Paying $20 To Delete Your Ashley Madison Profile Was Probably Not a Great Idea. Among Others

The most interesting question is why anyone would believe any site is not hackable, especially as juicy a target as a site promoting extra-marital affairs. JL

Megan Geuss reports in ars technica:

Ultimately, what Ashley Madison is doing is not totally dishonest, but it's not totally honest either. We would guess that most people coming to a site for extramarital affairs have made peace with that kind of parsing of the truth.

About a year ago, Ars ran this article looking into how Ashley Madison tricks people into thinking they need to pay $20 to have their profile information deleted. This weekend, a hacker group calling themselves Impact Team broke into the site and looked through its databases, finding that users' details aren't actually deleted after the $20 is handed over. In essence, the two options that Ashley Madison gives exiting customers—”Full Delete” or “Hide My Profile”—are almost the same, with the only benefit of “Full Delete” being that it removed messages and “winks” from other users' inboxes after an account was deleted. Read Ars' take below to see what we found out in August 2014. Earlier this week, Ars got an e-mail from a reader named Rob Plant. “I think most right-thinking people have been dismayed by the tactics of charging for picture take downs—what is worrying to me is that these practices now seem to have been taken up by more legitimate websites.”
Ars has long covered the scourge of “revenge porn,” in which seedy websites post revealing photos of unwilling people and then charge those victims a fee to take the photos down. But Plant was writing about a site called Ashley Madison, which markets itself as a dating website for married people to find accomplices in extra-marital affairs. (Its slogan is blunt: “Life is short. Have an affair.”) The website has been around since 2001, and although it's taken some guff for allegations that it populates its network with fake profiles of women, it still boasts 29 million users worldwide, most of whom are presumably not fake.
The way it works is this: Ashley Madison allows people to sign up for free with "Guest" accounts, which permit users to send and receive photos and “winks.” Guest accounts can also reply to messages sent by a member. To become a "Full Member," one must buy credits, as opposed to, say, paying a monthly subscription. Full Members can initiate messages and chats with their credits, and women can send messages “collect." After first contact (and guidelines of the Prime Directive permitting) messages between the two users are free.
Plant, however, took issue with the way Ashley Madison treats its departing customers. As he described:

A few years ago Ashley Madison had a big media blitz on UK TV and I signed up, primarily because the ads were interesting and I had signed up for a few other dating websites, like POF [Plenty of Fish] and wanted to compare. Having had a check out of the website (and some puerile giggles at people's profiles) I promptly forgot about it and Gmail did its thing of filtering all of the updates into the social/promotional folder.
I've decided today to get rid of all my online dating profiles (not used them in years, have a longterm girlfriend etc.) and went to delete my Ashley Madison log on to discover that it wants to charge me £15 [approx. $20] for the privilege of them removing my data from their systems!
Now I don't care about my profile being up there (it does offer the opportunity to hide it so that it can't be found and I'm no longer getting e-mails from them)—but this does seem like a crappy way of a company extorting money out of a (presumably wealthy) audience eager to quickly hide the details of their sordid extramarital dealings.

Of course, Ars couldn't resist the urge to look into a story involving sordid extramarital dealings and alleged extortion. As it turns out, however, the issue is a bit more nuanced. Ashley Madison does let users delete their profiles for free, but directions on how to do so can be confusing to the point where they appear misleading.
Still, similar dating and social networking sites aren't much better—in fact, Ashley Madison's paid-delete service goes further in scrubbing you off its system than most other networking sites.

The way you think you must delete

On Ashley Madison, you can simply hide your profile using the “Profile Options” page. Selecting the box that says “Check this box if you wish to temporarily hide your profile” deactivates your account, but this preserves all your account details in case you want to return months or years later and pick up where you left off.

Enlarge / Under Profile Options, users can deactivate their accounts, which lets them return at a later date and pick up where they left off. This is the most temporary of Ashley Madison's three tiers of deleting.

Enlarge / Ars made a test account and was presented with an ad to "Ghost Erase" our account. Others have been shown the words "Full Delete." Also, notice the "Hide Your Profile" option beneath it.

But when you go to actually delete your account, you are presented with two options: you can either choose the option in big, bold letters that says “Full Delete” (Ars also came across the term “Ghost Erase” when we tried to delete our test account), which promises to “remove all traces of your usage for only $19,” or you can choose to “Hide My Profile,” which only promises a “basic deactivation” to “hide profile from search.” If you choose to hide your profile, you are then taken to a page that gives you the option to “permanently hide” your profile. But Ashley Madison doesn't give a clear run-down of what's involved in hiding a profile, whereas with the “Full Delete” option you're told up front that it will include:

• Removal of profile from search results
• Removal of profile from the site
• Removal of messages sent and received
• Removal of messages from recipient's mailboxes including Winks & Gifts
• Removal of site usage history and personally identifiable information from the site
• Removal of photos

So naturally, many people assume that Full Delete is the only way to get your profile taken off Ashley Madison's servers.

