# Delete Old Online Accounts: An Order of Work

Delete old online accounts safely: how to find yours, what to export first, which to close or rewrite, and what to do when there is no delete button.

---


To delete old online accounts safely, build a list of every account tied to your email address and phone number, export anything you want to keep, remove the links between accounts, and only then close each one, starting with the accounts that hold the most personal data or can unlock other accounts. Where a service has no delete button, a written request under a privacy law is the next route. Closing an account protects your name because it shrinks what can be found, reused or taken over.

Most people hold far more accounts than they remember. A forum login from a decade ago, a fitness app, a store account made to get a discount code, a profile on a site that no longer updates: each one stores a name, an email address and often a birth date, a phone number or a photo. Each is also a password that may be reused, and a page that may appear in search results for your name. 

This guide is written from the protective side. It covers only your own accounts, and it does not explain how to find or enter anyone else's. It gives the order of work, a decision table for what to close, keep or rewrite, the steps when a service makes deletion hard, and a realistic timeline. Rules are described as of the official pages named beside them; check the live version before you act. This is information, not legal advice.

<div class="box"><b>The short version</b>
<ul><li>Find the accounts first, using your password manager, your inbox, your phone and the "sign in with" pages of your main accounts. Do not start deleting from memory.</li><li>Export what you want to keep, unlink the account from others, and change or note the password before you close it. Deletion cannot be undone.</li><li>Close the accounts that hold sensitive data or can reset other accounts first. Rewrite, rather than delete, public profiles that still matter.</li><li>If a service has no delete option, send a written deletion request under the law that applies to you and keep a dated copy.</li></ul></div>

## Why old accounts put your name at risk

An old account exposes you in three separate ways, and each one needs a different fix. The first is visibility: a public profile, a review, a comment history or a username that links back to your name can appear when someone searches for you. The second is access: an account you no longer use may share a password or an email address with one you do, and the weakest account becomes the way into the strongest. The third is data: the company behind the account still holds your details, and if it is breached, they leave with the rest of its customers.

The third risk is the one people underestimate: a service you stopped using years ago can still be breached, and you will not hear about it unless you are watching. Have I Been Pwned lets you check whether an email address or username appears in known breaches. Its <a href="https://haveibeenpwned.com/FAQs">FAQ</a> says you search one address at a time, individual searches are free, and the site does not load passwords alongside breached addresses. Treat each result as a pointer to an account you may have forgotten.

Fewer accounts also shrinks what a journalist, an employer or a business partner can find. An abandoned profile with an out-of-date job title or a careless comment is part of what they see. The records that data brokers hold are a different problem with their own route; this guide stays with the accounts you opened yourself.

## Which accounts to close, keep or rewrite

Not every old account should be deleted. The right action depends on what the account holds, who can see it and whether it can open anything else.

<div class="tablewrap"><table><thead><tr><th>Account type</th><th>Main risk</th><th>Usual action</th><th>Priority</th></tr></thead><tbody>
<tr><td><strong>Old email addresses</strong></td><td>Password resets for other accounts</td><td>Keep if still linked to anything; secure it, then migrate and close last</td><td>Highest</td></tr>
<tr><td><strong>Shopping and payment accounts</strong></td><td>Stored cards, addresses, order history</td><td>Remove saved cards, then delete</td><td>High</td></tr>
<tr><td><strong>Social profiles, active years ago</strong></td><td>Old posts, photos, tagged locations</td><td>Review, then delete or lock down</td><td>High</td></tr>
<tr><td><strong>Forums, comment sections, reviews</strong></td><td>Username that links back to you</td><td>Delete the account, then ask for posts to be removed or anonymized</td><td>Medium</td></tr>
<tr><td><strong>Fitness, health and location apps</strong></td><td>Routes, routines, health data</td><td>Export if wanted, then delete with data</td><td>High</td></tr>
<tr><td><strong>Professional and portfolio profiles</strong></td><td>Outdated facts that rank for your name</td><td>Rewrite and keep, or delete if the platform is dead</td><td>Medium</td></tr>
<tr><td><strong>Domains, hosting, website builders</strong></td><td>Ownership records, abandoned pages</td><td>Renew, redirect or close deliberately; never just let lapse</td><td>High</td></tr>
</tbody></table></div>

The old email address is the one you close last, because deleting it before the accounts that depend on it can lock you out of them. A domain or website is not a login you can simply drop: if it lapses, someone else can register it and publish under what used to be yours. Decide what happens to it, then act.

