![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
Time to delete your Glassdoor account and data
Recently I contacted Glassdoor for an account-related issue. This led to them sending me email that I had to respond to. Big mistake.
The TL;DR is: Glassdoor now requires your real name and will add it to older accounts without your consent if they learn it, and your only option is to delete your account. They do not care that this puts people at risk with their employers. They do not care that this seems to run counter to their own data-privacy policies.
I created my Glassdoor account about ten years ago. The only information they required at the time was an email address -- or you could sign in with Facebook or Google if you wanted, which I declined to do. Early on I set some job alerts, including location, as one does on a site with job postings. I didn't worry about that too much at the time.
After I responded to that support email last week, I found that they had updated my profile to add my real name and location, the name pulled from the email From line I didn't think to cloak because who does that? I never gave consent for that change, and said so explicitly when I objected. (In what follows, I was so fixated on my name that I didn't immediately notice my city was there too. I don't know how long it's been there.)
For context, here are some quotes from their own data policy:
As a global company, Glassdoor is subject to a variety of privacy laws that confer a range of privacy rights upon our users. We are committed to working to support compliance with the requirements of these global privacy laws and ensuring the rights and protections they offer are available to all of our users regardless of their location. [...]
We allow you to learn about, access, and control the personal data that Glassdoor holds about you. This includes data related to your use of Glassdoor.com, Fishbowlapp.com, and our associated apps. Using the form at the bottom of this page, you can request that Glassdoor allows you to: [...] Rectify your personal data. [...] Delete your personal data.
There is also this:
Right to withdraw consent for certain specific uses of your personal data on Glassdoor. [...] If we have collected and processed your personal information with your consent, then you can withdraw your consent at any time.
Note the loophole there -- "if we collected it with your consent". They haven't explicitly invoked that, but they could and it's slimy. (I never gave consent, therefore the dependent clause doesn't apply, they could argue.)
--
Now, on to the email discussion I had with, through escalations, three people over the course of six days.
First, they said that they are a "verified network" and "we require all users to verify their identity before giving them full access to our platform". Which parts constitute "full access" were not specified; they seem to mean FishBowl, a Blind-inspired social-media thing they're now doing. I don't care about that.
This requirement wasn't in place when I created the account -- demonstrably, as I was never required to provide a name. Sometime since then they changed the rules and my profile was sitting there with a null required field, I guess, until some employee noticed and edited it. I didn't find a notice of this changed requirement in my saved email, though it's possible I missed it or it got caught in a spam trap or something whenever it happened. I have no idea how long they've required that.
I replied to that message saying, in part, that I withdraw consent for them to store my name, in accordance with their data policy that they had helpfully provided me a link to. (Wasn't going to quibble over "withdraw" at that point. I thought this would be straightforward. How wrong I was.)
I got a reply from "lead, content and community team" -- I'm eliding employee names in this public post because I have more scruples than they do -- who informed me that though they were "required" to add my name to my profile, this would not affect the anonymous reviews I had posted in the past. Well I would hope not! But still, I said, them storing my name along with that data puts me at risk. I pointed out that we've seen ample evidence that anybody with a juicy online database can be hacked, and the mere presence of that involuntary data was a problem.
The next reply contained this plot twist:
So all users will now receive a Fishbowl account once they login to Glassdoor. Yours has already been created. All you need to do is download the Fishbowl app and login with either a social connection, your work email, or phone number to gain access to your account.
Say what now? You created and stored my personal information in a second account, and I can only get access to delete it by giving up even more information? Um, no. I guess that unsolicited account will just sit there.
(I asked where this was disclosed and was told that would be forthcoming. !!!)
This message went on to tell me that it was "not possible" to edit my name and if I want it gone, my only option is to delete my account. I responded that I planned to do that after I get my data dump, and in the meantime can they remove or anonymize my name -- reset to last week's level of privacy? It obviously is possible for them to edit that field because they did. Users, however, cannot edit it, so I can't fix it myself.
The reply came from "manager, content and community team":
I stand behind the decision that your name has to be placed on your profile and it cannot be reverted or nullified/anonymized from the platform. I am sorry that we disagree on this issue. We treat all users equally when it comes to what is eligible to be placed on the profile and what is not, but we know that there are times our users, such as yourself, may not always agree with us.
If you are not willing to allow your name on your profile, you will again need to complete Data erasure once you are able to. However, we cannot remove this for you or make the changes you wish to see for your name.
This is my final determination. I, as well as multiple members of my team, have reviewed your request several times, and I am considering this matter closed.
You heard it from the manager of Glassdoor's community team: they treat all users equally badly. Soon my account will be gone. If you have one, you might consider doing the same.
Edited to add, 2024-03-14, 23:00 UTC-4: I have been told that deleting your account merely deactivates it. To delete, you need to use the form at the bottom of their data policy page. Choose "delete my personal data", which also deletes your account. Also, mechanics of data deletion aside, I have not been contacted by Glassdoor since making this post.
Further edited to add: this comment describes a workaround if you hit the "you must cough up personal info to continue" wall.
no subject
I'm so sorry to hear this (if I had a Glassdoor account, I'd be deleting it now).
no subject
Yeah, it blew my mind when I realized that they considered this to be appropriate behavior and not an over-eager employee trying to "help". In what universe is it reasonable for service providers to dox their users like that?
There are places online where I choose to use my name. (Most of them, actually.) When I choose not to, I do not expect to be overruled. The account lacked a name for years; they could have said "comply with our altered terms of service or delete your account", without making things worse in the meantime.
