What are the implications of deleting a user account?

Question

Most of the websites I've used in the past (including this one) do not offer an option to delete your own account.

I think the main reason is to avoid the orphanage of the items created (or the delete on cascade of those items).

Modern sites (like this one) have a place where those items go when an account is abandoned (in the case of SO it is the user "Community").

What is, in your opinion, the rationale of not providing a "delete my account" feature?

Security? Laziness? Ignorance? Bug? Or feature?

We are designing a small web app, and we are discussing precisely this topic. We can't find too many reasons though for not allowing the user to delete the account.

Answer 1

Will it be more work to maintain those abandoned accounts than you would normally have? Also, are people that visit your site likely to come back to it after long periods of time? These are questions your team might want to discuss.

Personally, unless it is going to cause a disruption or slowdown in work, I would keep the accounts. That way, users won't complain when they visit six months down the road and find they cannot log in.

Answer 2

I'd say either lack of foresight or "not worth the effort" judgement.

Answer 3

This is a pretty broad topic, but some of the ones I've experienced are:

• Accounts can be tied to comments, deleting the account screws up the comments
• Accounts can tied to other systems (community server, authorize.net and blackbox web services) and can be hard to delete on those
• Cascade, like you mentioned
• Prevent user stupidity - accidental delete is hard to undo, and even trickier on a subscription site
• Return on investment - try explaining to your boss why you're doing a weeks worth of data integrity testing instead of setting a boolean to false
• Marketing - "We have 85,000 registered users" (see: myspace)

Answer 4

This may not apply to you. But in our system, we deal with patient data. Because of privacy, security and regulatory concerns, we do not delete users. We have extensive audit trails indicating who accessed/entered/changed which pieces of information. We provide a mechanism to disable access, but the audit trails must remain in tact, so the health care facilities can monitor and enforce their privacy policies.

Answer 5

As a user, I want to be able to contact a company and request that my account be wiped.

Answer 6

I'm pretty sure I've quoted this Udi Dahan article but it's worth posting again here.

The key point is to model the task, not the data. Do you truly want to nullify the existence of a user (he/she never existed)?