## How to find every account you have

Finding the accounts is the hard part, and no single source is complete, so work in layers, using only your own devices and inboxes.

<figure class="fig">
<figcaption><b>Building your account inventory</b></figcaption>
<ol class="fig-steps">
<li><b>Open your password manager</b>Export or list every saved login. Browsers keep a similar list under saved passwords. These are the accounts you used on purpose.</li>
<li><b>Search your inbox</b>Look for phrases such as "welcome", "verify your email", "confirm your account" and "your receipt". Check each email address you have ever used, including old school or work addresses you can still open.</li>
<li><b>Check the sign-in links</b>Review the "sign in with" connections on your main accounts, and the list of apps with access to them. These show accounts that never created a password at all.</li>
<li><b>Look at your phone and payment statements</b>List installed and previously downloaded apps. Scan card and bank statements for subscriptions and old trials.</li>
<li><b>Run your addresses through a breach checker</b>Search each of your email addresses and usernames. Every breach named is a company that holds, or held, an account of yours.</li>
<li><b>Write it all in one list</b>Record the service, the login used, the date last used, what it holds and whether it is linked to anything. Add to it as you find more.</li>
</ol>
<p class="fig-src">Steps use only your own devices, inboxes and statements. No step involves another person's account.</p>
</figure>

The sign-in links step is the one most guides skip. Google's help page on <a href="https://support.google.com/accounts/answer/13533235">linked apps</a> says that if you delete a link, Google stops automatic sign-in to the app, and that this "doesn’t delete your data on the app". Unlinking is a preparation step, not the finish.

## What to do before you delete anything

Deletion is permanent on most services, so run these checks on each account you intend to close, in this order.

First, decide whether anything in it is worth keeping: photos, messages, purchase history, a record you might need for tax or warranty. Use the service's export option and store the file somewhere you control. Second, check whether the account is the sign-in for something else, and move that to another login first. Third, remove stored payment methods and cancel any subscription, because deleting an account does not always stop a recurring charge.

Fourth, and the step people forget: change or note the password and turn on a second step for any account you keep. The UK's National Cyber Security Centre describes two-step verification as a "second step" that only you can access, recommends it for your high-value accounts, and singles out email because criminals with access to your inbox can use it to reset passwords on your other accounts. Its <a href="https://www.ncsc.gov.uk/guidance/setting-2-step-verification-2sv">guidance on 2-step verification</a> also says backup codes work only once and should be stored somewhere secure, and that many services let you set up more than one second step as a fallback.

<aside class="callout">
<span class="callout-label">Rule</span>
<h4>Export first, delete second, in that order</h4>
<p>A deletion button rarely asks twice and almost never offers an undo. If there is anything in the account you might need in a year, take it out before you click.</p>
</aside>

## Delete, deactivate or anonymize: what each really does

Services use "delete" for several different actions, and the difference decides whether your name leaves the site. Deactivation hides the profile but keeps the data, so you can come back; it is wrong if the goal is to remove your details. Deletion removes the account and, per the service's policy, its data, sometimes after a waiting period. Anonymization, used by some forums and review sites, keeps your posts but detaches your name, which removes the link to you but not the words. Check the help page for the waiting period, for what happens to your posts, and for records the service keeps for legal or security reasons, which is usual and lawful.

The <a href="https://support.google.com/accounts/answer/3036546">Inactive Account Manager</a> page for Google accounts says that, if you set no plan, Google may delete an account and its data after it has been inactive across Google for at least two years, that deleting an account affects all linked products, and that a deleted Gmail username cannot be reused. The same page lets you name up to 10 trusted contacts and choose what each receives, so set a plan rather than rely on the default.

