Glassdoor is a site which lets employees and ex-employees report anonymously on what it’s like to work at companies. It used to place a high value on user privacy, since people reporting bad stuff about their employers can get them into trouble. Recently, though, it’s not only reversed itself but, in a single bound, become one of the worst websites for privacy.

I’m unusually close to Report Zero on this matter, and I think the person making this report would rather not be too widely identified, so I’ll link only to secondary sources here, such as this Ars Technica article, checking them against the original reports for accuracy.

It started when M. sent Glassdoor an email to resolve a routine issue with an account. Without her consent, they took her name from the “From:” line and put it into her profile. It wasn’t made publicly visible, but the fact of its presence puts it at risk of acquisition by a data breach or government surveillance.

Worse, she was informed that the next time she logs into Glassdoor, an account will be automatically created for her on a second site called Fishbowl (a remarkably revealing name), and it will get all her profile information. To delete the Fishbowl account, she has to log into it with a phone number or work email and download an app.

When she objected, she was told point-blank that Glassdoor will not delete the information it added except (maybe) if she deletes her account, and probably not even then. A separate data erasure request is necessary. I strongly urge anyone with a Glassdoor account to do both as quickly as possible. See the bottom of this page for asking Glassdoor to delete the data that it added with or without your consent.

It could get even worse: Glassdoor’s terms of service now say: “We may update your Profile with information we obtain from third parties.” That removes just about all limits on what they can throw into your profile without asking you, whether it’s accurate or not. Flee. Fight your way onto the lifeboat.

Incidentally, as I’m writing this, Glassdoor is demanding that I “verify [I’m] a real person” before I can view the Terms of Service page. It didn’t do that to me the day before. That would require enabling JavaScript for Glassdoor, which at this point I’m not willing to do. I was able to access it through the Internet Archive.

I don’t know why Glassdoor did something so suicidally stupid, but they must have hoped that nobody would notice. They’ve lost that bet.