Delete the Old Accounts You Forgot You Had Before They Leak Your Data

Delete Old Accounts: Your Forgotten Logins Are a Liability

You have accounts you forgot about. Everyone does. The shopping site you used once in 2019. The forum you joined to ask one question. The streaming trial you cancelled but never deleted. Each one holds your email, probably your name, maybe your address, and very likely a password you reused somewhere else. Every one of them is a breach waiting to happen, and you cannot protect accounts you do not remember exist.

This is not a theoretical risk. Breaches hit forgotten services all the time, and the data from those breaches feeds the credential-stuffing attacks that break into your current accounts. The attacker does not need your bank password. They need the password from a dead forum you joined a decade ago, because there is a good chance it is the same one. Deleting old accounts is the single most effective privacy chore most people never do, and it takes an afternoon.

Step 1: Find Them All

Start with your password manager if you have one. Open it and scroll through the full list. You will be surprised. Most people find 50 to 100 logins they forgot, and a chunk of them are for services that no longer exist or that they have not touched in years. If you do not use a password manager, your browser's saved passwords are the next best list. Export them, sort them, and work through them.

Then search your email. Search for the words "welcome", "verify your account", "confirm your email", and "thanks for signing up". These messages are the fossil record of every account you ever created. Work through the results in batches, and add anything unfamiliar to your list. If you have old email addresses you no longer use, check those too, or accept that anything tied to a dead inbox is already lost and move on.

Finally, check your social logins. Google and Apple both have pages showing which apps and services you signed into with their buttons. Facebook does too. These lists are often the most revealing, because one-click signups are the easiest to forget. Revoke access for anything you do not recognize or no longer use.

Step 2: Decide What Goes and What Stays

Not every old account needs to die. Sort your list into three piles.

Delete now: shopping sites with saved payment cards, services that hold your address or ID documents, social accounts you never use, and anything from a company that has already been breached. These are the highest risk, and keeping them buys you nothing.

Keep but lock down: accounts tied to services you might need again, like a government portal or a professional tool. For these, change the password to something unique, turn on two-factor authentication, and remove saved payment methods. If you have not already, read our guide on removing personal data from data brokers to cut off the other end of the same problem.

Leave alone: accounts for services that shut down years ago, where there is nothing left to delete. If the company is gone, your data is gone with it, or it is already in a breach database and deleting the account changes nothing. Do not waste time on ghosts.

Step 3: Delete Them Properly

Deleting an account is rarely one click. Most services hide the option three menus deep, and some require an email to support. That is deliberate, and it is annoying, but it is still worth doing. Start with the account settings page and look for "delete account", "close account", or "deactivate". Deactivate is not the same as delete. Deactivation hides your profile. Deletion removes your data, or at least starts the process.

Before you delete anything, download your data if it matters. Photos, purchase history, messages, anything you might want later. Most services offer a data export, usually under privacy settings. Grab it, then delete.

If a service will not let you delete your account, email their privacy team and cite your local data protection law. In the EU, the GDPR gives you a right to erasure. In California, the CCPA gives you a right to delete. Even outside those regions, most companies will comply with a written deletion request, because refusing one is more trouble than granting it. Keep a note of what you requested and when, in case you need to follow up.

Step 4: Stop the Next Pile From Growing

Deleting old accounts is a cleanup. Keeping them from piling up again is a habit. Three rules will do it.

First, stop creating accounts for one-time use. If a site lets you check out as a guest, do that. If it demands an account for a single download, ask yourself whether you need the download. Most of the time you do not.

Second, use Sign in with Apple or Google where you trust the service, because those logins are easy to audit and revoke later. But audit them. The app permissions audit we published is a 15-minute job that pairs well with this cleanup.

Third, do this once a year. Put a reminder in your calendar for the same weekend every year. The pile grows slowly, and an annual pass keeps it small. If you ever do get caught in a breach, our guide on what to do after a data breach walks through the recovery steps calmly.

Old accounts are not harmless clutter. They are copies of your identity sitting on servers you do not control, protected by passwords you do not remember, owned by companies you forgot existed. Deleting them is the cheapest security upgrade there is, and the only cost is an afternoon.