I deleted several years worth of old accounts. Here is my experience.
Summary
The task of deleting online accounts is very long and challenging. No one web page has the same approach to data privacy. Even if you are seemingly able to close your account, your data may still remain on backup servers. In doing this task, you have to trust that the organisations in question are actually erasing your data as you would expect.
The best way to reduce your exposure to data breaches and misuse is to be mindful before setting up an account in the first place. You lose all guarantees once your data is handed over.
Background
The web page I am looking at holds a swathe of identifying information: name, date of birth, previous and current address, telephone number and email. Also included are the details of my referees. I haven't been on this webpage in years, I have had no reason to, and I am surprised that my account still exists. Why hasn't anybody noticed the inactivity? Surely the owners of this webpage can feel the weight of holding so much responsibility over my data?
I look for a link to delete my account, thinking this must be under account settings. This would be the most sensible place to put such a link, right? I can't see one though. I scroll down to the bottom of the webpage, and in tiny font (I would estimate size 6), I see a link to the webpage's privacy policy. I click.
The privacy policy for this site is thick and dense. The language used is enough to make Susie Dent wince. I can't be bothered to read through all of this, so I press ctrl+f to search by word. I type 'delete' to begin with, and when this fails to highlight anything, I type 'erasure'. This highlights one line in the privacy policy that indicates I have the right to data erasure, and points me to contact details in another section on the page.
I send an email using the contact details provided. I ask for my data to be deleted and my account to be closed. This is my right under their privacy policy. I fire off the email. A week later, I still have no reply. I resend the email, double checking that the contact details were correct. They were. Another week later, still nothing.
My account remains open and my data remains undeleted.
This was the experience I had deleting just one online account. I don't even remember creating this account to begin with, but it contains all of my personal information all the same. Rarely a week goes by where I don't need to create an account for something, and when our lives are digitised from such a young age, the number of accounts holding our personal information swells.
According to my password manager, I hold accounts with 243 webpages. That's 243 different targets for those interested in using my identity. I decide enough is enough. I know the task is going to be long, boring and tedious, but I can't allow myself to be so apathetic to my data going forward. I decide to go through the 243 different accounts and delete as many as I can.
I make it my goal to reduce the number of accounts I have to 100, with less than this being preferred. I naively think that deleting so many old accounts will reduce the surface area for which my data can be stolen, or used against me. I soon learn that this isn't the case.
How I did it
Based on some previous experience and moderate research prior to starting, I already realise that in many cases total deletion of my data will be impossible or unreasonably difficult. So I decide that the next best alternative is to muddy whatever data exists with fake information. To me, this seems like an alternative virtually equal in effectiveness to outright deletion.
Whilst it is easy to fake a name or address, faking an email is harder as I know that this is used for verification. Using someone else's email will not allow me to receive the verification code needed to cement the change. Fortunately, I know just the tool that can help.
Proton Pass1. This tool allows me to create 'alias' email addresses that can be used in place of my actual email address. The address itself looks like something you would receive from a spammer, but still enables you to receive emails from the recipient. This means I can receive verification codes without providing my real address. Once I have deleted the account, I can disable the 'alias' email and delete entirely, as though it never existed.
I already have a free Proton email account, so it makes sense for me to use this tool. I pay $7.99AUD for the month, with the view to cancelling the membership once I am finished with my task.
Whilst I am trawling through so many accounts, I might as well update my passwords whilst I am at it. I'm not creative enough to think of secure passwords, and that lack of creativity is a security risk. So instead I use my password manager, Bitwarden2, to create randomised 15 digit passwords without repetition.
I have used Bitwarden for the last 2 years as my research suggested it was favoured amongst data privacy advocates for its strong encryption. A password generator is also included, which is what I will be using to replace my passwords. I pay around $20.00AUD annually, which I think is pretty reasonable.
At this stage I feel well enough equipped to start work, but wonder how and when I am going to fit this all in. There is no way that I am doing this in one sitting, no amount of concern is going to make this task any less tedious. I resolve to do an hour or two in the evening, whenever life permits. I know this means that I am going to be doing this for at least a few weeks, but I figure that there is no immediate threat to my data, and that it will be worth it in the end.
