Cool cool, now realistically, do you have the time, resources and know how to find and contact every owner of every federated instance these comments have made to? Would you be able to deal with the legal resources of any number of jurisdictions to truly test whether that is actually enforceable?

My point basically is that it’s functionally impossible regardless of what the law says, and you should treat your comments and personal information as such that they won’t ever be able to be deleted or scrubbed.

Except that only applies to federated servers that exist in the EU. If your data gets federated out to a country outside of the EU, they don’t have to listen to your whines of GDPR as it’s not enforceable. And given that you could be federated with hundreds of instances across the world, good luck.

I said the same thing with AI scraping. All someone needs is to add their own instance that federates with everyone else and they can scrape data for AI training till their heart’s content.

What makes it a “smash”-burger? I’ve always been curious.

And guess what, it can be done just as easily, if not, more easily on a federated instance. You don’t gain at real additional control over your data (and no putting “covered under license X” is about as realistic as those Facebook posts saying “I don’t give anyone access to my posts”).

I’ve said this before and I’ll say it again, realistically the only way to control your data from AI is a DRM type solution which everyone fundamentally hates.

Well, number 3 is an image I won’t be able to unthink….

You can use federated SSO. The remote site never sees your credentials but only a token that you’ve been authenticated against your home instance.

That being said, that’s probably the problem, in order to do federation a small degree of trust is required between the two instances. I guess that is already done with activityPub since you’re getting content from remote instances.