I deleted my Facebook account in 2017 because I saw what was coming and I didn't like it. I didn't "deactivate" it, I deleted it, according to all the "are you sure?" prompts I recall wading through to get the final message that if I don't log into it in the next 30 days, it's all gone forever.

This morning I woke up to a 2FA email request from Facebook, to the email address I last used with the service. It was a legitimate email from FB so I decided to see if my account was really just deactivated instead of fully deleted. Welp, guess what? I logged in with the password stored in my password manager, and it sent me a new 2FA code. I continued all the way in, and absolutely nothing was actually deleted. All of my friends from that era who still had Facebook accounts were in my friend list, my last post from the summer of 2017 was still there, and many more sent before that, along with photos that I recall individually deleting before closing the account just in case.

Facebook lied. Imagine that.

Of course I immediately went through the whole deletion process again, confirming I was sure at least seven times, and got the same "if you don't log in over the next 30 days all posts are deleted and unrecoverable". Gee, where have I heard that before?

I will try logging in around the first of December just to see what happens. As for that first 2FA request this morning, clearly someone has my FB login info. I know there was a breach a few years ago but I wasn't concerned back then since like a good tech person I only ever used that password on that site (which I confirmed with my password manager), and besides I had deleted my account right? ...Right. And I know that even if they really "delete" it this time and I can't get back in, they still have my data forever.

So the moral of the story (and we all know this already, don't we?) is that all corporations; all data holders and harvesters; all social media companies; all entities trusted with our personal and financial data, are lying to us. They are all defying the law, they are all disregarding their own data retention, privacy, and security policies, and they know they can get away with it so they do it with impunity. I'm in the US so there are virtually no laws protecting my rights. But even in the EU, the GDPR is not enough. Facebook/Meta was recently fined nearly a quarter of a billion Euros over "right to be deleted" legislation, and they brushed it off like the minor inconvenience it was.