You should email their data privacy officer and request them to delete it under the laws of GDPR.

Document it before and after and every correspondence.

If your data isn't gone in 6 months, publish everything you've documented in a blog post. Post it here to Lemmy and email the government.

They'll get fined millions or over a billion Euros. The EU doesn't fuck around with these violations.

Your name shows up as deleted and the post stays up if you try to delete a post not account.

Not if you do some sort of whistleblower thing, right?

I think people here know, but your comment leads people to misinterpret your intention as trying to discourage people from removing deleting stuff from reddit.

I know of one Redditor, who did a monthly edit on his posts and comments with an app that did not delete content, but replaced it with gibberish.

That is illegal under GDPR, if true

This statement is unfortunately doing a lot of work with the word “that”, even if I dearly wish it wasn't so. Like, I really wish it were that easy, it would even the playing field back to the non-corporate webmaster almost instantly.

But alas.

The GDPR doesn't have some special category where data only becomes data once you hit Submit. Article 4 literally defines “processing” to include collection, recording, and storage. So yes, depending on what the site is actually doing, it can absolutely be processing what you type before you submit anything:

https://eur-lex.europa.eu/eli/reg/2016/679/art_4/oj/eng

But that does not get you from “they captured it” to “therefore illegal.” GDPR doesn't prohibit processing personal data; it regulates how and why you can do it. Article 6 gives six possible lawful bases for processing, including consent, contractual necessity, and legitimate interests (and it is bastardizing the spirit of how these six interconnect that these companies use to skirt intent of the law):

https://eur-lex.europa.eu/eli/reg/2016/679/art_6/oj/eng

The actually interesting question is what they're capturing, why, how long they retain it, what they do with it, whether they disclosed that processing, and what lawful basis they're claiming.

That's where you can potentially have a GDPR problem.

Article 5 requires, among other things, fairness/transparency, purpose limitation, data minimization, limited retention, and appropriate security:

https://eur-lex.europa.eu/eli/reg/2016/679/art_5/oj/eng

And Article 13 requires the relevant information to be provided when the personal data is obtained. There isn't a magical “well technically the user never clicked Submit” exemption from transparency:

https://eur-lex.europa.eu/eli/reg/2016/679/art_13/oj/eng

There's also a separate ePrivacy issue if we're talking about storing or accessing information on the user's device. Article 5(3) generally requires consent unless the storage/access is strictly necessary to provide a service the user explicitly requested:

https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A62017CJ0673

And this is where the details get important again, because regulators have explicitly recognized things like short-lived, first-party “user-input” session cookies for multi-page forms as potentially falling within that necessary-function exemption. See WP29 Opinion 04/2012:

https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp194_en.pdf

That is a very different animal from silently retaining abandoned form contents indefinitely, sending them somewhere unexpected, profiling somebody with them, or reusing them for advertising.

So if somebody actually wants to know whether their abandoned input was retained and what happened to it, GDPR gives them tools for finding out instead of having to speculate from browser behavior. Make an access request to the controller and ask what personal data they hold, the purposes/legal basis, recipients, retention period, and the source/context of the collection.

They normally have one month to respond under Article 12:

https://eur-lex.europa.eu/eli/reg/2016/679/art_12/oj/eng

If they don't respond, or the answer establishes something questionable, then you have something concrete to take to the relevant supervisory authority under Article 77:

https://eur-lex.europa.eu/eli/reg/2016/679/art_77/oj/eng

The EDPB has the list of national authorities here:

https://www.edpb.europa.eu/contact_en

GDPR is leverage, not a magical force field that prevents a server from receiving bytes. The useful part is that it gives you a mechanism to make the controller explain what those bytes became, why they kept them, and what they did with them—and a regulator to complain to if the answers suck.