Delete Your Old Accounts (If You Can)

I recently received an email about a data breach at Drizly, a website I used one time three years ago to send a former co-worker a bottle of whiskey. I had completely forgotten I had an account there, and I decided I should just delete it, so I went searching through the account settings—only to find no way to delete it on my own. That frustration set off one of my stranger pandemic-quarantine hobbies: finding and deleting as many zombie accounts full of personal information as I could.

Drizly is certainly not the only service to fall victim to a data breach. I get emails about these sorts of hacks, leaks, and breaches constantly.

Seemingly minor data breaches are especially problematic if you reuse passwords. If you do, a data leak from an old login could reveal the credentials of other, more recent accounts. But even if you’re using a password manager and being careful to use strong, unique passwords, long-forgotten sites can still pose a privacy risk. The old sites or services might be linked to other accounts, such as for a calendar or contacts, or they might hold some data you’d rather just keep private, like demographic information or personal notes.

But as I learned with Drizly, deleting accounts isn’t always easy (or even possible). In the case of Drizly, I had to read the terms of service to learn that to delete my account I’d have to email the customer service team. Looking for other examples, I found that Amazon forces you to email customer service, as well. Evernote requires you to submit a ticket to remove your email address and username from the service. The NBC Peacock video streaming service merely provides a way to delete your account if you’re covered under the California Consumer Privacy Act (CCPA). None of these major websites let you delete your account in a few clicks.

This is bonkers.

No one should have to spend five minutes searching for a how-to guide to delete an account. If you’re having trouble finding such instructions, entire websites such as Just Delete Me and Account Killer exist to help.

Of course, in some cases, simply remembering that you even have an account is difficult enough. If you’re like me, you probably have dozens of zombie accounts spread across the web, lost to time—until you get the inevitable email announcing an account breach.

Here’s how I went about finding mine.

Sort through your password manager (or the credentials saved in your browser)

If you’ve used a password manager for a long time, the process of tracking down old accounts is mostly painless. Fire up your password manager, go through your list of logins, head to any website you no longer use, and then (attempt to) delete your account. Some password managers, like 1Password, allow you to sort logins by “Date last used” or “Date created,” which helps you locate older accounts quickly.

If you use the password tools built into a browser, there’s usually a way to find a list of all the accounts there, too:

• Chrome: Click your profile icon in the top right and then the key icon.
• Firefox: Click the three-bar menu in the top right, and then click Logins and passwords.
• Safari: Click Safari in the menu bar, then Preferences, then Passwords.

Deleting a login in your password manager doesn’t delete an account, so you’ll still have to log in to the sites themselves to remove your accounts for good.

Hunt through your email inbox

There’s a good chance your inbox is filled with welcome emails from accounts you’ve created over the years. Search for phrases like “welcome to,” “updates to,” “we are updating,” “your account,” “free trial,” or “verify your email” to find things you might have missed elsewhere.

Check for accounts where you used Google or Facebook to log in

If you used Google or Facebook to log in to an account instead of creating a new username and password, you can find a list of those sites easily. But always delete your account at the site in question before revoking access from Google’s or Facebook’s permissions page.

• For Google, head to the Permissions page (Account > Security > Signing in with Google) and take a look at which sites are listed under “Signing in with Google.” If you find anything old there, go to that site to delete your account before revoking access from the Permissions page.
• For Facebook, click the drop-down icon in the top right, and then click Settings & Privacy > Settings > Apps and Websites. As with Google, be sure to head to the particular site and try to delete your account there before revoking access.

Search for old accounts

Finally, it’s worthwhile to see whether any lost accounts have already been subjected to a data breach. Head over to Have I Been Pwned?, a free site that monitors email addresses in data breaches. Type in your email address and see if your credentials are out in the world. The data here goes pretty far back—the oldest account I found was from 2010, when Gawker was hacked—so chances are good you’ll find some random account that you forgot existed.

Of the two dozen or so old accounts I found with the above methods, I was easily able to delete about half of them, including a few from accounts I had no memory of creating, such as for Withings, Box, and Todoist. Some, such as an old 8tracks account, seemed to have been deleted for inactivity at some point, while others, like a Showtime account I apparently signed up for, required me to send an email to ask the service to delete it.

Be prepared for this entire process to be far more frustrating than necessary. Drizly, for one, didn’t respond to my inquiry as to why account deletion was so hard to find and hard to do. But if the main worry at Drizly and other companies is that customers will delete their accounts and lose their data, the companies should make that data portable and available to download. Heck, make my data available for download immediately, the second I click the delete link. But until it’s possible for anyone to delete their accounts—including all the data stores—without emailing or calling customer support, it’s worth taking the time to manually find and delete them on a regular basis.