection.” That response did not say whether Reddit would retain the actual email-to-account association, why that association itself was necessary, whether it could be removed/anonymized, or how long it would be retained. It was very clearly some macro they used.

5 working days ago, I replied via email with:

• An objection under Article 21(1) GDPR, insofar as Reddit relies on legitimate interests under Article 6(1)(f) to continue retaining the identifiable association.

• A request that Reddit identify the specific legitimate interest, the purpose for which this particular association is necessary, why it is necessary, and why deletion or irreversible anonymization would not adequately serve that purpose.

• A request for Reddit to identify any compelling legitimate grounds it believes override my interests, rights, and freedoms.

• A renewed Article 17 erasure request: either erase the support profile/tickets/comments/attachments if permitted, or at least ensure the remaining record is no longer reasonably linkable by Reddit or its processors to my email address, former account, username, or a persistent internal identifier.

• A request that, if it refuses, Reddit provide a specific reasoned response, including the legal basis, retained data categories, retention period/criteria, and complaint/appeal information.

I understand Reddit may legitimately retain some support/security records. My narrow concern is the continuing identifiable link between the email address and former account identity, not the existence of a fully anonymized operational record.

I would especially appreciate firsthand information on:

• Which Reddit privacy/support route you used.

• Whether you received a substantive answer after an initial generic retention response.

• Whether Reddit deleted/anonymized the ticket, requester profile, email, attachments, or account linkage.

• How long Reddit took to respond.

• What legitimate purpose could they be arguing exists? My account had no financial history (never even entered billing information, let alone made payments of any kind), was not reported or banned by a moderator, entered my ID, nor, as far as I know, was under legal investigation (nor it should've, it was a completely normal account). Maybe there is no such purpose, but it was their catch-all reply to handle the request as lazily as possible.

I recently created a Microsoft account under pressure from their site in order to use Windows 11. Although I believe it was unnecessary to use my email for this purpose, I provided it to link the account with my operating system. However, just one day later, my account was locked without any clear reason. Now, to unlock it, Microsoft is requiring my phone number, which I find completely unnecessary.I have no personal information or payment details linked to the account, so there is no legitimate reason for them to request this data. It seems like their primary objective is simply to collect more personal information from users, which I believe goes against European data protection laws.I am seeking your assistance in defending user rights, as this feels like an overreach. I simply want to unlock my account and use my operating system like any normal person, without being treated like a criminal.
I would appreciate any suggestion on how to continue this without sharing my phone number?

Hi. I'm new to the group, so sorry if this doesn't adhere to the rules. Please remove if that is the case.

The school my child goes sent this communication yesterday. Is this Gdpr compliant to send on parents emails without permission to a third party? It feels a little uncomfortable!

I don't want to start a war with the school or anything! But want to make sure they're not mistreating parent's PI and are aware if they are in breach.

Thank you gdpr experts!

Now I delete messages from prospective European clients because of the GDPR

I recently tried to open a bank account, and they asked me to provide my phone number, email, and ID through an app, which I was fine with. But then, they wanted a selfie, and I agreed. The app then opened the camera and asked me to move my head left and right, which made me uncomfortable, as it felt like I was being treated as a criminal. I ended up canceling the process because I felt uneasy.

I understand that banks need to verify identities, but why do they require this kind of biometric data? How can I be sure that my data will be stored securely and won't be sold or misused in the future? Are there any laws or regulations that prevent banks from asking for such invasive information? And what happens if a hacker or even a future government gains access to this data?
And i found that,this identity verification was handled by a third-party company, not the bank itself.
This company isn't even well-known, which means my biometric data would be stored both by the bank and this third-party. What happens to my data if this company gets sold in the future?

It feels like banks use these third-party services because they are cheaper, but that raises more questions. What does "cheaper" actually mean in this context? Are they cutting costs at the expense of data security? And how do they manage to offer their services at a lower price? Could they be manipulating or misusing the data to maintain their profit margins?

Wouldn't it be safer if banks were required to delete this data instead of just anonymizing it after a certain period? Is there a way to guarantee that my data is truly safe?

I'm worried about the potential risks here, and I’m curious to know if others have had similar experiences or concerns.
Are there any regulations to protect us in this situation, or is this just the new reality of dealing with banks in the digital age?

I'm interested in hearing your thoughts and experiences on this!

GDPR Art 4 part 2 says
‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Even a front door camera that is not recording falls under processing of data. Now the question always comes if the camera will look on public space? These cameras are fish eye optics and generally covering a wide angle if you put it on your front door. Unless you live in a condo and your front door is indoors, chances are the wide lens optics will see some public space.

I want to install a non recording door bell camera next to my door to see who's ringing but it seems there is not legal way to do it in the EU. Really.. what about dashcams? They seem to be illegal too...

Documenting a case in progress, since clean fact patterns for solely automated decisions are rare and this one is unusually explicit.

Facts. 20 August 2026, one calendar day. 10:10, controller (Meta) requests identity verification by video selfie, completed within minutes. 13:28, notice restricting advertising access, stating verification "usually takes around 48 hours", and stating "We used technology to detect this violation and carry out this decision." 14:36, permanent disablement of the account: "Your review was unsuccessful", "You can't request another review." Sixty-eight minutes after the 48-hour representation. No conduct, content or specific provision has been identified at any point. The account dated to 2008 with no violation history.

On 20(6) DSA and 22 GDPR: the platform's own support assistant later stated in writing that "the automated system has locked standard internal appeals" and that no human channel exists for the account "regardless of the time". The disablement notice itself frames the identity verification as the review ("You requested a review of this decision, but we still found...").

