If you’re like me, you’ve created hundreds of accounts online over the years. Time goes by, and eventually, you forget about a lot of them, but the accounts are still there, waiting for you patiently on a corporate server. Unfortunately, the information they contain can erode your privacy and even put your security at risk.
Privacy experts will tell you it’s a good idea to delete those old accounts to avoid data breaches and stop the monetization of your data. But that’s a lot easier said than done.
More on Digital Security
Consumer Reports Security Planner
Privacy Fix: How to Find Old Online Accounts
What to Do After a Data Breach
How to Use Facebook Privacy Settings
How to Delete Your Information From People-Search Sites
I’ve written about this issue for years, and had conversations with colleagues, friends, security experts, and CR readers about why it’s smart to periodically delete accounts and the data found in them. One thing that often comes up is how hard it can be to do. Signing up for an account often takes less than a minute, and the link to get started is usually at the top of a website’s home page. But deleting an account can be much more time-consuming.
Recently, I did a little experiment to uncover some of the most common inconveniences in the way account and data deletion requests are set up, and to provide some guidance on navigating the most convoluted processes. (You can jump right to my tips for cleaning out accounts.)
To establish a rough benchmark for how long it should take to delete an account, I decided to use Google—an obvious example of a consumer-data-gathering mega-corporation, but also one that makes this process relatively easy.
So I set a timer and created a new Google account as fast as I could. It took 1 minute and 11 seconds. Then, just 34 seconds and nine easy clicks of the mouse later, I deleted that account and all the data Google had collected during its short but eventful life. That was fast.
My experiences were very different when I moved on to some other services. I timed how long it took to create and then delete accounts with a number of well-known brands where I or people I know have had difficulty in the past. I also added a couple of websites I’ve seen people complaining about online.
It wasn’t a methodical survey, and the companies I looked at might not be the worst offenders.In fact, one reason I chose these companies is that the difficulties I ran into seem to be fairly typical—complicated menus, a lack of clarity about whether deleting your account also deletes your data, and situations where you have to get on the phone, wait on hold, and eventually ask a customer service agent who may try to talk you out of it. In some cases, finding any information at all about deleting an account entails a frustrating scavenger hunt through a website or an app.
“Companies have a moral obligation to let you delete your accounts and your data, and in a few states they have—or soon will have—a legal obligation,” says Justin Brookman, director of privacy and technology policy at Consumer Reports.
“Unfortunately, many companies seem to make this process deliberately hard to manage,” Brookman says. California’s privacy law mandates that most medium and large businesses let you delete your personal information, for example, but we’ve found that exercising that right can be a challenge. (Colorado and Virginia residents will have similar rights starting in 2023.)
However, the challenges consumers face “may not be nefarious,” says Miriam Wugmeister, a lawyer who’s advised hundreds of companies as co-chair of the privacy and data group at the international law firm Morrison & Foerster. “There are substantial hurdles—cost, technical skill, legal issues” that companies face when it comes to account deletion, she says. The problem can also be due to operational complexity, especially at bigger companies. “Your data isn’t just sitting in a spreadsheet, it can be spread across many different systems, including some which can be designed so deleting information is almost impossible. It’s an entirely manual process.”
For each company below, I created a new account, then set out to time how long it took to delete it and any data the company had collected about me. Each process was challenging in a different way—but every time, I found some tricks that helped.
Walgreens
The health information a pharmacy collects can be particularly sensitive. You can shop the Walgreens website as a guest, but a Walgreens account is needed to earn rewards points. Until recently, you needed to establish an account to make an appointment for a COVID-19 vaccine online, a process that asks you to give Walgreens your name, home address, phone number, and more. (You can now sign up as a guest.)I set up a new account and scoured the website to find a way to get rid of it. No luck. Eventually, I found my way to an entry in the help menu, where I learned that a customer service call was the only way to make such a request. It took even longer than I expected because my first call got disconnected. When it was finally done, the customer service agent told me that Walgreens would erase most of my data, but there was no way to get it to delete my username and email address.
Via email, Walgreens spokesperson Fraser Engerman declined to answer my specific questions but said the company complies with the California Consumer Privacy Act (CCPA), the law that gives Californians the right to delete their data.
Time to create a new account: 37 seconds
Time to delete account: 16 minutes, 52 seconds
Lesson learned: Check the online help menu for information about deleting accounts if you can’t find anything else.
Facebook, the parent company of Instagram, is well-known by privacy experts for its 30-day waiting period before it’ll complete a request to delete your account, but finding the button to get started on Facebook is pretty easy. Not so with Instagram. I opened the app on my phone, created a new account and started the clock, looking through every tab of the Settings menu. I write about Instagram’s settings a lot, so I’m probably faster at navigating them than most people, but I couldn’t find anything there related to deleting an account. Then I checked the Help menu, where I learned that even though you can create an account with the app, the only way to delete one is through a web browser, something I never would have thought to try because everyone I know uses only the app. From the “Delete your account” page, Instagram explained that, as on Facebook, I needed to wait a month before the process was finished. Facebook didn’t respond to my emailed request for comment.
Time to create a new account: 20 seconds
Time to delete account: 7 minutes, 47 seconds (plus 30 days of waiting)
Lesson learned: You may need to use a company’s website, even if you’ve only ever used the app before.
