Ashley Madison faces proposed class-action suit over half-deleted data

A proposed class-action suit has been filed [PDF] in California on behalf of Ashley Madison users who had their personal information leaked, including those who paid the site a fee for a “full delete” of their data.

After a breach of the site's database, people combing through the information found that Ashley Madison and other properties owned by parent company Avid Life Media (ALM) had retained quite a bit of information pertaining to users who purchased a “full delete” of their profile for $19, including GPS coordinates, date of birth, gender, ethnicity, weight, height, among other details. Although e-mail addresses, phone numbers, and descriptions written by users who sought “full deletes” were eliminated by the time the hackers accessed the database, the incidental data that Ashley Madison kept on those users could still paint quite a picture. The Register has a table that nicely illustrates what information Ashley Madison kept on “deleted” users and what it actually deleted.

In addition, when Ars investigated the “full delete” option on Ashley Madison a year ago, we found that there was little difference between a “full delete” and the “hiding your profile” option, except that messages that a user sent to another user would be deleted if exiting users paid the fee.