Google To Begin Deleting Inactive Accounts as Early as December

Google users with older accounts could risk losing their data beginning Dec. 1. That’s when Google is moving ahead with its plan to delete accounts that have been inactive for at least two years.

In May 2023, Google announced the new policy. It is intended to prevent security risks. The site shared that older accounts are more likely to rely on recycled passwords. They are also less likely to employ up-to-date security measures like two-step verification. This makes these accounts vulnerable to phishing, hacking, and spam issues.

When an account is compromised, “it can be used for anything from identity theft to a vector for unwanted or even malicious content, like spam,” the company said in its statement in May. The new Google policy will begin by eliminating accounts that users created and then never used again. 

“We want to protect your private information and prevent any unauthorized access to your account even if you’re no longer using our services,” Google wrote in an August policy update, according to CNN.

“Starting later this year, if a Google Account has not been used or signed into for at least 2 years, we may delete the account and its contents — including content within Google Workspace (Gmail, Docs, Drive, Meet, Calendar) and Google Photos,” Ruth Kricheli, Google’s vice president of product management, stated.

However, the new policy only applies to personal Google accounts. Business accounts will not be affected.

The company’s updated account policy shows that Google will also not remove accounts that have uploaded YouTube videos or have active subscriptions to apps or news services. Users will receive notifications that their affected accounts will be terminated before the policy rolls out beginning Dec. 1.

Before deleting, Google will go through a checklist to ensure that a user’s account is active. Ways to ensure this include signing into the email, using Google Drive, watching a YouTube video, downloading an app on the Google Play store, using Google Search, or using Sign in with Google to access a third-party app or service.

“By proactively removing these accounts, Google effectively shrinks the attack surface available to cybercriminals,” Oren Koren, CPO and co-founder of cybersecurity firm Veriti, told CNN. “This action by Google exemplifies a broader trend in cybersecurity: taking preemptive steps to strengthen overall digital security landscapes.”