Paying to totally erase the past

The company's CEO Noel Biderman spoke to Ars over the phone and said that's just not the case. Ashley Madison's Hide My Profile Permanently option, he told us, is the same thing as deleting a profile on most other sites. Your identifying details will be deleted, but messages and pictures you've sent to others on the site behave like e-mail, and you can't get them back.
But with a Full Delete, Biderman told Ars, Ashley Madison erases all identifying details, plus any photos and messages you may have sent to others. “We've developed a product where we'll go back in time and remove photos and conversations that you've had,” Biderman said. “We feel it's more than fair to charge a nominal fee to take that away.”
“There's a real administrative cost,” he added, noting that sometimes recipients will contact the company asking why messages they received are now missing from their in-boxes.
Removing messages you sent in the past is something few other sites will do. Facebook will delete your profile and any pictures you've uploaded, but a spokesperson told Ars that Facebook can't take back messages you've sent. OKCupid, too, told Ars that once a user deletes their account on that site, “any messages that have gone out act like e-mail; once they are delivered then the receiver can see them until they delete them. However, a receiver won't be able to see the sender's profile.” OK Cupid also keeps photos uploaded to its servers for longer than one might expect. After a user has deleted their account, “The photos will remain if a user has a dedicated link to them (they aren't crawlable, however). We are receptive if people want those removed and will do it manually if someone requests.” (This is something Facebook used to do, too, which Ars covered extensively.)
Similarly, Match.com requires that you call its payment processing centers first to stop your subscription, and then it allows you to permanently delete your profile. However, it's unclear if messages and photos can be scrubbed off the company's servers after permanently deleting your profile. (Ars has contacted Match.com and will update when we receive a response.) Tinder also lets you delete your account from within the app. “This will delete your matches, messages, etc…” the company writes on its website.
One of the few social network services that actually allows a user to remain in control of the photos and messages they send, even after they've sent them, is Instagram Direct. Users can delete their sent communications off recipients' phones (as long as the recipients haven't downloaded the images, of course) at any time after it has been sent.
Oddly, Ars discovered that Ashley Madison's site for men seeking men, called “Downlow,” does not organize its delete page like Ashley Madison's main site does. Instead, deleting a profile is much more straight-forward: there's a “delete my profile” option on the left-hand menu bar, and when you go there you can choose to “deactivate your account,” which gives you a warning that your profile will no longer be available after 24 hours. “Delete” is, confusingly, used interchangeably with “deactivate,” but at least customers know their profiles won't be available to others after the button has been pushed. However, the customers for Downlow don't seem to enjoy access to the Full Delete feature that scrubs their messages and photos from recipients' mailboxes for a fee.

On Ashley Madison's "Downlow" site for men seeking men, deleting your account is much more straightforward.

1. 
   On Ashley Madison's "Downlow" site for men seeking men, deleting your account is much more straightforward.
2. 
   Although your only option is to "deactivate" your account on this page, clicking that button brings up a message that says the action is permanent.

Still, Ashley Madison, Tinder, Match, OK Cupid... these are the best of the bunch. A site called Delete My Account says services like Chemistry.com and SpeedDate.com don't allow you to delete your profile at all; deactivation is the only option. Ars has reached out to these companies but has not yet heard a response.
For Ashley Madison, it seems like getting users to simply deactivate their accounts rather than permanently delete them might be just as good for business as pushing them to do a full delete. “I can't tell you how many people delete their profile and come back and say 'oh that was a mistake,'” Biderman said. “Historically this is different from a traditional dating site, where people tend to use it for three months and if they do find a person, then they're done with it, and if they don't then they say 'this isn't working for me. With an affair it's different, with an affair they feel like they need it, it ebbs and flows.”
He added that “almost 30 percent of the people that delete their accounts come back and ask us 'oh can we reinstate our account?'”
Correction: Ars originally compared Ashley Madison's overall return rate with a statistic from OK Cupid on the number of active users who have re-enabled their deactivated accounts. The two sets of data are not comparable, however, so the OK Cupid statistic has been removed.

The only delete you see is a full delete

Still, if you look at the screen shot Plant sent with his e-mail, it's easy to see why he was confused. And he's hardly alone. Many articles, forums, and review sites often advise Ashley Madison users that “the only way to delete your profile is to pay.”
Biderman says that these complaints are in the minority, and satisfied customers who want to have every trace of their presence on Ashley Madison removed are happy that the service exists. After all, when you're sending illicit messages between people looking for affairs, you might really, really want that message that you sent deleted from someone else's inbox (especially if that message could be used for blackmail). “That is what we're charging for, and that comes with a bunch of blowback on the other side [from the receiver who can't find old messages], and we're dealing with that blowback,” he said.
“16,000 people a month are totally ecstatic with it, and people don't understand that. This isn't a charity, we have to charge for that, and that's our prerogative,” Biderman continued. Ars later asked a spokesperson for Avid Life Media, the parent company of Ashley Madison, to confirm that number, and the spokesperson said that the number of Full Deletes the site sells each month varies between 8,000 and 18,000. (Noel Biderman is both the CEO of Ashley Madison and Avid Life Media.) For those keeping score, numbers like that would mean that Ashley Madison is raking in somewhere between $152,000 and $342,000 each month, just from the Full Delete option alone.

Enlarge / Ars got this notice after we permanently deleted our test profile. Sorry ladies, Kieth26 is officially off the market.

Biderman also told Ars that he didn't know why our reader, who wrote that he only ever signed in as a Guest user and had never purchased any credits, would want to do a Full Delete. But that's the problem: the reader didn't know he didn't need a Full Delete. Ashley Madison doesn't make it clear to Guests who want to delete their profiles that “hiding” a profile can mean more than hiding it. Hiding something permanently is slightly clearer, but you don't get that option until you've made the choice between doing a Full Delete and Hiding your Profile.
On the other hand, what you get for a Full Delete is probably entirely worth the money to enthusiastic users of the site. Few social networks let you take communication back, and if sporadic affairs are your thing, there are probably worse ways to spend your money.
Ultimately, what Ashley Madison is doing is not totally dishonest, but it's not totally honest either. And we would guess that most people coming to a site for extramarital affairs have made peace with that kind of parsing of the truth.