Digital Minimalism

How to delete old accounts you no longer use (2026)

November 6, 2026

14 min read

Copy Link

I made most of mine to get a discount code. Here is how I found them, how I closed them, and what I did about the ones that would not let me leave.

Quick answer. An account you stopped using is a live copy of your personal information sitting in a database you no longer look at. Deleting it is two separate jobs. First you find the accounts, which means searching your inbox and your sign-in lists rather than your memory, because your memory will hand you a list that is off by an order of magnitude. Then you work each account through its own exit, which ranges from a button in the settings menu to a formal deletion request with a legal deadline attached. The procedure below works on any service, whether or not the company wants you to leave.

Last updated November 2026. Legal details current as of 6 November 2026.

Your memory is the wrong tool for finding old accounts, and the four places that hold a better record
Why a company you left can still get you breached
A seven-step procedure for deleting any account, including the ones with no delete button
What California law requires once you ask, with the actual deadlines
What to do when deletion is refused or impossible

I wrote my accounts down from memory. Then I checked.

Before I started, I tried an experiment that I now recommend to everyone. I sat down with a blank page and wrote out every online account I could think of. I got to 31 and felt pleased with myself.

Then I searched my inbox for the word "welcome." The real number was in the hundreds.

That gap is not a personal failing. Yorba members hold an average of 246 online accounts, according to Yorba's 2024 State of Clutter report, and almost nobody can name more than a few dozen of theirs. The reason is that most accounts were never meant to be remembered. I made one to track a package. I made one to read an article. I made a great many to get 10 percent off a thing I bought once. I think of these as transactional accounts: a login created to complete one purchase, with no intention that it would outlive the purchase.

The company did not see it that way. From their side, every one of those logins is a customer record, and customer records are kept.

Is it actually risky to leave old accounts open?

I used to assume that an account I never logged into was inert. It is the opposite. The account you never log into is the one with the old password you reused everywhere, the saved card you forgot about, and the address from two apartments ago.

The breach record makes the case better than I can. The Myspace data that went up for sale in May 2016 covered almost 360 million accounts, and analysis suggested it had been taken around 2008 or 2009, years after most of those people had stopped using the site. Yahoo's 2013 breach affected all three billion of its user accounts, including every dormant one, and the full scale was not disclosed until October 2017. Under Armour disclosed in March 2018 that 150 million MyFitnessPal accounts had been exposed. And in 2024 a data broker called National Public Data confirmed that 2.9 billion records had been taken, filed for bankruptcy that October, and shut down in December, which tells you how much recourse the people in that database have.

As I write this, Have I Been Pwned lists 1,049 breached websites and nearly 17.8 billion breached email addresses. Some of those addresses are mine. Most of my entries are at companies I had not thought about in years.

Here is the principle that reorganized my thinking: you cannot be breached at a company you have left. Every other security measure, from a password manager to two-factor authentication, reduces the odds of a bad outcome at an account that still exists. Deletion removes the account from the set of things that can go wrong. It is the only measure that works retroactively, because it reaches back to decisions you made in 2011.

How do I find accounts I have forgotten about?

Your memory holds a few dozen. Four other places hold a better record, and I worked through them in this order.

Your inbox. This is the most complete source most people have, because nearly every account begins with a confirmation email. Search for "welcome," "verify your email," "confirm your account," "your account has been created," and "thanks for signing up." Work through the results and note every sender. Expect this to take a while. It is also the method Yorba automates, by reading the header data of your inbox rather than the message bodies and listing every company that has a registered relationship with you.

Your saved passwords. Open your browser's password manager, or your standalone one, and read the list of sites. This catches accounts that never emailed you. It misses everything you signed up for before you started saving passwords, which for me was most of the worst ones.

Your sign-in lists. If you have ever clicked "Sign in with Google" or "Sign in with Apple," those companies kept a list. For Google, go to myaccount.google.com/linkedapps, select "Sign in with Google," and read the apps. For Apple, open Settings on your iPhone, tap your name, then tap "Sign in with Apple," or sign in at account.apple.com and look under "Sign-In & Security." Facebook keeps a similar list in its settings. One warning, which Google states on its own help page: removing the link stops you signing in automatically, but it does not delete your data in the app. The account still exists. You have only removed the key.

Your breach record. Enter your email address at Have I Been Pwned. The results list which companies lost your data and roughly when. Every company in that list is an account you hold, or held, and a few will be ones you had completely forgotten.

When I finished, I had a spreadsheet of a few hundred rows. The next question was where to start.

Which accounts should I delete first?

I sorted by what the account holds, not by how easy it looked. Accounts with a saved payment method went first, then anything holding my home address or a photo of my face, then anything at a company that no longer appeared to exist, because a dead company's database is maintained by nobody and sold to anybody. Old social accounts came next, since they hold messages I did not write with an audience in mind. Anything attached to money I might need records of, such as a bank or a utility, I kept, and pruned the data inside instead.

How do I delete an old account, step by step?

This is the procedure I settled on after the first fifty. It works on any service, because it does not depend on the service being cooperative.