My (abbreviated) experience
I won't be describing every single experience I had doing this task. That doesn't make for very engaging reading (or writing)! I have shortened the overall process to focus only on the most noteworthy experiences.
Session 1
Accounts Remaining: 243
River Island
And immediately the going gets tough. I begin with high street retailer River Island. I once bought a pair of trousers from them in 2020, and haven't shopped with them since. Despite this, my account remains open, which includes payment details and addresses. I start easy (or so I think) by trying to find a 'delete account' button, but I have no such luck. One does not exist. So I try my Plan B. I replace all the the account details with nonsense. My name is Anon Ymous, I live at 1 London Road, London and my email address is randomly generated by Proton Pass.
However, for my nonsense email address to stick, I receive a message to my previous address indicating that I must verify my details by clicking a link sent to my new nonsense address.
I never receive this email, which I find odd as I haven't had any issues with Proton Pass before. I try again with a different nonsense email, but again, no verification is received.
I suspect the issue lies with the website itself. Besides this, there have been other examples of glitches and poor design making my use of the website harder. This will become a running theme, but for now I can do nothing but move on and come back later.
Sky Broadband
Like River Island, I haven't used Sky in some years and I am in a position where I won't be using them again. This account contains both my personal details and those of my partner, so I am particularly keen to delete this account.
I look in all of the sensible places for a 'delete account' button, but one cannot be found. I consider resorting to filling in nonsense details again, but I have a problem. What I thought was one account is actually three: mine, my partner's and an account for our broadband plan. These are all interconnected and changing details in one will surely make it difficult to change the details of the others later on.
There is also an issue on my end. I no longer live in the UK and do not have access to the UK number on this account. I cannot update any of my details unless I set up two factor authentication, which requires access to my old number.
So I scroll to the bottom of the page and click on the 'Privacy options' button, to see what else I can do. Nothing happens. I try again, but nothing happens. After some guess work, I am eventually able to find the privacy policy by clicking on the link from a different part of the website. I am asked to request for data erasure by completing a form.
I complete the form and wait to hear back.
Weirdly, a few days later my partner receives an email from Sky asking her for confirmation to delete her account. I wonder where I fit into this, bearing in mind I completed the form.
I try to log in a few days later, and my account still exists. However, the details concerning my previous broadband service have now gone. This does nothing for me, as my name, address and contact details all remain. So I fill in another form under the privacy policy, now specifying that I want my personal details erased.
I am unable to submit the form. The form requires that I have an account number, which was deleted in the previous request.
There is now very little left for me to try. In desperation, I begin a chat with Sky's AI assistant, but that leads no where.
I am forced to give up. I don't want to sit in a call with Sky for an indefinite amount of time, only to find out that customer support can't (or won't) delete my account. I take some comfort in knowing that some of the data is no longer current, and that I was at least able to update my password to something stronger.
I move on.
Session 2
Accounts Remaining: 223
ChatGPT
The start to this session is thankfully (and surprisingly) easy.
Like so many, I have provided lots of information to ChatGPT to ask everything from 'how do I fix this syntax error in Python' to 'what is the future of humanity'. When it comes to LLMs we provide more than just our contact details, we provide our thoughts, and ChatGPT benefits from our thoughts by using them as training data.
With personal data being so beneficial to ChatGPT, I really thought that OpenAI would make closing my account as difficult as possible. But I was pleasantly surprised. There was a delete account button, and it was where I expected it to be. Within a few clicks my account was closed and my data erased.
Whilst this was very easy, I did notice that within 10 seconds of me landing on the ChatGPT webpage, Brave had blocked 156 different trackers and ads. So I was left wondering whether my account was actually as valuable as I thought.
Bulk Powders
I don't know much about web design, but this next website seemed archaic to me. Data security is clearly not a priority.
I haven't used Bulk Powders in about 10 years, and I assumed that my account would long ago have been shut down for inactivity, but again I was wrong.
There was no 'delete account' button, and their privacy policy did not include any contact details to ask for account deletion. Thankfully, the contact information under my account was highly suggestible, and could be changed to literally anything.
Unaware that Kier Starmer would shortly vacate this address, I bid him happy bulking and moved on.
Tuta Mail
I finish this session with an example of a company that respects my data. Tuta Mail is a privacy focused email provider based in Germany. I like them a lot, but I ultimately chose to go with Proton Mail for personal preferences. I kept the account open, but hadn't used it at any stage since opening.
