Closing an account is rarely as final as it sounds. Companies hide delete buttons, add waiting periods and keep backups, and some data has to be kept by law. Meanwhile an account you’ve stopped using still holds your details and can still be breached.
This page explains the difference between deactivating and deleting, why old accounts are a risk, what you can ask companies to do, and what deletion can’t undo. It doesn’t give step-by-step instructions for individual services, because menus change often. It gives the principles and points to where the current steps live.
The cheapest deletion is the account you never made. Account creation covers how to avoid that work in the first place.
What deleting means, in plain terms
There are three different outcomes, and services often blur them.
Deactivation hides your profile but keeps your data. You can return by logging in. Deletion is meant to remove the account and its contents, but it often comes with a delay. Even after deletion, some information can remain in backups or in records the company must keep.
Facebook shows how this works. Deactivating hides your profile temporarily. If you delete, Meta says you have 30 days to cancel by logging back in, after which the account and its information are deleted. It can take up to 90 days from the start of the process to remove everything, and copies may remain in backup storage afterwards. Those are Meta’s published terms and may change.
App stores draw the same line. Google Play’s policy says temporary deactivation, disabling or “freezing” an app account doesn’t count as account deletion.
Why old accounts are a risk
Privacy Guides makes the point that dormant accounts are vulnerable to data breaches. A forgotten account usually has an old password, often one you reused, and probably no second login step. Nobody is watching it for alerts either. In Google’s account hijacking study, most attacks came from automated bots trying passwords exposed in other breaches, which is exactly how a forgotten account gets taken over.
The record itself is also a target. The FBI’s Internet Crime Complaint Center received 67,456 personal data breach complaints in 2025, according to reporting on its annual report. That is US data covering only filed complaints.
Companies have noticed the risk. Google announced in 2023 that personal accounts left unused for two years could be deleted, starting that December, and cited security as the reason. You can keep an account alive by signing in at least once every two years, and Google’s Inactive Account Manager lets you decide what happens to your data if you stop. A policy like this shows that an unused account doesn’t stay harmless.
What the law may let you demand
In the European Union and European Economic Area, Article 17 of the General Data Protection Regulation (GDPR) gives people a right to erasure. It applies to services that serve European users wherever the company is based, a point Privacy Guides stresses. The right is qualified, not absolute. It applies on certain grounds, and a company can refuse for specific reasons, including legal obligations to keep records such as tax and anti-money-laundering data. Companies generally have one month to respond, extendable by up to two more for complex requests.
Privacy Guides adds practical advice. Read the privacy policy, because some “Delete account” buttons only disable the account and real deletion needs another step, such as an email to the company’s data protection officer. If you plan to rely on GDPR rights, don’t overwrite your details first, since the company may need to confirm who you are or where you live. If a company ignores a valid request, you can complain to your national data protection authority.
Other countries and some US states have their own laws, and we couldn’t summarise them all. Bangladesh passed a Personal Data Protection Act in 2026, but we couldn’t verify whether it includes an erasure right or when its provisions take effect.
Even without a privacy law, app stores give you leverage. Apple has required apps that let you create an account to let you delete it inside the app since June 30, 2022. Google Play requires apps with account creation to let users request deletion in the app and through a web link. Both rules cover only apps distributed through those stores.
Why deleting is often harder than signing up
Privacy Guides notes that account deletion is often made difficult by deceptive design. The clearest legal example involves subscriptions, not accounts. In September 2025 Amazon agreed to pay $2.5 billion to settle US Federal Trade Commission (FTC) allegations that it enrolled people in Prime through manipulative design and made cancelling hard. The FTC cited a path of four pages, six clicks and 15 options, according to a former commissioner. Amazon denied wrongdoing. The settlement requires a cancellation route as easy as the sign-up route.
That case isn’t about deleting accounts, but it shows that regulators treat obstructive exits as a problem. The rules are still moving. The FTC’s 2024 “click to cancel” rule was struck down in July 2025, so protections vary by country and by product.
