it might help to think about this aistudio warning that has consumed your days as being like the confirmation they show when you delete a youtube video. to my eyes, these are consumer warnings positioned to be "extra scary" to consumers/users, not anything related to data retention.
they probably do not immediately purge your personal video bits upon YT delete either (i mean, who knows, but they can probably afford the space).
in fact, one could argue that being able to retrieve a supposedly destroyed "personal item" for no cost as being a benefit to the consumer/user, but i understand if that is a bridge too far.
Are you on Google’s payroll, or what the hell is this garbage excuse? It doesn't even matter anymore because my post was flagged anyway—most likely by corporate sycophants like you
I want to take this seriously, but eight (slop?) rehash of the story on the blog isn’t helping with credibility. Pro tip: don’t do that, however triggered you are, it definitely doesn’t help.
I don’t use Google AI Studio so can’t verify, good luck.
Anybody who has ever run a website with customer data can instantly understand why they do it this way. I don't see any malice.
It's simple, really. You have a website where people can upload their cat photos. There's a delete button. People click the delete button, read the "This will really Delete your Thing. It's Permanent. You CAN'T GET IT BACK!" warning, and click the confirm button.
Then you get an angry email (and twitter post, and blog entry, and Reddit mob) saying "I can't believe you deleted my photo without asking. That was my favorite cat photo it was my only copy I'LL SUE YOU!@!!"
So you go into your console and flip the .isActive bit back to 1 on that photo, send off your stock apology, and get on with your day.
To run your business any other way is madness. You're not training or selling or otherwise misusing that cat photo. You just don't want to deal with that hassle every day. So you "delete" things by moving them someplace where they're not public anymore.
No, sorry. Promising to permanently delete data without doing it is the madness and should be illegal if it's not already. Hide the permeantly delete for privacy just a bit further and offer a soft delete to the user then for the normal case.
But that's silly. If you don't trust a website with your cat photo, don't upload your cat photo the website.
As I said above, the only thing my site does with your cat photo is show it back to you when you ask to look at it. No training. No selling your data to anybody. All I'm doing is storing it because you asked me to, and showing it to the people you ask me to.
You can certainly ask me to stop showing it to people. But please don't get all excited about how your rights have somehow been violated.
The fact is, people click delete buttons without thinking about it. Those people get way more mad when they can't undo that delete than you are now.
I only wish there was a centralized registry of websites that are controlled by parties that have galavant attitude if not deliberate misunderstanding of what does the right to privacy mean.
This is honestly a foolish response, but I'm still not going to flag you. In fact, I'll even upvote your comment so you get a point. I'm sure you aren't writing this nonsense out of malice—you just genuinely don't understand the issue.
Deletion means deletion. There is no such thing as 'we didn't delete it just in case you did it by accident.' That is just a convenient excuse for illegally hoarding user data, and the law strictly forbids it. What is their lawful basis under the GDPR to keep it after I demand deletion? Exactly: none at all.
Exactly! This is my problem too, because they are lying. Promising to permanently delete data without actually doing it is insane, and it should be illegal if it isn't already. Hide the permanent deletion a bit more for privacy reasons, and normally offer a soft delete to the user. But they are just lying!
Well, no. Correct behavior would be to state „your data will be deleted and may be recovered for X days“. Claiming full and permanent deletion and then not deleting it is malicious behavior and should be against the law (at least inside the EU).
Exactly! But unfortunately, the reality is incredibly frustrating. I actually wrote to a woman at NOYB. She replied at first, but now they have gone completely silent! I honestly wonder if they just don't understand the technical side of the problem.
It’s the exact same story with the Irish DPC. But with them, I think they are actively protecting Google. There’s a reason people call the DPC 'Google’s shield.'
They even gave me a hard time once because I use AI to write my emails... xD But what the hell am I supposed to do if I don't speak fluent English and need to explain a complex architectural fraud? I’m doing my best, but the system is deaf.
They are not a 'poor large corporation'—the problem is that they don't delete anything. They just lie and say they do, while in reality, nothing is deleted. I proved it against them with the JSON restore
This cannot be an excuse. The data is clearly used for AI training. If that were actually the case, they would state the truth on the UI buttons instead of lying, and they wouldn't have banned me from VRP either.
