# Delete Your Data ![DeleteYourData trash-bin logo](/public/brand/delete-your-data/logo.svg) A Portland BSides follow-up centered on autonomy. Keep the 2022 recap short; spend the time on LLC proxies, business accounts, estate planning, and the people who can act after us. Each slide carries one illustration and a title. Presenter notes and sources stay below its divider. Law and provider documentation checked October 21, 2026. - I. The original talk - II. LLC proxies and estate planning - III. Death and digital control - IV. State removal rights - V. Data hygiene ## I. The original talk ### Delete Your Data in 2022 ![A screen with a play symbol recalls the original BSides recording](img/delete-your-data/01-original.png) --- BSides Portland, October 2022. Find the data, find the request process, ask for deletion. One-minute recap. Our addition: reduce exposure before signup and plan who acts afterward. Sources: - [original recording][original] - [transcript and talk listing][transcript] [original]: [transcript]: ### Before the next signup ![A person chooses an account arrangement before sharing information](img/delete-your-data/02-signup.png) --- Notice collection. Ask who benefits. Decide what to share. Add three tools: separate contact details, choose the service agreement, and name a successor. These are separate ways to exercise control. ## II. LLC proxies and estate planning ### A business-facing identity ![A person reaches a service through a separate business](img/delete-your-data/03-business.png) --- For genuine business activity, use the LLC's name and appropriate business contact details. Keep the home address and personal phone out of routine public-facing fields where permitted. The provider can still require an individual's identity. An LLC is a contracting party, not an anonymous identity. Sources: - [Oregon business privacy alternatives][registry] [registry]: ### The registry can expose you ![Public records fan out from a business registration](img/delete-your-data/04-registry.png) --- Check what the filing publishes before submitting it. Oregon requires physical addresses for specified fields. A registered agent does not replace every address requirement. Choose lawful alternatives before creating new exposure. Sources: - [Oregon business privacy alternatives][registry] [registry]: ### Separate the channels ![Business contact channels separate a person from several services](img/delete-your-data/05-channels.png) --- Illustrative setup: business email, business phone, appropriate business address, and an eligible business account. Keep personal recovery details out of public profiles. The benefit is less casual linkage, not guaranteed anonymity. ### Estate planning follows ownership ![Trust documents connect an asset to its successor](img/delete-your-data/10-trust.png) --- After separating the business, plan its continuity. Identify who succeeds to the LLC interest and who can administer its accounts; coordinate the governing documents and provider access. A trustee may hold appropriate assets through a living trust. An estate plan is not itself a signup identity. A decedent's estate is administered after death. A funded living trust can avoid probate for trust assets; litigation and recorded transactions can still expose facts. Sources: - [California court explanation of living trusts][trust] - [California digital-asset directions][directions] [trust]: [directions]: ### Meta for Business ![A business controls a public page while a person manages access](img/delete-your-data/06-meta.png) --- Example: publish the LLC's business name and contact channels on its Page; manage business assets through a business portfolio. Keep personal details off the public Page where the platform permits. Meta still identifies its managers. Contact information is visible to people added to the portfolio. Page Transparency can disclose management countries and confirmed business owners. Public separation does not mean anonymity from Meta or coworkers. Sources: - [Meta portfolio setup][meta-setup] - [Meta Page Transparency][meta-transparency] [meta-setup]: [meta-transparency]: ### Choose the AI service agreement ![An organization selects the boundary around a model request](img/delete-your-data/07-fabric.png) --- Example: Copilot in Microsoft Fabric. Microsoft documents no training on customer data; this is a product commitment, not a benefit automatically created by an LLC. Fabric is not the ChatGPT consumer service. Some Fabric experiences retain conversation history, so no training does not mean no storage. Inference still processes the prompt to produce an answer. Check tenant settings and the exact feature. Sources: - [Fabric privacy and security][fabric] - [notebooks and data-agent history][fabric-history] [fabric]: [fabric-history]: ### Vertex AI and ChatGPT business use ![A model request stays within a chosen organization boundary](img/delete-your-data/08-vertex.png) --- Example: a business uses managed models through Google Cloud's Vertex AI route. Google's terms restrict training on customer data without permission or instruction. Logging, caching, grounding, and model-specific terms still matter. ChatGPT business workspaces also have no-training-by-default commitments. Compare the actual service, retention, and administrator access; an LLC name alone changes none of those settings. Sources: - [Google Cloud service terms][google-terms] - [Google's data-retention guidance][google-retention] - [ChatGPT business workspace protections][chatgpt-business] [google-terms]: [google-retention]: [chatgpt-business]: ### Privacy expectations in court ![A balance represents privacy interests and access authority](img/delete-your-data/09-cases.png) --- *Warshak*: hosted email contents can carry a reasonable expectation of privacy against government access. The Sixth Circuit found a warrantless-access violation but applied the good-faith exception to suppression. *Ziegler*: a private workplace office carried a privacy interest, but the employer