I logged in to delete my account, now sure that I wouldn't be using Tuta as my email provider going forward, and I was met with the following message.
This is how it is supposed to be.
Session 3 - 5
Accounts Remaining: 204
Morrisby (Careers Platform)
Morrisby is a platform that provides psychometric tests, the kind you might have been issued at school to provide some idea of what career might suit you. I actually took this more recently than school, and so not only did this platform contain my contact details, it also contained details of something less tangible, my personality.
With this in mind, I was quite keen to have this account closed. Like many of the other sites I had visited, there was no easy 'click this button' option, and filling in my contact details with nonsense wouldn't work as my details were included on the tests I took.
So I had to do this the hard way. I scrolled down to the privacy policy at the bottom of the page to check my rights. Under the UK GDPR, I had the right to erasure and contact details were provided for me to act on this. So I wrote the following email:
I felt this made clear that I wanted BOTH my account closed and data deleted, and did a good job of sounding somewhat professional. I was validated the next day, when I received the following in response:
I was pleased that the email was acted upon so quickly, and without any further hassle, but one line left me concerned:
"Your data will remain in our database backups in line with our backup retention period."
So even though I requested that my data be deleted, it was still being kept in backups. Was this the case for every organisation? If so, then it left me wondering whether my progress up to this point had been for nothing. I looked deeper into the Morrisby privacy policy to find out how long the retention period is:
5 years. My data will be held for a further 5 years after I requested deletion. The reasoning seemed rather arbitrary, being that 5 years is the time it might take for a career decision to reach 'fruition', whatever that is.
It was beginning to dawn on me.
The only time we ever have full control over our data is when we are yet to hand it over.
I continued onwards with the exercise anyway, feeling there was still some merit to eventual deletion rather than no deletion at all. I also felt showing my intent to delete my data set a precedent to the organisations with accounts on me.
TenantApp
A website for rental applications. I will sign up again if I ever need it.
In this instance, there was a nice and easy 'delete account' button, and it looked like this.
I clicked, and my account was gone! Or so I thought...
I tried to log back in to the service after my account was deleted, just to check that I had been successful, and found that I was able to log back in. All my data was still present. I tried to delete my account twice more, achieving the same results.
I wasn't going to give up. I checked the privacy policy and emailed the contact details shown, and got the following response, over a month later.
Whilst I was now happy that I could no longer access my account, I was disappointed by the length of time it took to respond, but at least I got a response.
Session 6 - 10
Accounts Remaining: 135
Let's have a quick recap. For the sake of this post, I have mostly shown all the attempts that have had the most friction. Don't get me wrong, there is mostly friction. But there have been some easy wins along the way as well. Twitch, Uber, Anthropic, Goodreads and Compare the Market are all examples where it has only taken a few clicks to delete my data. I think it is important to acknowledge this for balance.
PayPal
Another example of where not having access to an old phone number has lead to aggravation.
I haven't used PayPal in years, and it shows. I couldn't even log in to change my details, I needed access to a number I no longer held.
I'm not easily put off by added friction, but even I have to draw the line. I decide not to contact PayPal (for an unknown quality of support) and just hope that my levels of inactivity will result in my account eventually being removed.
Apple
An interesting case. I was expecting added friction, as Apple's business model relies on our data for revenue. I wasn't wrong. Whilst I was able to delete my account online, there were several screens that stalled finalising my request, four in fact.
This one,
This one,
This one,
And this one,
It took a further 8 days from this point for my account to be deleted.
As I said, it was easy enough to click through all of these warnings, but it was clear that Apple didn't want me to delete my data.
Hotmail (Microsoft)
I've been dying to delete this account for years. I've had this email since I was 11, the address itself is embarrassing and all it picks up is heaps of junk and spam.
I've deliberately left this account for the end. For me to delete it, I need to ensure that no other account uses this email address for fear of being locked out. Doing this exercise has resulted in me finally unlinking this email from my current (and remaining) accounts.
It still wasn't easy. At some point in time, Microsoft merged my Hotmail address to my Xbox account. I have purchased many games through Xbox Marketplace and total deletion of my Hotmail account will result in me losing all of these purchases.