For that matter, if they now require this, why wasn't I prompted to edit it upon login after the change? If they want to enforce it, enforce it -- by making users respond. Not by going behind their backs.
no subject
(Anonymous) 2024-03-16 04:42 am (UTC)(link)It's a required field! so you must allow them to potentially anonymize your data. Fuck that.
no subject
I hope that means "if I'm asking for deletion I give permission for deletion, and if I'm asking for something else I give permission to anonymize", but yeah, that's not what that says, and it's concerning, especially from a company that has already demonstrated extreme disregard for users' privacy and safety. It just keeps getting worse and worse, ugh.
no subject
no subject
no subject
Yeah. It would have been so easy for them to do the right thing instead. Name is required? Check at login, prompt, block whatever "full access" means until the user handles it. Fixes all your missing names, not just the ones attached to people who came to your attention, and doesn't take control away from the user. Or to handle cases individually, notify when discovered and then block access until the user edits. Easy peasy. No consent violations required; the user can edit, delete the account, or walk away.
no subject
To use technical language, what the deep fried fuck is this bullshit.
no subject
Your technical language made me laugh. :-)
no subject
no subject
https://www.axios.com/2023/03/27/labor-board-says-non-disparagement-clauses-are-unlawful
no subject
no subject
I guess it hasn't happened to anybody with reach. Sites requiring real names isn't new, and sites changing their terms of service isn't new. The slimy new thing here is non-consensual privacy violations. I don't know how much they've done that; I only know that they did it to me.
no subject
I didn't even twig to the name thing when it asked for it last time I logged in. As you might imagine, I just said no on providing my name, and my alter ego now has an account.
no subject
You can, they say, still make public posts anonymously. You have to remember to set that. With them storing your name, there's no protection from future changes that either accidentally or intentionally reveal it on your past contributions.
The whole point was to allow people to post reviews safely. Of course this allows fake reviews (I've seen some that are too good to have been written by anybody but HR or marketing), and I guess that's the problem they're trying to combat. If they wanted to change the rules from now on, that would be fine -- people could decide whether to continue, and contributions that earlier could even be marked "unverified" or something if they want. But that's not what they did.
no subject
Would you like some advertising of this page via Mastodon (https://mastodon.sdf.org/@rhialto) Not that I am such an influencer but it might help to make this issue a bit more widely known...
no subject
And their data policy seems to be claiming that, inteaad, the extend GDPR protections to everyone. But it sounds like a GDPR violation to this non-expert, too.
Please feel free to link this page on Mastodon, and thanks. (I did post something that fit in 500 characters there yesterday before writing this longer account here. This is definitely the more informative version.)
no subject
no subject
You've got reach! I've had and responded to two press inquiries.
no subject
no subject
I thought my cat pictures were kind of popular, but this is around 2 orders of magnitude bigger. It seems to have stabilized now though.
(the edit button seems to have disappeared so I'm posting this as a reply)
no subject
no subject
no subject
(Anonymous) 2024-03-14 06:57 pm (UTC)(link)The "if you consented, you may withdraw consent" seems likely to be a GDPR-oriented thing--there are rules for what kind of data collection does and does not require consent. They're probably leaning on one of the legal bases other than consent. See https://gdpr.eu/gdpr-consent-requirements/, subheader "The GDPR requires a legal basis for data processing".
no subject
no subject
Yeah, and someone on Mastodon reported finding the name filled in without ever having provided it and without having contacted them. I don't know if this person tied the account to Google/Facebook or uploaded a resume or what, but the name on the profile came as a surprise. It's not just me.
no subject
I know Zendesk is also bad about picking up names that people's email clients send and then not getting rid of them, but Glassdoor is a whole other level of YIKES.
I can't delete my account
So yeah, if you want to delete your Glassdoor account to prevent them from exposing your personal information, the only way you can do so is by potentially exposing even more personal information...
Re: I can't delete my account
Yikes!
I think I remember seeing "not employed" as an option. I wonder what happens if you choose that -- or have they removed that option too?
Re: I can't delete my account
Re: I can't delete my account
Re: I can't delete my account
(Anonymous) 2024-03-18 03:00 pm (UTC)(link)"Oops, there's an issue with your submission.
Below is information about the issue and how you can fix it.
Thank you for contributing to the Glassdoor community.
Our moderators evaluate each review to determine whether it complies with our Community Guidelines. We determined your review does not meet these guidelines.
If you wish, you are welcome to edit your review here and your edited review will be reevaluated within 24 hours of receipt.
If you would like more information about our Guidelines or how we assess content, please visit our Help Center for further background and insight."
Re: I can't delete my account
I got a batch of those a couple minutes after I got the confirmation that my data was deleted. It looks like I got one copy for every item I ever submitted there (reviews and information about benefits, in my case), but those edit links don't work without logging in, so I can't easily check. The count looks plausible from what I see in my data dump.
Looks like more bad/confusing UX.
no subject
(Here via Ask A Manager.)
no subject
Thanks for letting me know about the AAM thread.
no subject
no subject
Here via Ask A Manager
I just went to delete my account, and, irony of ironies, they ask your name for the account you want to delete.
Also , apparently "delete" doesn't really mean delete. They say "I acknowledge that by submitting this request I give permission to Glassdoor to permanently delete or anonymize my data," so, nice little loophole there for them I guess.
I hope you let AAM know if you ever hear back from them!
Re: Here via Ask A Manager
Oh, I wonder if you have to be logged in to delete, and they're doing something strange if you're not?
Upon login, I'm told, they are now requiring you to provide a name and job title. I was pointed to a Hacker News thread where, deep in the comments, someone reports giving a fake name and a job title of "Glassdoor Bankruptcy Advocate" to get past that modal.
no subject