validly consented to the search of the office and business computer. The Ninth Circuit affirmed denial of suppression. Neither case establishes that B2B accounts receive stronger privacy than personal accounts. Distinguish constitutional search protection, contractual limits on provider use, and public visibility. Our practical inference: inspect access rights and terms rather than treating the business label as a privacy guarantee. Sources: - [United States v. Warshak, 631 F.3d 266, 288 (6th Cir. 2010)][warshak] - [United States v. Ziegler, 474 F.3d 1184, 1192–93 (9th Cir. 2007)][ziegler] [warshak]: [ziegler]: ### Separation has limits ![A balance shows the benefit and limits of business separation](img/delete-your-data/11-limits.png) --- Ask three questions: Who owns the account? What is public? What can the provider do with the data? An LLC or trust does not automatically add deletion rights. Oregon excludes commercial-context activity from its consumer definition. Separation can improve exposure while changing the statutory rights available for a particular interaction. Sources: - [Or. Rev. Stat. § 646A.570][oregon-scope] [oregon-scope]: ## III. Death and digital control ### Your digital successor ![A key passes between a person and a successor](img/delete-your-data/12-successor.png) --- Oregon, California, and Washington provide routes for documented fiduciary requests to terminate accounts. Establish who has authority; provide the required death certificate, authority documents, and account identification. Account-termination authority does not create a universal right to erase the person's footprint. Sources: - [Or. Rev. Stat. § 119.062][death-or] - [Cal. Prob. Code § 880][death-ca] - [Wash. Rev. Code § 11.120.150][death-wa] - [Cal. Prob. Code § 874][death-limits] [death-or]: [death-ca]: [death-wa]: [death-limits]: ### Leave clear instructions ![Written instructions connect an account to its successor](img/delete-your-data/13-instructions.png) --- Inventory accounts. Name the appropriate fiduciary. Specify preserve, transfer, or delete. Align provider tools with the estate documents: qualifying online disclosure directions can override conflicting will or trust instructions. Keep credentials out of public documents. Access to message contents can require separate consent and documentation. Sources: - [California digital-asset directions][directions] - [Google's deceased-user process][google-death] [directions]: [google-death]: ### Preserve, then close ![Records move into an archive before an account is discarded](img/delete-your-data/14-preserve.png) --- Preserve records needed for estate administration before deletion. Then use documented termination requests and provider death procedures. Seek broker suppression separately. Google warns that closing an account prevents later delivery of its contents. Do not promise removal of public records, reporting, or copies held by others. Sources: - [Google's deceased-user process][google-death] - [California fiduciary limits][death-limits] [google-death]: [death-limits]: ## IV. State removal rights ### Oregon ![An Oregon outline contains a record and a deletion check](img/delete-your-data/15-oregon.png) --- For covered processing, request deletion of provided, purchased, and derived personal data. Also access, correct, and opt out of sale, targeted advertising, and qualifying profiling. Coverage and exceptions matter. Public-record data is a major limit. An ordinary request receives a response within 45 days, with a permitted extension in qualifying cases. Sources: - [Or. Rev. Stat. § 646A.574][oregon-delete] - [Oregon consumer FAQs][oregon-faq] [oregon-delete]: [oregon-faq]: ### California ![A California outline connects to several data brokers](img/delete-your-data/16-california.png) --- CCPA: request deletion of personal information collected from you, subject to coverage and exceptions. DROP adds a centralized request to registered data brokers; mandatory processing began August 1, 2026, with recurring checks. This does not erase the internet. Recheck the effective dates of recent amendments before delivering the talk. Sources: - [Cal. Civ. Code § 1798.105][california-delete] - [CalPrivacy DROP regulations announcement][drop] [california-delete]: [drop]: ### Washington ![A Washington outline contains a heart for consumer health data](img/delete-your-data/17-washington.png) --- My Health My Data provides deletion rights for covered consumer health data and withdrawal of consent. Notice reaches specified downstream recipients. Backup deletion can be delayed up to six months. This health-data route does not supply a general right to remove every online record. Sources: - [Wash. Rev. Code § 19.373.040][washington-delete] [washington-delete]: ### Deletion has boundaries ![A barrier separates a deletion request from remaining copies](img/delete-your-data/18-boundaries.png) --- Separate account closure, source deletion, search removal, and broker suppression. Exceptions and required retention can leave records behind. A successful request to one holder does not erase independent copies. Preserve the request and response so the next action starts from evidence. Sources: - [California deletion exceptions][california-delete] - [Washington downstream deletion][washington-delete] [california-delete]: [washington-delete]: ## V. Data hygiene ### A smaller footprint ![An eraser reduces a trail of account records](img/delete-your-data/19-hygiene.png) --- Close unused accounts. Limit optional permissions. Use distinct aliases where supported. Review public contact details, sharing, recovery paths, and business administrators. Keep a private request log and check for reappearance. These are ongoing habits. ### Choose one next step ![A person approaches an open door](img/delete-your-data/20-choice.png) --- One exposed address. One unused account. One successor instruction. Reduce what gets published, request what can be removed, and prepare the next person to act. Autonomy is the through-line.