Get back in. Use the password reset if you have to. If the account is tied to an email address you no longer control, skip to step five, because you will be making a request rather than clicking a button.
Take what you want and remove what you do not. Download any data you care about. Then delete saved payment methods, clear the address book, and remove uploaded files. If the deletion later fails quietly, this is what protects you.
Look for the exit in settings. The wording varies: "Delete account," "Close account," "Deactivate," "Remove my data." Read the fine print under whichever you find, because deactivation usually suspends the login and keeps the record. You want the word "delete" or "permanently."
If there is no button, look it up. Search the company name plus "delete account," or check JustDeleteMe, a community-maintained directory that rates each service's deletion process from easy to impossible and links straight to the right page. If you would rather search a larger directory, Delete Desk does the same thing by company name.
If there is still no path, write to them. Use the privacy contact in the company's privacy policy, which in my experience is a dedicated address more often than you would guess. Keep it short and formal. I used a version of this: "I am requesting the deletion of my account and all personal information associated with [email address]. Please confirm when this is complete." If you live in a state with a privacy law, name it. The section below explains why that matters.
Write down the date you asked. Deletion requests fail quietly and constantly. The date is what lets you tell the difference between a company that is slow and a company that is ignoring you.
Watch for the confirmation, and watch for the mail. A legitimate deletion ends with a confirmation and then silence. If marketing email from the company keeps arriving weeks later, the record is still there, and you are entitled to ask why.

What does the law require a company to do when I ask?

This is the part that most guides either skip or get wrong, so I went to the regulators' own pages.

If you are a California resident, the California Consumer Privacy Act gives you a right to have a business delete the personal information it collected from you, and the business must tell its service providers to do the same. The California Privacy Protection Agency states the deadlines plainly: the business must confirm receipt of your request within 10 business days, and must substantively respond within 45 calendar days. It can extend that by another 45 days, to 90 in total, but only if it notifies you.

The law does not apply to every company. It covers for-profit businesses that do business in California and meet at least one threshold: gross annual revenue of $26.625 million or more, buying, selling, or sharing the personal information of 100,000 or more California residents or households, or deriving half or more of annual revenue from selling or sharing that information. Nonprofits and government agencies are generally outside it. And the rights belong to California residents only, which the California Attorney General's office states directly.

There are exceptions that let a business keep your data after you ask. The CPPA lists them: completing a transaction you started, providing a product or service you would reasonably expect, warranty and recall purposes, certain security practices, internal uses compatible with reasonable expectations, legal obligations, and the inability to verify your identity. So a company can legitimately keep a purchase record for tax purposes while deleting your marketing profile. What it cannot do is ignore you.

Other states have passed privacy laws with their own deletion rights, and the thresholds and deadlines differ from California's. If you live outside California, search your state attorney general's site for "consumer privacy" before you write your request, and name the law in the request. In the European Union and the United Kingdom, the GDPR's right to erasure is the equivalent lever.

Naming the law changed the response I got. The requests that cited a statute came back faster and with fewer questions. I do not think that is a coincidence.

What if the company will not let me delete my account?

Some will not. JustDeleteMe marks these as "impossible," and the label is usually accurate. Some companies have no delete function and no privacy contact. Some have shut down and left the database running.

When that happened, I did the next best thing, which is to make the record worthless. I changed the name to a string of letters, swapped the email address for an alias I could later turn off, removed the phone number, deleted the saved card, and removed every uploaded photo and file. The account still exists, but what it holds is no longer me.

Then I filed a complaint. Californians can complain to the CPPA about a business that ignores a deletion request. Anyone in the United States can report a company to the FTC. Neither will necessarily fix your individual case, but complaints are how enforcement priorities get set, and companies that ignore deletion requests are counting on nobody bothering.

How do I stop this from building back up?

I changed one habit and it did most of the work: I stopped creating accounts to buy things. Guest checkout exists on most stores. When a store insists on an account for a one-time purchase, I now treat that as information about the store.

The second change was a schedule. Accounts accumulate at a rate you do not notice, so a cleanup that is not repeated is just a snapshot. I check once a quarter. If you would rather not, this is the job Yorba does continuously: it scans your inbox for every company holding an account in your name, shows you the list, and lets you request deletion from there. For the companies that make leaving difficult, Yorba's deletion team handles the back and forth. Yorba is a Public Benefit Corporation with no outside funding and no ads, which is relevant when you are deciding who to hand inbox access to.

If you would rather do all of it by hand, the procedure above is the whole method. It cost me a Sunday. The spreadsheet has stayed short since.

Frequently asked questions

Should I delete accounts I do not use? Yes, with the exception of accounts holding financial or legal records you may need later. An unused account carries the same breach exposure as an active one and gives you nothing in return.

Does deleting an account delete my data? Not always. Many services deactivate the login and keep the record under a retention policy. A formal deletion request under a privacy law is the version with a legal deadline. Read the wording on the delete screen, and if you are in a covered state, make the request in writing as well.

What is the difference between deactivating and deleting? Deactivation suspends your login and keeps everything behind it, usually so you can come back. Deletion is meant to remove the record. Most services offer deactivation first and make you look for deletion.

How do I delete an account if I forgot the password? Use the password reset. If you no longer control the email address on the account, write to the company's privacy contact with whatever identifying details you have, and ask for deletion as a formal request.

How long does account deletion take? It varies by service and by law. Under California's CCPA, a covered business must respond within 45 calendar days, extendable to 90 with notice. Some services also impose their own waiting periods before deletion becomes final.

Does deleting an account stop the emails? It should. If marketing email continues weeks after a confirmed deletion, the record was not actually removed, and that is worth a follow-up request.

Does removing "Sign in with Google" delete the account? No. It only removes Google's role in signing you in. The account at the other service still exists and has to be deleted there.

What if the company has gone out of business? The database often survives the company. Anonymize whatever you can still access, change any password you reused, and file a complaint with your state regulator or the FTC.