Google says it will start deleting inactive accounts later this year

In brief: Do you have a Google account you've not used for a long time? If it will have sat dormant for two years come this December, wave goodbye as Google will permanently delete it and all your data. The company says it's taking this action to prevent security risks.

In a post about updating its inactive account policies this week, Google wrote that if an account hasn't been used for an extended period, it is more likely to be compromised. This is because they often rely on old or reused passwords that may have been part of data leaks, haven't had two-factor authentication set up, and receive fewer security checks from the user. Google notes that abandoned accounts are ten times less likely to have 2-step verification enabled.

A compromised account can be exploited for identity theft, phishing scams, spam, and more, so Google is deleting those that have not been used or signed into for two years starting this December. The company warns that it may delete the accounts and contents within Google Workspace (Gmail, Docs, Drive, Meet, Calendar), YouTube, and Google Photos.

If you're wondering what constitutes activity when signed in, Google defines it as reading or sending an email, using Google Drive, downloading an app on the Play Store, watching a YouTube video, using Google search, and using Sign in with Google to sign in to a third-party app or service. Android-check-ins are also listed as activity, so just using your phone might count, as does paying for Google One storage.

Only individual accounts will be affected by the new policy. Those for businesses, which pay for their accounts, won't be impacted.

The new policy is an expansion of one that Google introduced in 2020. It wrote at the time that if an account was inactive in one or more Google services for two years or more, the content within these products might be deleted. But accounts were safe from deletion at the time.

Google is now sending multiple notifications to the email addresses and recovery mails (if set up) of inactive accounts to warn users ahead of time.