They lie constantly and they do not comply with the law. I have been writing to them for almost a year, and not a single human has ever replied to me—even their DPO is just an automated script!
I doubt much people using Google think that their data would just magically disappear the moment they click a button, to the contrary, I believe most qualified users would know that their data is forever stored, maybe "anonymized" sure (but can still be correlated back).
If some users think this, have they question the Why would they do it? Why would Google lose money that way? ToS is irrelevant when it comes to what's running on their own private infra.
Guys, please forgive me if my English is crappy. My native language is Hungarian, so I use AI to write my replies and the English articles. I've been working on this case for almost a year now, and I just want this big corporation to finally be held legally accountable! This whole thing has consumed so much of my time and my nerves. Honestly, it's starting to break me down a little. But I'm not backing down! It’s a really ugly thing that they are stealing people's data. Authorities like NOYB, the DPC, and the AI Office basically don't give a shit, even though I sent them everything. Either the bureaucrats are idiots, or I just don't know why the case isn't moving forward at all. Please look at the many web archives I’ve linked here in the comments. :) THX all!
Genuine advice. Just move on. It seems like you are proud of what you have done here and it is letting you spiral. You say that they’ve deleted more than a hundred of your posts and… yeah. If somebody is making hundreds of posts about this sort of thing that’s gone well beyond useful communication.
This is, frankly, not very important and not something that will produce a successful lawsuit so this is just harming your own mental health for no reason.
Content being moved to trash and then eventually cleaned up and permanently deleted is an extremely ordinary pattern. If you want a more rigorous deleting of your data you can use a wipeout procedure.
I have just mathematically proven that Google is lying to everyone, and you are here writing about some imagined, non-existent corporate jargon while telling me to calm down... Well, listen to me: I am not backing down! Google is the one that will suffer the consequences, not me, because I am going to sue them. I am the first person in the world to conclusively prove this architecture fraud against them. If you haven't done so yet, go read my posts—the links to the archives are all listed right here in the comments.
> have just mathematically proven that Google is lying to everyone
First, no you have not. Second, this would be distinct from actually breaking a law.
Think about the design here for a moment. When you click delete the file goes into the "recoverable, but to be deleted" state. Then after 25 days it goes into the "to be permanently deleted" state and various backend jobs start removing it from storage under a maximum time frame of 30 days. So Google communicates that you have 25 days to recover the file (you do). After 25 days the file is in an indeterminate state because it may be deleted from various backend storage systems. After 55 days it is guaranteed to be completely gone.
This is... how most such systems work. The laws governing data deletion give time windows. They don't specify that files must be deleted instantly. "Fraud" is also a specific legal term. Just saying "well the warning says it will be deleted permanently but it takes some time to do that" is not meaningful.
I also have no idea what "mathematically proven" means in this case.
> Google is the one that will suffer the consequences, not me, because I am going to sue them. I am the first person in the world to conclusively prove this architecture fraud against them.
I remember the first time I submitted something to a VRP. I was so proud of my accomplishment. I was a real security researcher! This made me overemphasize the importance of my finding in my mind. I can understand how pushback against your report feels like a personal slight but I assure that it isn't. The reason that you are getting banned from these systems is not because you've found some great crime or something so dangerous. The reason you are getting banned from these systems is because you are a spammer now.
I can assure you of two things.
First, you are not the first person in the world to notice this deletion pattern. It is not unique to these particular files. Second, you will not successfully sue Google. This design is commonplace across the industry.
What kind of deletion timeframe are you even talking about when I have literally proven that the deletion process hasn't even started in the first place? Do you actually understand my post at all, or are you just unable to read? xD
I'm genuinely trying to help but it is difficult if your response is to just insult people. I understand your post very clearly. What I am telling you is that what you describe is ordinary design across the industry. It is not unique to this one feature in AI Studio. It isn't even unique to Google.
You are using AI to write your posts. Ask it to summarize the deletion timelines required by GDPR. You are claiming that this design is illegal.
You've submitted dozens of posts on this topic to HN. You are a spammer and you are only causing yourself pain. I understand that it is exciting to see yourself as a protagonist. It is exciting to think that you are the only person to discover some dark secret. But you haven't.
Kudos to the author for not being so bitter and jaded, like me, and reporting this thinking some change might come.
I have mostly resigned myself to watching in unsurprised disgust as tech companies (aided by oodles of HN users who work there!) ruin everything they touch with legal impunity.