I did some digging around. I discovered that when my Hotmail address was merged with my Xbox account, it was converted into an alias much like the nonsense emails I create with Proton Pass. This alias pointed towards a generic outlook email address, that up to this point I hadn't realised existed. I created a nonsense email with Proton Pass to act as my primary address (you need at least one other email to delete preexisting addresses), and then deleted my old Hotmail 'alias'. This would prevent me from receiving and sending emails under this address, effectively removing it from existence.
Doing this didn't delete the emails received by Hotmail over the years, or the contacts added from my original MSN days (🤮). So I had to do this manually. It felt rather therapeutic.
For the perfectionist, there is also a section on your Microsoft account to delete individual categories of data such as location or search history. Naturally, I wiped every single one.
It isn't ideal (I would argue that it's underhanded) that Microsoft merged my Hotmail address to my Xbox account, thus preventing everyone but the most insane privacy hardliners from closing their account.
Despite this, I am satisfied that everything I wanted to delete from this account has been removed.
Discussion
Accounts Remaining: 83
As emphasised throughout, I have only covered what I believe to be the most egregious or notable attempts to erase my data. You will have noticed that the number of accounts eliminated between each session were much larger than those actually discussed. These accounts were eliminated from my list for one of the following reasons.
The webpage in question had already deleted my account due to inactivity.
I was successful in deleting my data and/or scrambling my details. The attempt was fairly mundane and for the sake of readability, it was not worth writing about.
Deleting my data was too difficult and scrambling my details was impossible, so I gave up. In these cases I cut my losses and removed my login details for the sake of good hygiene.
The login details kept in BitWarden were old, or duplicated.
The vast majority of cases fell under 2 or 3, with a not insignificant amount also falling under 1. I would estimate that around 20 of the accounts listed in BitWarden were duplicated or old.
I am only human, and I didn't think my approach would be perfect, nor was I aiming to be. I begun the experience with the view that deleting old accounts would reduce my exposure to data breaches or misuse, and with this in mind I tried all possible avenues. But when I realised that my data was also being kept on backup systems, I began to feel a sense that what I was doing was futile. That the cat was out of the bag.
This is where I began to put less effort in.
If there was a button to delete my data, or if I could replace my details with nonsense, then great. I would do that. But if I had to crawl through another privacy policy and send another email that would go unanswered, then I would give up and move on.
In writing this article, I wanted to portray my experience of deleting data that is already out there, and this was my experience. Perhaps a more dedicated person would be more thorough, but I tend to think that the average person would have a similar experience to me (if they attempted this task at all).
I was surprised when my experience was easier with Big Tech companies. Big Tech is highly incentivised to prevent me from deleting my data, and so I expected a lot of friction. However, in most cases it was as simple as pressing a delete button. I suspect the reason for this is that Big Tech is more heavily regulated that smaller companies. Cynically, I also think that our heavy reliance on the services provided by Big Tech make it unlikely that anyone would delete their data.
The worst experiences I had were with smaller organisations and retailers. A number of these websites were poorly designed, in which case the 'Delete Account' button would not work as intended, or the contact details on my account couldn't be changed. More frequently than not, these websites didn't even have an easy way to delete my account, and I would have to locate contact details under the privacy policy (if there were any). In some of these cases, I actually felt that the option to close my account was being deliberately concealed.
At a guess, I think that smaller organisations are either too under resourced to give data privacy the attention it needs, or these organisations are simply not incentivised to try harder. In either case, I felt that my privacy wasn't a priority.
Ultimately, I managed to whittle my accounts down to 83. Was it worth it? Kinda. It depends on the degree of trust that you provide to these organisations that when you request to delete your data, it is actually deleted. I tackled a significant number of accounts, and so chances are that some of these organisations would have deleted my data as requested. Where I was able to, I randomised my details with nonsense replacements, and this definitely would have worked in erasing my identity.
I also updated the passwords to all of my accounts to something more secure. So even if you think closing accounts is pointless, I at least achieved tighter data security.
I think the main take away from this experience is that you need to think about who you are providing your details to before you do so, because there is no getting them back once you hand them over. If you really have to hand them over, try to give false information (within reason).
Mindfulness over your data reduces the chances and impact of your data being sold or stolen. The only time you can guarantee absolute security is before you provide anything.