Users Claim Twitter Isn’t Deleting Their DM Data When Asked

EU law mandates that tech companies delete data when requested, but a new report alleges the company is ignoring requests to delete messages.

We may earn a commission from links on this page.
A person on a bicycle rides down the street in front of the California Twitter offices with the big Twitter sign out front.
Twitter has been accused of failing to delete users’ DMs even though it’s required by EU law.
Photo: Justin Sullivan (Getty Images)

Remember last August, when an ex-Twitter executive Peiter “Mudge” Zatko accused the blue bird app of routinely failing to delete users’ information from the platform when they deleted their accounts? Well, it seems under the new stewardship of billionaire Elon Musk, Twitter is still failing to delete users’ information upon request, even if they’re required to by law.

TechCrunch reported Wednesday that Twitter has ignored requests by European users to delete their messages, a right granted to them by EU law. Both Ireland and the UK’s offices responsible for citizens’ data protection said they are investigating Twitter after receiving multiple complaints the platform is ignoring requests to delete users’ DMs.


In an email statement, a spokesperson for the UK’s Information Commissioner’s Office told Gizmodo: “The ICO is engaged in dialogue with Twitter’s data protection officer and is continuing to assess the potential data protection impacts of any changes to the company and its online services.”

We also reached out to Ireland’s Data Protection Commission, but we did not immediately hear back. EU data is protected under the General Data Protection Regulation, or the GDPR. Even though the UK is still under the whole Brexit thing, the country has, at least until now, maintained the framework under domestic law.


Both agencies told TechCrunch that they have received multiple complaints from users that Twitter has ignored requests to delete their DMs. The DPC told the site it was “engaging” with Twitter on the issue, while the ICO stated it was assessing “the potential data protection impacts of any changes to the company and its online services.”

Of course, we would reach out to Twitter for comment, but the company no longer has a public relations department. We Tweeted at Musk, the only individual left who acts as a mouthpiece for the platform, but of course we didn’t hear anything more. Twitter itself says on its Help Center page that users can delete messages, though they are not removed from the account the DM was sent to. In essence, the message remains on company servers until Twitter manually deletes that information.


One unnamed Twitter user quoted by TechCrunch said that after he requested that Twitter delete his DMs, the company offered him a stock email response. The company gave instructions on how to delete the user’s Twitter account, and that if they wanted they could reverse that account deactivation within a 30-day limit. The company did add “search engines and other third parties may still retain copies of your public information… even after you have deleted the information.”

If you look back at Mudge’s original whistleblower complaints, he mentioned how Twitter had collected so much information on its users, but it still had no clear idea how much information it still contained on its servers. He also claimed that Twitter can’t delete much of users’ data since it doesn’t know where it’s stored. Twitter’s DMs are not end-to-end encrypted, so Twitter employees have long had access to users’ messages. This was a major complaint Mudge had in his initial whistleblower report.


Though Musk had originally been all-in on Mudge’s accusations back when he was trying to back out of the $44 billion Twitter deal, he’s now had to roost in that environment. Since coming into his seat, he’s fired more than half of the company’s global workforce. Layoffs have continued into the new year, including cuts to software engineering teams. Some of the worst hit departments were in the company’s public policy department.

Some of those layoffs have specifically impacted both the UK and Ireland Twitter offices. Last month, several dozen ex-Twitter employees who worked at the company’s London office threatened to take their former company and Musk to court. The former workers alleged the company did not give them the proper warning period before axing their employment.


Update 02/08/23 at 12:12 p.m. ET: This post was updated to include a comment from an ICO spokesperson.