Privacy & Data

Why you should delete accounts you no longer use (2026)

September 23, 2026

10 min read

Copy Link

Quick answer. Yes, you should delete accounts you no longer use. An account you've forgotten still holds your personal details, and nobody is watching it.

That's where the risk lives. A breach or takeover on an account you never open can go unnoticed for years, and deleting it removes the target entirely.

Last updated September 2026. Current as of 23 September 2026.

Why a forgotten account is usually the weakest login you have
How reused passwords on a few thousand accounts exposed 6.9 million 23andMe customers
Why you probably wouldn't hear about a breach on an account you abandoned
What happens to your data when the company behind an old account is sold
Which accounts to delete first, and the handful worth keeping
How to find forgotten accounts and delete them properly
What deleting can't undo, said honestly

Should I delete old accounts I don't use anymore?

In most cases, yes. The only accounts worth keeping are ones you'll need again, or ones that hold records you can't get anywhere else.

Everything else is a copy of your personal information sitting in a database you have no reason to visit. You get nothing from it, and it still adds to your exposure.

The numbers pile up faster than most people think. Yorba's State of Clutter report found the average Yorba member has over 240 online accounts.

Most of those were made once, for a discount code or a free trial. Then they were never opened again.

Why is an unused account a security risk?

It's usually the weakest login you have. Google made this case in 2023 when it announced it would start deleting personal accounts left unused for two years.

Its internal analysis found abandoned accounts were at least ten times less likely than active ones to have two-step verification turned on. Google also pointed to the old or reused passwords these accounts tend to rely on.

Reuse is what turns a forgotten account into a key to other ones. In Verizon's 2025 breach research, the median person's passwords were only 49% distinct from each other across different services.

That's what attackers count on. When a password leaks from one site, they try it on every other site they can find, which is called credential stuffing.

How did reused passwords expose 6.9 million 23andMe customers?

23andMe shows exactly how this plays out. In 2023, attackers got into about 14,000 accounts whose owners had used the same password on another site that was breached.

None of those accounts had two-factor authentication turned on. From there, attackers used the DNA Relatives feature to see profile information on about 6.9 million people.

The attacks ran for roughly five months before anyone noticed. The company only caught on after a post advertising the stolen data appeared on Reddit.

Most of those 6.9 million people never had their own password stolen. Their data was exposed through accounts connected to theirs.

How would I know if an old account was breached?

Often you wouldn't. Breach notices go to the email address on file, which might be an inbox you stopped checking years ago.

The odds that you're in a breach somewhere are high. Have I Been Pwned currently tracks more than 17.8 billion breached email addresses across 1,038 websites.

You can check your email addresses there for free. It only covers breaches that surfaced publicly, though, so a clean result isn't a guarantee.

What happens to your data if the company is sold or goes bankrupt?

It can go with the company. When 23andMe went bankrupt in 2025, its interim CEO told Congress that customers had already agreed at signup to their data being transferred in a bankruptcy sale.

A federal bankruptcy judge approved the sale to TTAM Research Institute, a nonprofit led by co-founder Anne Wojcicki, for $305 million. Customer data was part of the assets.

About 1.9 million people, roughly 15% of customers, asked for their genetic data to be deleted after the bankruptcy filing. The interim CEO said the company honored those requests.

Those people knew they had an account and acted on it. An account you've forgotten is one you can't react to when the company changes hands.

Do old accounts make inbox clutter worse?

Yes, because most accounts come with a mailing list attached. Sign up once and the company has a reason to email you for years.

Yorba members unsubscribed from 52,361 mailing lists in 2025. Unsubscribing quiets the inbox, but it leaves the account and your data where they were.

Deleting the account goes further. It ends the relationship the emails come from.

Which old accounts should you delete first?

Start with the accounts where a breach would cost you the most. If you only have an hour, work down this list.

Accounts with a saved payment card. Retail and food delivery sites often keep your card and home address on file by default.
Accounts that hold sensitive data. Think health apps, or anywhere you uploaded a copy of your ID.
Accounts with a password you've used elsewhere. These are the exact accounts credential stuffing is built to exploit.
Companies that have gone quiet or look shaky. The 23andMe sale shows where customer data can end up when a company fails.
Old social media profiles. Old posts and messages can still be scraped, or taken over and used to impersonate you.

Which accounts should you keep?

A few accounts are worth holding onto, even if you rarely log in.

The email account you use for password resets. Losing it can lock you out of everything connected to it.
Accounts with financial or tax records. An old bank or pension account may hold documents you'll need later.
Accounts you use to sign in elsewhere. If you log in to other apps with Google or Apple, deleting that account can cut off access to those apps too.
Accounts tied to things you paid for. Closing a store account can mean losing the ebooks or games you bought through it.

For these, tighten security instead. Give each one a unique password and turn on two-factor authentication.

How do you find accounts you've forgotten about?

Your inbox is the most complete record you have. Almost every signup sends a confirmation email, and those tend to stick around.

Search your email. Try terms like "welcome," "verify," "your account" and "free trial," which services usually send during signup.
Check your password manager or browser. Saved logins give you a partial list of the accounts you've made.
Review your connected apps. Your Google and Apple account settings each list the apps you've signed into with them.
Check your old email addresses. An address you stopped using still holds the signup confirmations from the years you used it.

How do you delete an old account properly?

Deleting well takes a few extra minutes. It's worth doing in this order.

Log in, or reset the password if you've forgotten it.
Download anything you want to keep, like photos or order history.
Remove your saved card and address from the account settings.
Look for "delete account" rather than "deactivate," since deactivating usually leaves your data intact.
If there's no delete option, email the company's privacy contact and ask for deletion under GDPR or a state privacy law like California's CCPA.
Keep the confirmation email in case you need proof later.

What if you can't delete the account?

Some companies make deletion hard, and some ignore requests entirely. If you can't get an account deleted, strip it down instead.

Bitdefender recommends removing your personal details and stored payment data so there's less to take in a future breach. Then set a unique password so a leaked one can't open it.

Does deleting an account erase all your data?

Not always. Companies can keep some records for legal reasons, and copies can sit in backups for a while after you leave.

Some data also lives outside the account itself. Yorba's 2025 report points to Shopify, which describes pulling shopping and order data from every sales channel into one customer profile that participating merchants can access.

It's still worth doing. A deleted account can't be opened with a stolen password, and it stops collecting anything new about you.

Where Yorba fits

Everything above is a one-time sweep. You'll make new accounts next month, and the list will start growing again.

Yorba scans your inbox for signup confirmations and other signs that you have an account somewhere, then keeps scanning. You get the full list without searching by hand.

On Premium, Yorba's Personal Deletion Agents send deletion requests on your behalf. They act under formal legal authorization, including Power of Attorney, and follow up when a company stalls.

What it doesn't do: Yorba connects to Google and Microsoft mailboxes, so Yahoo and iCloud Mail aren't supported. The first scan on the free plan goes back two years, so older accounts may need a manual search.

Frequently asked questions

Is it bad to have a lot of old online accounts?

Each account is another place your data can leak from. The more you have, the more likely it is that one of them uses a weak or reused password.

Is deactivating an account the same as deleting it?

No. Deactivating usually hides your profile and keeps your data, while deleting starts the process of removing it.

Will Google delete my account if I don't use it?

Google may delete a personal Google Account that hasn't been used or signed into for at least two years. Signing in at least once every two years keeps it active.

Does deleting old accounts remove me from data broker lists?

No, data brokers are a separate problem. In California, the state's DROP platform lets residents send one deletion request to every registered data broker, and brokers had to start processing those requests on August 1, 2026.