Redlinethe fine print, decoded

Contract trap · Privacy policy

Obstructed data rights

Rights requests must be sent by post or notarized letter, with ID copies or a fee; consent can be withdrawn only 'in writing to our postal address'; deletion is 'deactivation' or 'subject to our retention needs'; the operator 'may' comply or 'reserves the right to refuse'.

Severity
Expensive
How often it turns up
Common
Holds up?
Often void
Clause phrases
19

What it looks like in a contract

Redline matches these phrases against your document verbatim. Drafters rarely invent new wording — they copy it, which is why the same sentences turn up across unrelated contracts.

In English-language contracts

  • requests must be submitted in writing by mail
  • we may charge a reasonable fee
  • we may require notarized proof of identity
  • we reserve the right to refuse requests
  • deactivate your account
  • we will retain information as necessary to comply with our legal obligations
  • we may not be able to delete
  • within a reasonable time
  • you may withdraw consent by contacting us at our postal address
  • except as otherwise required by law we may continue to use

In Russian-language contracts

  • отзыв согласия осуществляется путём направления письменного заявления по почтовому адресу Оператора
  • заказным письмом с уведомлением
  • с приложением копии документа, удостоверяющего личность
  • Оператор вправе продолжить обработку персональных данных после отзыва согласия
  • деактивация аккаунта
  • в разумный срок
  • Оператор вправе отказать в удалении
  • за исключением случаев, когда хранение необходимо Оператору
  • Оператор рассматривает обращение в течение 30 дней

Check your own contract

Paste a clause, a page or the whole document. Nothing leaves your browser: the matching runs here, on this page, against the phrases above.

Run the full scan on this document

Why it bites

Consent that is one click to give and a registered letter to withdraw is not consent; deletion promises that exclude 'backups', 'legal purposes' or 'derived data' leave everything in place; statutory deadlines (1 month EU, 45 days CCPA, 10 рабочих дней RU) are silently replaced.

Is it enforceable where you are

The same clause can be routine in one country and void in another. What follows is what the law says where you are — not advice on your particular contract.

In the EU and the UK, the GDPR governs the legal basis, the retention period and your right to erasure; in the US, state privacy laws (CCPA/CPRA and its successors) give an opt-out of sale and sharing.

United States

CCPA/CPRA: at least two request methods (toll-free number/web form), 45-day response, no fee, deletion with limited exceptions, no retaliation; FTC deception where deletion promises are false (1Health 2023, Amazon Alexa 2023).

  • Cited
  • CCPA
  • CPRA
  • FTC

European Union

GDPR Art 7(3): withdrawal as easy as giving consent; Art 12: free, within one month; EDPB Guidelines 03/2022 list obstructive withdrawal as a deceptive pattern; CNIL 2022 fines for asymmetric refusal paths.

  • Cited
  • GDPR Art 7(3)

United Kingdom

UK GDPR same; ICO right-of-access guidance: no fee (except manifestly excessive), one month; Consumer Rights Act 2015 for terms hindering rights.

  • Cited
  • Consumer Rights Act 2015
  • GDPR
  • ICO

Russia

Ст. 14 152-ФЗ: ответ оператора в течение 10 рабочих дней (продление до 5); ст. 9 ч. 2 — отзыв согласия в любой момент; ст. 21 ч. 5 — уничтожение в течение 30 дней после отзыва; РКН рекомендует отзывать тем же способом, каким давалось согласие; штраф за нарушение порядка ответа — ст. 13.11 ч. 4 КоАП.

  • Cited
  • 152-ФЗ
  • ст. 13.11 ч. 4 КоАП
  • ст. 21 ч. 5
  • ст. 9 ч. 2

Where this has actually happened

Regulator actions, court rulings and the contracts they were fought over.

  • FTC v. 1Health.io/Vitagene (2023) — deceived consumers about the ability to delete genetic data
  • FTC/DOJ v. Amazon Alexa (2023) — parents' deletion requests defeated, recordings retained
  • CNIL v. Google and Facebook (Jan 2022) — refusing cookies required several clicks vs one to accept
  • EDPB Guidelines 03/2022 on deceptive design patterns — impeding consent withdrawal

What to do

In order, from the thing that takes a minute to the thing that takes a letter.

  1. Send the request through the same channel you used to consent (RKN's position) and by email with a read receipt
  2. Cite the statutory deadline
  3. Escalate to the DPA/ICO/CPPA/РКН when the deadline passes — RU operator must respond within 10 рабочих дней and destroy within 30 days after withdrawal
  4. Screenshot the obstacle (fee, notarization, postal-only).

Check your own document

Traps that travel with it

Drafters who use one of these usually use several.

79 traps · 1789 verbatim clause phrases