Hacker News Reader

Comment by sanxiyn | Hacker News Reader

Just delete the phone number. You can use two factor authentication with OTP, SMS part is unnecessary.

> Just delete the phone number.

I'd be surprised if Facebook ever deletes anything like this voluntarily. Most likely "deleting the number" just means hiding it and using it only of ad targeting and more subtle forms of profile matching.

They do in GDPR jurisdictions or they’re fucked.

Define fucked in this context.

They'll pay a fine, perhaps, but it's not like Mark Zuckerberg will be laying in a gutter pissing blood.

Regardless, you can't put the cat back in the bag. Bad actors will still have scrapped your number, or way too much personal identifying information, anyway.

GDPR fines can be pretty significant. Google was hit with a €50 million fine in January.

€50 million doesn’t sound like a lot for a company with $100,000 million revenue.

Assuming it is proven

Deleting the data in your account settings isn't going to necessarily remove it from Facebook's database. Getting a vanity number that spells your first name or nickname would be a better workaround IMO, and you can set business hours and such to control your potential employer's access to you :P

I believe GDPR specifies right of erasure, and if Facebook doesn't delete the phone number you "deleted", Facebook will face much larger problems.

My comment was fairly US-centric, as we don't have GDPR. In the EU that'd be much more useful, as the cost of phone numbers in Europe and calling rates vary wildly, and can be quite exorbitant in some countries.

Facebook still operates as a business in the EU and can therefore be fined there. As a similar example, Google was fined €50 million earlier this year as a result of a GDPR violation.

Can Facebook be fined by the EU for actions outside the EU that only affect users outside the EU? Sure, but it would likely create political waves and I'd doubt it'd happen. Global enforcement of GDPR isn't realistic, as the EU doesn't have worldwide jurisdiction.

The last time I tried to do this, about a year, it required a phone number to enable 2FA in the first place, and then it was possible to use OTP (with e.g. Google Authenticator). But once I got sucked into doing that, I couldn't delete the phone number to do only OTP without it also disabling 2FA.

Ugh, that sucks? I recently setup OTP-only 2FA, so apparently they fixed it.

It still gives the same warning if you remove the phone number while TOTP is enabled. But I was able to remove and then set up TOTP based 2FA without a phone number.

I should add that removing the phone number didn't actually delete the number from my profile (who could have known?). You have to go into the Mobile tab and remove the phone number again.

All this despite me reluctantly adding my phone number just for 2FA. Dark patterns throughout the website.

Facebook does not delete the personal information they've harvested about you. Delete = Hide it from you. Maybe they will in GDPR Europe, but not anywhere else.

Reply on news.ycombinator.com