And look at this, here is my latest ticket from IssueTracker, check it out xD I uploaded it here. Their automated bot kicked me out of the VRP, claiming I violated the 'Code of Conduct' just because I told the truth. To make it worse, the bot actually put in writing that this is 'Intended Behavior'! First of all, under the law, an automated bot shouldn't even have the authority to issue permanent bans without human review... and second, that idiot bot literally confessed in writing that their deceptive design is an 'intended feature'.
So, if this goes to court, Google will literally be arguing with themselves, and I'll just be sitting there laughing at them xD
Unfortunately, there are quite a few people here who can't even grasp what they read, and they are probably the ones who flagged my post too! These pathetic users keep blabbering about 'deletion timeframes' when it has been clearly proven that no deletion has even started—otherwise, it would have been physically impossible to restore the chat. On top of that, both the AI Studio buttons and the Trash button explicitly state that the file is deleted permanently and irreversibly. But their stupid minds just can't process this!
If there really were a functioning TTL (Time-To-Live), then why the hell are they lying on the UI buttons? These 'smartasses' just keep blabbering. Why does Google constantly lie, stating completely different and contradictory things in every single piece of their documentation?
I am really glad you guys are starting to understand the core problem with Google's scam here.
The fact that they lie on their buttons—promising that prompts are deleted, and literally stating 'Permanent Deletion' on the Trash button—but then in reality you can restore them with their 'special' robot, is a massive fraud. When you click that button, you are demanding that Google deletes your prompt, which is exactly what their UI promises they will do...
Every single piece of their documentation says something different. In the Gemini API docs, they promise a 24-hour automatic prompt deletion (TTL). Then, the Drive Trash docs advertise a 25-day recovery window (supposedly against accidental deletion, which I believe lacks any legal basis). The reality is that this is a lie just so they can hoard our data! This is illegal. They also mention 55 days, which I believe is calculated by adding the 30 days in the trash plus the 25-day drive recovery window.
But guys, think about it for a second. You are not restoring the prompt; you are restoring the pointer, the JSON file. And to make it worse, there are multiple versions of this file inside Drive, depending on how old the prompt is and how much you chatted with the AI!
If it were really about deletion, they would just be honest and write: 'Sorry, we don't delete anything, we keep it for 25 or 55 days.' But no, they constantly lie in the button texts. They claim they are deleting the 'prompt', when they demonstrably aren't, because it's just a JSON file. It’s just a pointer. It is NOT the data on the backend...
They are lying in an incredibly disgusting way, especially since EU laws don't even allow this. And when I threw this in their faces, what did they do? They banned me from their forums, and they permanently banned me from the VRP... This tells you everything you need to know.
The problem is that Google is lying in its documentation because they don't delete anything. If they did, the chat wouldn't work, since I am only restoring the JSON with the robot. Understand this :) If you understand this, because you are not stupid, then you will realize what a vile, lying company Google is! The buttons are lying right off the bat. And what does 'recovering permanently deleted files' even mean? I'm not even recovering the prompt, just the JSON file. And another thing: if I permanently deleted something, how can they restore it? This is called a scam!
https://news.ycombinator.com/item?id=49777035
it might help to think about this aistudio warning that has consumed your days as being like the confirmation they show when you delete a youtube video. to my eyes, these are consumer warnings positioned to be "extra scary" to consumers/users, not anything related to data retention.
they probably do not immediately purge your personal video bits upon YT delete either (i mean, who knows, but they can probably afford the space).
in fact, one could argue that being able to retrieve a supposedly destroyed "personal item" for no cost as being a benefit to the consumer/user, but i understand if that is a bridge too far.
Are you on Google’s payroll, or what the hell is this garbage excuse? It doesn't even matter anymore because my post was flagged anyway—most likely by corporate sycophants like you
[dead]
Since they keep flagging my comments, you can find them here: https://ibb.co/933qjqVr
I want to take this seriously, but eight (slop?) rehash of the story on the blog isn’t helping with credibility. Pro tip: don’t do that, however triggered you are, it definitely doesn’t help.
I don’t use Google AI Studio so can’t verify, good luck.
thx!!!!!
This is what happens when a Google Fanboy lies and gets caught red-handed:
https://ibb.co/ccSVTKXk
Anybody who has ever run a website with customer data can instantly understand why they do it this way. I don't see any malice.
