Anonymizing Users in Discourse

You can delete your own account, as long as you have only 1 post or less. This is not configurable at the moment.

https://github.com/discourse/discourse/blob/2ef16d0719e90b9eaba917c02cf1b0d643485fa2/lib/guardian/user_guardian.rb#L41-L48

10 Likes

No, you can’t undo this anonymizing.

You can restore a backup made before the destructive action.

12 Likes

Is it possible to pass anonymize_ip parameter via http api call to /admin/users/{id}/anonymize method?

It is currently not possible, as this was considered a power feature that should be approached with caution.

5 Likes

Hello.
Do we have an opportunity to do this action via API?

Yes, any action that can be performed through the UI can be performed throuth the API. Have a look at How to reverse engineer the Discourse API for details about how to find the correct route to call.

6 Likes

Is this user also anonymized since he has the “anon” :roll_eyes::roll_eyes:

1 Like

… Yes users who begin with anon seem pretty anonymized to me. Its a genreral pattern :slight_smile:image

3 Likes

I suppose there might be a remote possibility that a member gave themselves such a username, as unlikely as that would be.

If in doubt, look for an “@example.com” email address.

7 Likes

Are you sure about that? Pretty sure anonymized users have a @anonymized.invalid email address.

6 Likes

Not 100% I’m going by what I know (obsolete or otherwise :blush: ) and have not recently retested this on localhost i.e. this account anonymized 2 years ago

2 Likes

Yeah, that very likely changed with all the updates to anonymization. .invalid is a domain we use for emails that should never be emailed. Yes, no one will receive emails sent to example.com, but better to not send them at all.

8 Likes

Ah yes, this account was anonymized summer 2018

I’m assuming that running some type of (pseudo)
UPDATE email SET email '/1@anonymized.invalid' WHERE email LIKE '%@example.com'

query could be a good idea. If anyone has run such a command with success I would appreciate knowing what it was.

5 Likes

Why is this only available for developers? If the option is there, why not make a button for it?

I tried this:

cd /var/discourse
./launcher enter app
rails c

And then

user = User.find_by_username("username_of_the_user_here")
UserAnonymizer.make_anonymous(user, nil, anonymize_ip => '0.0.0.0')
user.save!

But it doesn’t do anything. Can someone help me? I am just an admin who wants to comply with the GDPR and anonymize the IP-addresses of a user who asked me to.
But I can’t find any documentation on how to do this.

1 Like

It’s a drastic operation and we want to make sure people integrate it into their existing systems with care and thought. People should make sure it matches their own organization’s standards for GDPR compliance.

As for your code, you needn’t call user.save as the anonymizer class does that for you. The code should still work though. How did you confirm that it did not?

5 Likes

Thank you for your reply!

Sorry, I didn’t press enter enough times after the first statement. (So I already entered the second statement while the first one was being executed). However, when I do press enter enough times, I run into this error:

So I changed it to this:

UserAnonymizer.make_anonymous(user, nil, {anonymize_ip: "0.0.0.0"}) 

And now it works!

3 Likes

Here’s a fully prepped form for others:

UserAnonymizer.make_anonymous(User.find_by_username_or_email("=USERNAME="), nil, anonymize_ip: "0.0.0.0") 
13 Likes

We’re having a first request to anonymize an account on our forum and I just tested the effects on a sandbox instance.

Username on post and mentioned before anonymizing:
Screenshot from 2020-12-05 20-52-53

After anonymizing:
Screenshot from 2020-12-05 20-54-02

Shouldn’t the mentions also be anonymized? The original announcement says so.

Edit: looks like it didn’t work because I had this test user mention themselves on their own post. On other users’ posts it works.

5 Likes

Yes they should.

Nice catch!

10 Likes

Also saw that anonymized users can still be messaged, suggesting there’s still someone responding to the profile:

5 Likes