Groupon
I had a Groupon account I hadn’t used in years, but for consistency, I signed up for another one. Then, I set about the process of deleting my new creation. I dug through the website, searching the account and profile pages, and came up dry. Then I typed “delete account” into the help menu. The first result was an entry that said to “deactivate” my account, I would need to talk to customer service. I launched a chat with an agent, and after some extensive back and forth, they deactivated my account. But when I asked if that meant all the data would be erased, they said no.In my years as a tech reporter, I’ve come across details about deleting accounts in privacy policies, so I checked there—bingo. I found a link to a special privacy portal where I made a data deletion request. I got a confirmation email explaining it could take up to 72 hours. I got a message at 4 a.m. two days later saying the request was being processed, and five days after that Groupon said my data had been deleted.
Groupon and its parent company didn’t respond to my requests for comment.
Time to create a new account: 24 seconds
Time to delete account: 13 minutes, 14 seconds (plus two days of waiting)
Lesson learned: Don’t assume deactivating an account means deleting your data; check privacy policies for additional help.
Pizza Hut
Years ago, before I moved to New York City, where I can get a great slice from the local shop right outside my front door, I signed up with Pizza Hut’s website to streamline deliveries. Turns out ordering a large pepperoni pie is a lot easier than deleting your Pizza Hut account, which can include your address, phone number, and other details. I created a new account and waded through the company’s website. I couldn’t find anything; nothing in the privacy policy and no help menu to be found. So I called customer service. A friendly man named Howard told me there is a way to delete your account online, but he couldn’t walk me through it (and even after additional searching, I never did find it myself). Instead, he forwarded my request to the Pizza Hut Rewards team, which emailed me a few hours later to confirm that my personal information would be deleted.Pizza Hut’s corporate office didn’t respond to my request for comment.
Time to create a new account: 38 seconds
Time to delete account: 10 minutes, 11 seconds
Lesson learned: When in doubt, call customer service.
SiriusXM
SiriusXM collects a lot of personal information. If you use a SiriusXM-enabled radio in your car, for example, the company may get location data about everywhere you drive. Want to delete that data? Good luck. And it’s also complicated just to cancel a paid subscription. When you sign up, the fine print says the only way to end a subscription is to get on the phone. When I called, the automated system suggested I use my phone to text with a customer service agent instead. It took more than a dozen messages with an agent who tried to convince me to stay three times before they agreed to cancel my subscription.But when I asked how to delete my data, the person I was texting with told me I would have to call again. I did, waited on hold, and finally spoke to a representative. They told me, “There’s nothing that we can do to totally delete the account,” and said it’s impossible to delete my data.
“SiriusXM follows all legal requirements regarding the deletion of customer information,” says SiriusXM spokesperson Patrick Reilly. Reilly says the company keeps the data for legitimate business purposes. “Customers have the ability to restrict the use of their personal information for company marketing purposes via our online contact preferences form. We do not and have never sold subscriber account information to third parties.”
Reilly says that utilizing customer service for subscription cancellation is standard practice at many similar businesses, but the company has started making online cancellation possible for people with certain subscription packages.
Time to create a new account: 1 minute, 15 seconds
Time to delete account: 43 minutes, 37 seconds, just to learn it can’t be done
Lesson learned: Sometimes deleting your data is impossible, but it’s still worth a try.
(In the interest of full transparency, here’s how the process works at CR: Nonprofits are not covered by the California privacy law, but we at CR believe that consumers should be able to control the data that’s collected about them, with broad data deletion rights. Paid CR members can cancel their membership online by going to their “My CR” account settings—of course, we hate to see any member leave, and hope you stay with us!To learn more about your privacy rights, or how you can request deletion of your data, visit the “Your Privacy Rights and Choices” section of our Privacy Policy located on the Consumer Reports website.)
Tips for Deleting Old Accounts
If there’s one thing I learned, it’s that deleting your old accounts can be a time-consuming and sometimes frustrating process. Along the way, I’ve put together some guidelines to speed things along.
- Check to see if anyone has figured out the steps. Google “how to delete [company name] account” and you’ll often find instructions. (I’ve written a step-by-step guide to deleting two dozen common accounts.)
- Go to the Settings page first. Companies sometimes put the delete button in settings, account menus, or pages to edit your profile; it varies by company.
- Try the privacy policy. Privacy policies often include instructions, and you can search for words like “account,” “delete,” “close,” or “deletion.”
- Explore the Help menus. If there’s a Help menu or an FAQ section on a website, you can often find deletion instructions there.
- Try customer service. When available, text chats are usually faster than phone calls in my experience.
- Take advantage of privacy laws. California’s privacy law, the CCPA, requires most businesses to let state residents delete data collected from them. Companies don’t have to fulfill a deletion request if you’re not a resident, but some honor requests from anyone. Look for “California” or “CCPA” in privacy policies for details.
- Don’t forget the accounts you’ve forgotten. You may have registered for accounts years ago that have slipped your mind. I wrote a whole article with detailed instructions on how to find them. Some tips to get started: Google your email address and old usernames; check for saved log-ins in your web browser or password manager; search your email inbox for old “welcome” messages. Try variations on phrases like “welcome to,” “new account,” “password,” or “confirm your email.”
Thomas Germain
Thomas Germain was previously a technology reporter at Consumer Reports, covering several product categories and reporting on digital privacy and security issues. He investigated the sharing of sensitive personal data by health-related websites and the prevalence of dark patterns online, among other topics. During his tenure, Germain’s work was cited in multiple actions by the Federal Trade Commission.