It's simple, really. You have a website where people can upload their cat photos. There's a delete button. People click the delete button, read the "This will really Delete your Thing. It's Permanent. You CAN'T GET IT BACK!" warning, and click the confirm button.
Then you get an angry email (and twitter post, and blog entry, and Reddit mob) saying "I can't believe you deleted my photo without asking. That was my favorite cat photo it was my only copy I'LL SUE YOU!@!!"
So you go into your console and flip the .isActive bit back to 1 on that photo, send off your stock apology, and get on with your day.
To run your business any other way is madness. You're not training or selling or otherwise misusing that cat photo. You just don't want to deal with that hassle every day. So you "delete" things by moving them someplace where they're not public anymore.
It's just what you do...
No, sorry. Promising to permanently delete data without doing it is the madness and should be illegal if it's not already. Hide the permeantly delete for privacy just a bit further and offer a soft delete to the user then for the normal case.
It's already illegal in Europe, as long as the data falls into the PII category.
TRUE!!!!
But that's silly. If you don't trust a website with your cat photo, don't upload your cat photo the website.
As I said above, the only thing my site does with your cat photo is show it back to you when you ask to look at it. No training. No selling your data to anybody. All I'm doing is storing it because you asked me to, and showing it to the people you ask me to.
You can certainly ask me to stop showing it to people. But please don't get all excited about how your rights have somehow been violated.
The fact is, people click delete buttons without thinking about it. Those people get way more mad when they can't undo that delete than you are now.
> the only thing my site does with your cat photo is show it back to you when you ask to look at it. No training. No selling your data to anybody
Yeah, right.
> You can certainly ask me to stop showing it to people.
There is much better solution: add author's websites to dnsmasq, so they stop resolving:
http://www.expatsoftware.com/ http://www.expatsoftware.com/articles https://stravaeger.com/ http://www.twiddla.com/ https://www.s3stat.com/
I only wish there was a centralized registry of websites that are controlled by parties that have galavant attitude if not deliberate misunderstanding of what does the right to privacy mean.
THXX
That’s not silly. Your rhetoric is.
“I don’t get it, why do people expect a promise to permanently delete your things to akshually do just that”
Such a goofball stance on the subject tbh.
THX!!!!!
This is honestly a foolish response, but I'm still not going to flag you. In fact, I'll even upvote your comment so you get a point. I'm sure you aren't writing this nonsense out of malice—you just genuinely don't understand the issue.
Deletion means deletion. There is no such thing as 'we didn't delete it just in case you did it by accident.' That is just a convenient excuse for illegally hoarding user data, and the law strictly forbids it. What is their lawful basis under the GDPR to keep it after I demand deletion? Exactly: none at all.
> What is their lawful basis under the GDPR to keep it after I demand deletion?
GDPR explicitly permits deletion timeframes. It does not demand that files are instantly destroyed as soon as you click the button.
[dead]
It is permanently deleted. It just takes a little while.
[dead]
Exactly! This is my problem too, because they are lying. Promising to permanently delete data without actually doing it is insane, and it should be illegal if it isn't already. Hide the permanent deletion a bit more for privacy reasons, and normally offer a soft delete to the user. But they are just lying!
Well, no. Correct behavior would be to state „your data will be deleted and may be recovered for X days“. Claiming full and permanent deletion and then not deleting it is malicious behavior and should be against the law (at least inside the EU).
So forwarding it to NYOB is a good choice.
Exactly! But unfortunately, the reality is incredibly frustrating. I actually wrote to a woman at NOYB. She replied at first, but now they have gone completely silent! I honestly wonder if they just don't understand the technical side of the problem. It’s the exact same story with the Irish DPC. But with them, I think they are actively protecting Google. There’s a reason people call the DPC 'Google’s shield.' They even gave me a hard time once because I use AI to write my emails... xD But what the hell am I supposed to do if I don't speak fluent English and need to explain a complex architectural fraud? I’m doing my best, but the system is deaf.
Oh yeah, poor corporations, getting sued(!!) for deleting data after being asked by the user to delete it.