<figure class="keyfacts">
<div class="keyfacts-grid">
<div><b>45 days</b><span>the time a business covered by California law has to answer a deletion request</span></div>
<div><b>90 days</b><span>the longest that response can take if the business tells you it needs more time</span></div>
<div><b>2 years</b><span>the inactivity after which Google says it may delete an account if no plan is set</span></div>
</div>
<p class="fig-src">Sources: the California Attorney General's CCPA page (response time) and Google's Inactive Account Manager help page (inactivity period, which the page words as Google reserving the right to delete). Both read for this guide and described as of that reading.</p>
</figure>

## When a service has no delete button

Some services hide the option or offer only deactivation. Search the help center for "close account", "delete my data" or "privacy request". If there is no self-service option, find the contact for data requests in the privacy policy and send a short, dated message from the email address on the account.

A good request names the account by the login you used, asks for the account and its personal data to be deleted, says which law you rely on if you know it, and asks for written confirmation. Keep a dated copy. Send identity documents only if the business has explained why it needs them and how it will protect them.

### Your rights depend on where you live

In the European Union, the right to erasure is set out in Article 17 of the GDPR. It requires erasure without undue delay when, for example, the data is no longer necessary for its original purpose, you withdraw consent and there is no other legal basis, or the data was processed unlawfully. It also lists exceptions, including freedom of expression and information and the defense of legal claims. The right is real but not absolute. Check the equivalent rule if you live elsewhere.

In California, the Attorney General's <a href="https://oag.ca.gov/privacy/ccpa">CCPA page</a> says residents can ask businesses to delete personal information collected from them. Businesses must respond within 45 calendar days, and may extend by another 45 if they tell you. Businesses must designate at least two ways to submit a request (a business that operates only online need offer just an email address), cannot make you create an account just to make one, and are not required to delete in every case: the page lists exceptions, including complying with legal obligations and exercising or defending legal claims. The law applies only to businesses that meet set thresholds, so a small operator may fall outside it. Other US states have their own laws, and some places have no general deletion right, in which case the platform's own policy is what you have.

<aside class="callout">
<span class="callout-label">Limit</span>
<h4>A deletion right removes the data the business holds, not every copy</h4>
<p>It does not reach screenshots, archives, search caches or posts that other people made about you. Those need their own routes, and some may not be removable at all.</p>
</aside>

## What to do with accounts you can no longer reach

The commonest blocker is a login lost with an email address that no longer exists. Start with the password reset, because you may still receive mail at the old address. If not, look for the service's account-recovery form, which may accept other proof such as a payment record. If the old address was on a domain you owned or belonged to an employer or school, the registrar, provider or an administrator may reopen it. When recovery fails, tell support you cannot sign in and ask for deletion instead of access. If a service refuses and a privacy law covers you, send a written request to its privacy contact, then complain to the regulator if it is ignored.

Never pay a third party to "recover" an account, and never hand a stranger your email password to do so. If the service is defunct, the account may no longer matter, but change the password everywhere you reused it.

## Public profiles to rewrite instead of delete

Search engines and AI assistants read old professional, social and directory pages and use them to describe you. Deleting a stale profile is often right, but on an active platform a rewrite can serve you better than a gap.

The test: keep and update a profile if the platform is still in use and the facts can be made current and accurate. Delete it if the platform is dead, the details cannot be made accurate, or it shows something you would no longer choose to publish. Where several profiles repeat the same outdated facts, close the weakest and update the strongest.

A deleted page can stay in a search result or cache for a time, and archive services may hold a snapshot. If it still appears for your name weeks later, use the search engine's removal tool for outdated content or its personal information request. Search your name and usernames from a private window to see what remains.

## A worked scenario, with a realistic timeline

This is an invented scenario with a generic person, to show how long the work takes and how the list divides.

