One of Zatko’s chief allegations against Twitter is that it does not reliably delete the data of users who cancel their accounts.
Expanding on that claim, Zatko told lawmakers Tuesday that the company’s chief privacy officer had come to him admitting that Twitter has deliberately misled regulators who asked about Twitter’s deletion practices.
“I was told straight out by the chief privacy officer that the [Federal Trade Commission] had come and asked, ‘Does Twitter delete users’ information?’,” Zatko said. “He said, ‘I need you to know this because other regulators are asking us, and this ruse is not going to hold up.'”
Twitter has allegedly told regulators that it deactivates user accounts but has been elusive about whether it fully deletes the data. In response to questions from CNN, Twitter has previously said it has workflows in place to “begin a deletion process” but has not said whether it typically completes that process.
Asked by Sen. Mazie Hirono whether Twitter has the capability to delete user data appropriately, Zatko said it would be possible if Twitter had better control of its data, but that it does not, in a “fundamental root problem” for the company.
“They need to know what data they have, where it is, why they got it and who it is attached to,” Zatko said. “At that point, they would be able to delete.”