Beautifully crafted ragebait :D
They are not a 'poor large corporation'—the problem is that they don't delete anything. They just lie and say they do, while in reality, nothing is deleted. I proved it against them with the JSON restore
You could just not put a delete button in the first place
I don't like your comment because it's nonsense, but I'll upvote it so you get a point. :)
This cannot be an excuse. The data is clearly used for AI training. If that were actually the case, they would state the truth on the UI buttons instead of lying, and they wouldn't have banned me from VRP either. They lie constantly and they do not comply with the law. I have been writing to them for almost a year, and not a single human has ever replied to me—even their DPO is just an automated script!
I doubt much people using Google think that their data would just magically disappear the moment they click a button, to the contrary, I believe most qualified users would know that their data is forever stored, maybe "anonymized" sure (but can still be correlated back).
If some users think this, have they question the Why would they do it? Why would Google lose money that way? ToS is irrelevant when it comes to what's running on their own private infra.
[flagged]
Why Hacker News Protects Google: The Anatomy of Big Tech Fanboyism
https://substack.com/@bitu79/note/c-341436310
Guys, please forgive me if my English is crappy. My native language is Hungarian, so I use AI to write my replies and the English articles. I've been working on this case for almost a year now, and I just want this big corporation to finally be held legally accountable! This whole thing has consumed so much of my time and my nerves. Honestly, it's starting to break me down a little. But I'm not backing down! It’s a really ugly thing that they are stealing people's data. Authorities like NOYB, the DPC, and the AI Office basically don't give a shit, even though I sent them everything. Either the bureaucrats are idiots, or I just don't know why the case isn't moving forward at all. Please look at the many web archives I’ve linked here in the comments. :) THX all!
Genuine advice. Just move on. It seems like you are proud of what you have done here and it is letting you spiral. You say that they’ve deleted more than a hundred of your posts and… yeah. If somebody is making hundreds of posts about this sort of thing that’s gone well beyond useful communication.
This is, frankly, not very important and not something that will produce a successful lawsuit so this is just harming your own mental health for no reason.
Content being moved to trash and then eventually cleaned up and permanently deleted is an extremely ordinary pattern. If you want a more rigorous deleting of your data you can use a wipeout procedure.
I have just mathematically proven that Google is lying to everyone, and you are here writing about some imagined, non-existent corporate jargon while telling me to calm down... Well, listen to me: I am not backing down! Google is the one that will suffer the consequences, not me, because I am going to sue them. I am the first person in the world to conclusively prove this architecture fraud against them. If you haven't done so yet, go read my posts—the links to the archives are all listed right here in the comments.
> have just mathematically proven that Google is lying to everyone
First, no you have not. Second, this would be distinct from actually breaking a law.
Think about the design here for a moment. When you click delete the file goes into the "recoverable, but to be deleted" state. Then after 25 days it goes into the "to be permanently deleted" state and various backend jobs start removing it from storage under a maximum time frame of 30 days. So Google communicates that you have 25 days to recover the file (you do). After 25 days the file is in an indeterminate state because it may be deleted from various backend storage systems. After 55 days it is guaranteed to be completely gone.
This is... how most such systems work. The laws governing data deletion give time windows. They don't specify that files must be deleted instantly. "Fraud" is also a specific legal term. Just saying "well the warning says it will be deleted permanently but it takes some time to do that" is not meaningful.
I also have no idea what "mathematically proven" means in this case.
> Google is the one that will suffer the consequences, not me, because I am going to sue them. I am the first person in the world to conclusively prove this architecture fraud against them.
I remember the first time I submitted something to a VRP. I was so proud of my accomplishment. I was a real security researcher! This made me overemphasize the importance of my finding in my mind. I can understand how pushback against your report feels like a personal slight but I assure that it isn't. The reason that you are getting banned from these systems is not because you've found some great crime or something so dangerous. The reason you are getting banned from these systems is because you are a spammer now.
I can assure you of two things.
First, you are not the first person in the world to notice this deletion pattern. It is not unique to these particular files. Second, you will not successfully sue Google. This design is commonplace across the industry.
You are only causing yourself pain here.
What kind of deletion timeframe are you even talking about when I have literally proven that the deletion process hasn't even started in the first place? Do you actually understand my post at all, or are you just unable to read? xD
I'm genuinely trying to help but it is difficult if your response is to just insult people. I understand your post very clearly. What I am telling you is that what you describe is ordinary design across the industry. It is not unique to this one feature in AI Studio. It isn't even unique to Google.