A consultant sits down on a Saturday and builds an inventory from a password manager, two inboxes and the sign-in pages of three main accounts. She finds 61 accounts. Her sort gives 14 to keep untouched, 9 to keep and tidy, 31 that can be deleted from a settings page, 5 that need a written request and 2 she cannot reach. Those add up to 61. If she assumes about 10 minutes for each of the 31 self-service deletions, that is about 310 minutes, a little over five hours, spread across the weekend. The 9 keep-and-tidy accounts take perhaps 15 minutes each, which is about two hours and fifteen minutes. The written requests take an evening to draft, then waiting.

<div class="tablewrap"><table><thead><tr><th>When</th><th>What happens</th><th>Outcome to check</th></tr></thead><tbody>
<tr><td><strong>Day 1</strong></td><td>Build the inventory; secure the main email; turn on a second step there</td><td>One list, every account rated</td></tr>
<tr><td><strong>Days 2 to 3</strong></td><td>Export what matters; unlink; delete the self-service accounts</td><td>Confirmation emails saved</td></tr>
<tr><td><strong>Week 2</strong></td><td>Send written requests for accounts with no delete option; rewrite kept profiles</td><td>Dated copies of each request</td></tr>
<tr><td><strong>Weeks 3 to 6</strong></td><td>Follow up on replies; try recovery for unreachable accounts</td><td>Replies logged on the list</td></tr>
<tr><td><strong>Day 45 to 90</strong></td><td>Where a law gives a response limit, check it against your request dates; escalate to the regulator if ignored</td><td>Each request closed or escalated</td></tr>
<tr><td><strong>Month 3 and after</strong></td><td>Search your name and usernames again; re-run the breach check; close the old email last</td><td>Nothing unexpected remains</td></tr>
</tbody></table></div>

The timeline is an estimate, not a promise: some services answer within days, others take the full legal period. The last row exists because a removed account can return as a newsletter subscription, a guest-checkout profile or a stale search result.

## Keeping the list small and responding to misuse

Use a separate email address for sign-ups and trials you expect to abandon. Use a password manager so each account has a unique password, and note the date you opened it. Decline the "sign in with" shortcut where you would rather have an account of your own. Once a year, repeat the inventory in an hour rather than a weekend.

For executives, founders and public figures, an account tidy is one layer of a wider review of what search engines and AI assistants show for a name. Reputation Partners offers the free <a href="/page-one-score">Page One Score</a> as a quick self-check of page one. It does not replace the work above, which only you can do on your own accounts.

If a forgotten account has been taken over, or a breach notice names an address you still use, treat it as live: change the password on it and on any account that shared it, turn on a second step, check the recovery email and phone attached to it, and tell the service.

<div class="box hot"><b>If this is happening to you now</b>
<p>If an old account has been misused, or an old profile is feeding your search results, do the urgent part first: secure your main email and change shared passwords. If you want a second pair of eyes on what is visible under your name, request a private review and we will tell you what to close, keep or correct. <a href="/audit">Request a private audit</a>.</p></div>

## Questions people ask

### Will deleting an account remove my name from search results?

Not immediately. Deleting removes the page from the site, but a search engine may keep showing the old result until it refreshes, and cached or archived copies can persist. Search for your name and usernames a few weeks later. If an outdated result remains, use the search engine's removal tool for pages that no longer exist or a personal information request.

### What if the service ignores my deletion request?

Send a second written request, quote the date of the first, and cite the privacy law you are relying on if one applies to you. Where the law sets a response time, note when it runs out. If the business is still silent, complain to the relevant data protection regulator or state authority. Keep every message and date.

### Should I delete my old email address?

Only after everything linked to it has moved or closed. Many accounts rely on an old address for password resets, so deleting it first can lock you out of the rest. Secure it with a strong password and a second step, move your accounts to a current address, wait, then close it last. Check the provider's inactivity rules too.

### Does a deletion request cover posts I made on forums and reviews?

Sometimes. Depending on the service and the law, posts may be removed, left in place with your name detached, or kept because other people's replies are attached to them. Read the service's policy before you delete the account, and ask in your request what happens to posts. In the EU, the exception for freedom of expression can apply.