Removing Old Accounts

[This is a multi-part series. Start here.]

We’ve come a long way – and we’re at the finish line! We discussed why finding old, forgotten accounts is important, we learned several ways to find all of our online accounts, and we’ve made sure they were secure. There’s only one step left in our Data Diet: it’s time to delete the old accounts we no longer need – or at the very least minimize the data they hold.

To Delete or Not to Delete

The first thing you need to decide is whether you need to keep a given account for some reason. There may actually be good reasons for keeping an old account, even if you don’t actively use it. Let’s review some key ones:

1. Any accounts used to verify your identity (like “sign in with…”) or that may be used as a recovery mechanism for other accounts should be kept alive. Email accounts are often in this category.
2. You may want to hang on to accounts with public user names – like social media, online forums, gaming or messaging accounts. Many of these services will eventually recycle any abandoned user IDs, giving them to someone else, who could then impersonate you.
3. Similarly, some accounts have professional aspects that you might want to keep alive, like LinkedIn or GitHub. This may also include online portfolios.
4. Any accounts with financial or legal ties should probably be kept. You might need to access old statements or tax records, dispute purchases, and so on.
5. If you have online accounts that are tied to hardware or software you still use, you should probably keep those active in case you need support or access to licenses.

If the old account is dormant, not linked to anything still relevant, and is easy to replace, then it’s a candidate for outright deletion.

Before you delete the account, you might want to download a copy of whatever data they have as we discussed in the previous article. And before you close the account, you should ask them to delete your data. Some sites might retain your data for their own purposes. This is what you’re trying to prevent. Thanks to GDPR and other privacy laws, most online sites have had to implement the ability to delete user data on request.

Dumb Down Remaining Accounts

For accounts that you’re decided to keep, you should still do what you can to reduce your data footprint. Remember, the goal here is to minimize the amount of personal data you have floating around the internet. Sure, some of this old data has probably already been sold and abused, but that doesn’t mean it can’t be sold or shared or leaked again. Also, we keep coming up with more reasons to abuse private data and new ways to do it. As a prime example, everyone and their brother is scouring the internet for more data to train their AI systems.

Here are some ways to minimize or dumb down your data on the accounts you’re going to keep:

1. Purge all unnecessary data, except the bare minimum required to keep the account alive.
2. For data you can’t delete, consider changing it to something innocuous or even false. Do they need your real name? Birth date? Mailing address? There are definitely situations where they might… but if not, consider just making up some dummy data and make it different for each site.
3. Change the email address associated with the account to something unique, to prevent correlating data between otherwise unrelated accounts. For this, you’ll likely want to use email aliases.
4. Remove any connections to other accounts. If you used “Sign in with…” for this account, see if you can switch the account to something that uses a dedicated username and password, and break the connection to the sign-in-with account.
5. Remove any payment methods or bank account connections.
6. Make sure there are no on-going subscriptions associated with this account.
7. For social media and online forums, see if you can bulk-delete old posts and uploads. You might look at tools like Cyd for help.

As one final note, for any social or public accounts you keep, you might want to post a note somewhere that you no longer use this account. Many accounts have a profile that would allow you to include a message like this.

If you want people to be able to find you, you could add a hint about how or where to do so. I would avoid explicitly listing a new email address as this would defeat the purpose. (Note that using obfuscated formats like “jsmith [at] somedomain [dot] com” won’t defeat smart web scrapers.) You could create a unique email alias for each site. Maybe you only want your friends and family to find you, so you could craft a clever and vague message that only someone who knows you would understand.

Final Thoughts

This series ended up being a lot longer than I thought it would. I was thinking originally there would be just three articles, but I kept coming up with more ideas. I know it’s a lot of work, but you don’t have to do it all at once. Pace yourself and do things in manageable chunks. Take good notes.

You might want to keep track of any data or account deletion requests you’ve made so you can follow up later to make sure they actually honored your request. For any accounts you kept but don’t actively use, you may want to check in 1-2 times a year to see how they’re doing.

And finally, as you inevitably create new accounts in the future, try to minimize the information you give them. Use email aliases where you can, maybe fudge some of the personal data they ask for, and avoid giving them any information that would allow them to tie the account to some other account or to something that would give them more of your personal data.