You are using AI to write your posts. Ask it to summarize the deletion timelines required by GDPR. You are claiming that this design is illegal.
You've submitted dozens of posts on this topic to HN. You are a spammer and you are only causing yourself pain. I understand that it is exciting to see yourself as a protagonist. It is exciting to think that you are the only person to discover some dark secret. But you haven't.
[dead]
[flagged]
[flagged]
Look at these archives here, they even banned me from their official forum, but I saved hundreds of my posts. Look at this: https://archive.ph/https://discuss.ai.google.dev/* and this: https://archive.org/details/@gy_rgy_ist_kovics/web-archive and this: https://archive.org/details/@gabor_gabor_freemail_hu/web-arc... and this: https://ghostarchive.org/search?term=https%3A%2F%2Fdiscuss.a...
Kudos to the author for not being so bitter and jaded, like me, and reporting this thinking some change might come.
I have mostly resigned myself to watching in unsurprised disgust as tech companies (aided by oodles of HN users who work there!) ruin everything they touch with legal impunity.
thx
https://github.com/istokovicsgyorgy79-jpg/CanusLupus/blob/ma...
And look at this, here is my latest ticket from IssueTracker, check it out xD I uploaded it here. Their automated bot kicked me out of the VRP, claiming I violated the 'Code of Conduct' just because I told the truth. To make it worse, the bot actually put in writing that this is 'Intended Behavior'! First of all, under the law, an automated bot shouldn't even have the authority to issue permanent bans without human review... and second, that idiot bot literally confessed in writing that their deceptive design is an 'intended feature'. So, if this goes to court, Google will literally be arguing with themselves, and I'll just be sitting there laughing at them xD
Unfortunately, there are quite a few people here who can't even grasp what they read, and they are probably the ones who flagged my post too! These pathetic users keep blabbering about 'deletion timeframes' when it has been clearly proven that no deletion has even started—otherwise, it would have been physically impossible to restore the chat. On top of that, both the AI Studio buttons and the Trash button explicitly state that the file is deleted permanently and irreversibly. But their stupid minds just can't process this!
If there really were a functioning TTL (Time-To-Live), then why the hell are they lying on the UI buttons? These 'smartasses' just keep blabbering. Why does Google constantly lie, stating completely different and contradictory things in every single piece of their documentation?
I am really glad you guys are starting to understand the core problem with Google's scam here. The fact that they lie on their buttons—promising that prompts are deleted, and literally stating 'Permanent Deletion' on the Trash button—but then in reality you can restore them with their 'special' robot, is a massive fraud. When you click that button, you are demanding that Google deletes your prompt, which is exactly what their UI promises they will do... Every single piece of their documentation says something different. In the Gemini API docs, they promise a 24-hour automatic prompt deletion (TTL). Then, the Drive Trash docs advertise a 25-day recovery window (supposedly against accidental deletion, which I believe lacks any legal basis). The reality is that this is a lie just so they can hoard our data! This is illegal. They also mention 55 days, which I believe is calculated by adding the 30 days in the trash plus the 25-day drive recovery window. But guys, think about it for a second. You are not restoring the prompt; you are restoring the pointer, the JSON file. And to make it worse, there are multiple versions of this file inside Drive, depending on how old the prompt is and how much you chatted with the AI! If it were really about deletion, they would just be honest and write: 'Sorry, we don't delete anything, we keep it for 25 or 55 days.' But no, they constantly lie in the button texts. They claim they are deleting the 'prompt', when they demonstrably aren't, because it's just a JSON file. It’s just a pointer. It is NOT the data on the backend... They are lying in an incredibly disgusting way, especially since EU laws don't even allow this. And when I threw this in their faces, what did they do? They banned me from their forums, and they permanently banned me from the VRP... This tells you everything you need to know.
The problem is that Google is lying in its documentation because they don't delete anything. If they did, the chat wouldn't work, since I am only restoring the JSON with the robot. Understand this :) If you understand this, because you are not stupid, then you will realize what a vile, lying company Google is! The buttons are lying right off the bat. And what does 'recovering permanently deleted files' even mean? I'm not even recovering the prompt, just the JSON file. And another thing: if I permanently deleted something, how can they restore it? This is called a scam!
[dead]
[dead]
[dead]
[flagged]