What deletion can’t undo
Even a successful deletion leaves some traces.
- Backups can hold copies for weeks. Meta’s published terms allow this after its 90-day process.
- Some companies are required by law to keep records, particularly of financial transactions, as Privacy Guides notes.
- Copies may exist elsewhere. Web archives such as the Internet Archive and other caches can hold earlier versions of public pages.
- Data already shared or sold stays with whoever received it.
- Other people may have screenshots or copies of what you posted, which is our own observation.
What can go wrong when you delete
Deleting has its own risks, and some are hard to reverse.
Linked sign-ins break. Consumer Reports advises backing up your data and setting up new credentials for services where you used Facebook Login before deleting. Your email account is the same kind of dependency, because other accounts use it for recovery. Delete it last.
Logging in during a grace period can cancel the deletion, so stay logged out once you’ve asked. Download anything you want to keep first. Check billing separately, because closing an account doesn’t always stop a subscription.
Finding accounts you have forgotten
Your password manager is the easiest place to start, and some include breach reports that flag exposed logins. Browsers and phones also save passwords, often without people realising, and desktop systems have their own credential stores.
If you never used a password manager, search your email for words such as “welcome” and “verify”, because nearly every service sends one when you sign up. Privacy Guides suggests trying “forgot password” for any account you can’t log in to. If the site says no account exists for that address, or no reset link arrives after several tries, try a different address. Have I Been Pwned can also show which known breaches include your email address and alert you to future ones.
Privacy Guides points to JustDeleteMe, a community directory of deletion instructions for specific services. Some services let you delete in one click, others make you contact support, and a few don’t allow deletion at all.
A sensible order
How far to go depends on what’s at risk, which threat modeling helps you judge. These steps run from most to least useful.
- Start with accounts that hold sensitive data or payment details. They cost the most if breached.
- Download anything you want to keep before you delete.
- Delete each account, or request deletion under the law where you live. Keep a note of the date, since a GDPR response is due within a month.
- For an account you can’t delete, follow Privacy Guides’ fallback: replace your details with false ones, turn on every security option, and set a long random password. It reduces exposure but isn’t a guarantee, because backups may hold the originals.
- Check subscriptions and billing, and delete your email account last.
Sources
- Account Deletion, Privacy Guides, 2025.
- Deactivating or Deleting Your Account, Facebook Help Center, as reproduced in a 2022 copy and checked against Consumer Reports below.
- How to Delete or Deactivate Your Facebook Account, Consumer Reports, accessed October 2026.
- GDPR Right to Erasure: Article 17, Presencis, accessed October 2026.
- What is the GDPR right to be forgotten?, Usercentrics, accessed October 2026.
- Apple Reminds Developers to Add Account Deletion Option for Apps by June 30, iPhone in Canada, 2022.
- Understanding Google Play’s app account deletion requirements, Google Play Console Help, accessed October 2026.
- App Account Deletion Requirements: What Apple and Google Actually Check, QAwerk, accessed October 2026 (quoting Google’s policy).
- Google will start deleting inactive accounts later this year, Popular Science, 2023.
- Google will start deleting ‘inactive’ accounts in December. Here’s what you need to know, Associated Press via KMPH, 2023.
- Amazon pays $2.5B settlement over deceptive Prime subscriptions, Malwarebytes, 2025.
- FTC Reaches Record $2.5 Billion Settlement with Amazon over Prime Subscription Practices, Alston & Bird, 2025.
- Subscription cancellation dark patterns, Chargebee, accessed October 2026.
- New research: How effective is basic account hygiene at preventing hijacking, Google Security Blog, 2019.
- 2025 Losses to Cybercrime Exceeded $20 Billion, HIPAA Journal, 2026 (reporting FBI IC3 data).
- Get Breach Notifications, Have I Been Pwned, accessed October 2026.
- What is Personal Data Protection Act, 2026 (Act No. 63)?, OfflistMe, 2026.