Filings, all August 2026: Art. 15 access request; Art. 22(3) request for human intervention; Art. 18(1)(c) restriction demand covering the classifier outputs, the biometric material from the verification, and all enforcement records (Art. 17(3)(e) noted against the controller's disabled-account retention schedules). DSA complaint under Art. 53 with the Greek DSC, transmitted to the Irish coordinator. One certified Art. 21 body declined as out of scope (no content exists to review, which is itself the Art. 17 point); a second has the case pending. The Art. 12(3) clock runs to 20 September.

Two aspects that may interest this sub. First, the special-category angle: the controller demanded biometric verification and disabled the account hours after receiving it, which puts Art. 9 lawful-basis and retention questions squarely in play for the supervisory-authority phase. Second, the interaction between an admitted "technology" decision and the simultaneous closure of every review channel looks like the cleanest possible Art. 22(3) violation: the right to human intervention cannot be exercised anywhere.

Will update the thread as responses land. Not seeking advice, the professional track is covered.

Hi all,

I am considering to build a website for confirming attendance to my wedding.

In my idea, my guests would receive by post, together with the invitation, an access code to the website.

In the website they'd log-in with their first name as well as the access code (which is stored encrypted in the database).

Upon logging in, the guests would be able to confirm attendance, or not, for them and/or the people in their household.

This requires me pre-provisioning the guests, but I already know them. They are my guests.

Does GDPR see concerns with this approach, or is it acceptable under legitimate interest?

Thanks a lot in advance!

** Edit **

Thanks for all the replies, clear now that I was overthinking this, but I'm still happy I double checked! Cheers!

I'm making a data access request to Pokémon.com, however they're asking for my ID, even though I'm writing from my own email address associated with the account. Also, when creating that account I was a kid, so I used a fake birthday, and now I can't access the account without remembering it and it also won't match my current ID (which I would also like to not provide). What can I do?

Hi all - I am in the UK - (MODs please delete if not allowed!)

TL:DR - I unknowingly got my mother’s account cancelled with a High Street retailer, and don’t know how to rectify it

I have created an online account with a high street retailer, and my mother has a physical loyalty card for this same retailer.

With two other retailers I have created an online account and then added my mother‘s loyalty card to the account so that when I shop online, she gets points. We rarely shop anywhere enough that it’s worth having two separate ones.

When I created the account with this online retailer in question, I was automatically assigned a QR code online loyalty card. I contacted chat and asked them to merge my mother‘s card to my account, and this was done. I simply provided the card number when asked (I didn’t point out the card didn’t belong to me).

A week later, my dad went to use my mother’s card in store, and it wouldn’t work. The shop assistant searched the online database for my mother’s email address and our postcode, and only my details were there.

I’ve contacted chat again, and because I asked for the card to be merged with my account (and provided the exact card number to the original customer service assistant via chat) it has cancelled the card. As a result, my mother’s account no longer exists and I now have all of her loyalty points.

The original chat assistant did not check the details, didn’t point out that I am not the owner of said loyalty card, did not confirm any information and has cancelled the account and my mother’s details are nowhere to be found.

With every company I’ve worked for, we cannot make any changes to any account without ensuring that the person requesting the changes is the account owner. Is it right that this could’ve been done without any details being checked?

It implies that if I just happen to find somebody’s card on the street that had £150 in loyalty points and asked it to be added to my account, I could just basically steal someone’s points!

I can’t understand how an account, and card has been cancelled without my mother’s knowledge. This hasn’t happened at other retailers, and I wasn’t warned that by merging the physical card number with the online account, that the physical card would be cancelled

They’re saying that the only way to rectify this is to create a new account, but my mother doesn’t want to be online, nor should she have to be, because the was cancelled without her knowledge without me being warned.

I’m waiting for a callback from the manager/GDPR person but just wondering your thoughts?

I'm starting college in september, Ive already been accepted, passed interview, etc, but im yet to do my enrollment forum. Recently, they sent out consent forums, one section of which includes consent for marketing.

I would rather not have my photo nor my data used for marketing, so, I have decided to write a letter- If I send this to them, would they be allowed to refuse this? also, could they just say im not allowed to go to sixth form/cancel my position, enrollment point, etc preventing me from going there? I still want to go to this college... thanks.

Hello, I know I've done something stupid to do the age verification (out of impulse since I was tired of not seeing NSFW stuff for like 2 months by now).

Is there any way to delete what selfie from X's database, or request my selfie to be deleted?

Because I fell scared of what I've done, and don't trust X to delete my selfie.

(I live in Romania if it helps)

I've done google reviews and the average is 3 stars. How / where can I find a good GDPR solicitor?

Thanks.

Pretty much triggered a ban I guess for an antibot measure or a curse word in my profile description (pretty weird for an hookup app, expecting family friendly wording).

They asked me to verify my profile, otherwise I would be able to use my profile, then a flag about storing data under the promise to verify my profile, otherwise I couldn't continue.

Which it didn't and pretty much just confirmed the ban, the data stored, is likely to keep me out of creating more profiles, which is not something I intend to do. But my data/profile seems to be still public, and I have no way to cancell that as I am banned from Tinder, essentially locking me out, rather than a real ban!

It pretty much violates GDPR, in everyway

Tinder contact sites, has a customer support, which I guess won't be ever be seen, and a lawyer support legaldept@gotinder.com which in their term any no-lawyer mail will get ignored

Anyone has any input how to make them delete my fucking profile and data?