15 ms·

Updating our inactive account policies

231 points by msla 3y ago

bombcar 3y ago
> To reduce this risk, we are updating our inactivity policy for Google Accounts to 2 years across our products. Starting later this year, if a Google Account has not been used or signed into for at least 2 years, we may delete the account and its contents – including content within Google Workspace (Gmail, Docs, Drive, Meet, Calendar), YouTube and Google Photos. Note the may. It is not a guarantee that they will delete!
- thimabi 3y ago
  That seems to be merely legalese to prevent people from relying on the deletion period and then suing Google when it ends up not deleting something for one reason or another.
paraboul 3y ago
Account handles will not recyclable (for obvious security considerations). So this seems more akin to "permanently disabled" rather than "deleted"
- xenago 3y ago
  It has been reported that they will not be reusable for exactly that reason. https://9to5google.com/2023/05/16/google-account-delete/ https://9to5google.com/2023/05/16/google-account-delete/
  - SoftTalker 3y ago
    There's an argument that this should be done with domain names as well. Right now, anyone can buy an expired domain, set up a wildcard email address, and read any email that's still being sent to addresses in that domain. Conversely, if you take the advice of some to set up a personal domain for your email, you are basically committing to a lifetime obligation. If you later change your mind and let that domain expire, any future owners of that domain will receive any email that was sent to your old addresses.
    - kube-system 3y ago
      And if you don't take that advice, you are committing to someone else's lifetime obligation. Or the extent of their funding/desire/or attention span.
    - davchana 3y ago
      Domains are like real estate. You may end up with a nuce prime real estate in cheap & do nothing. You bought a good domain long ago and not using it. You may buy a domain/property, raize everything & start from scratch. If you abandon a plot/property, domain, and not pay the dues (taxes) or registration fees, anybody can come & claim it through defined procedures. Same way I may buy a home & get mail. Tomorrow if I sell that home I need to do change my address with senders, and make sure to put forwarding (maybe keep the old domain for few weeks/ this year)
    - renewiltord 3y ago
      Interesting. Is there a 302 equivalent for mail so I can start people getting off a particular address?
      - SoftTalker 3y ago
        No standard way to inform the sender of a new address, AFAIK. You can set up a forward to your new email, and keep the old address active and forwarding messages until you're satisfied you've updated (or canceled) all the uses of your old address. Then maybe start bouncing messages for a period of time before you finally shut down your domain.
- hackernewds 3y ago
  Isn't this a vector for username squatting then?
  - nkozyra 3y ago
    How is this more a vector than it is now, though?
xenago 3y ago
Oof. The end of YouTube as we know it
- janosdebugs 3y ago
  How so?
  - bombcar 3y ago
    There are many content creators on YouTube who have gone silent or died, two years from now all those videos will be lost like tears in rain.
    - sphars 3y ago
      In this article[0], it says that YouTube accounts with videos won't be deleted: > At the moment, Google is not planning to delete accounts with YouTube videos. (That would be tricky as some old abandoned clips might have historical relevance.) [0]: https://9to5google.com/2023/05/16/google-account-delete/ https://9to5google.com/2023/05/16/google-account-delete/
      - deleted 3y ago
        [deleted]
      - rurp 3y ago
        For now. It feels like a small leap to go from deleting a person's photos, documents, and emails to deleting their videos.
        crazygringo 3y ago
        No it doesn't because public videos are designed for public usage. They have comments, are part of recommendations, playlists, and so forth. Deleting private content and deleting public content are two entirely different things. There's zero reason why the former would imply the latter, and many reasons why it wouldn't.
withinboredom 3y ago
This ... is not what is going on. When I worked at $bigcorp serving billions in traffic, what happened is that botnets would create accounts and leave them dormant for weeks/months/years (thousands of them), then start doing their bot thing. Account age says a lot when it comes to trust (usually) and spam detection. That's more than likely what they're seeing, not 'compromised' accounts. All this does is tell the spammers exactly how long they are going to be allowed to have 'sleeper accounts' for, the problem won't magically go away.
- vore 3y ago
  I am sure Google of all companies has enough insight into account behavior to conclude this is the case for them. It's not like they can't verify it either: if the account previously had legitimate activity and is now compromised, it's not really a sleeper account.
  - orbital-decay 3y ago
    Bots, antidetect browsers, and residential proxies exist specifically to imitate the activity and circumvent fraud prevention systems like Google's. Most accounts get caught, but many slip under the certainty threshold. This is a cat and mouse game, and sometimes mouse wins by blending into the crowd. With LLMs it suddenly became much easier. I suspect that the timing of this decision might be not random.
- nullityrofl 3y ago
  > This ... is not what is going on. I am reasonably confident that Google are more aware of what's going on with dormant accounts on their platform than you are. I previously worked at Google in Security and while it wasn't in user protection, I know they have quite a few signals for determining compromise. It's pretty trivial to see that an account that was in legitimate use for 5 years and then dormant for 5 vs one that was created and left dormant for 10. Yes, on Google and on other platforms, account age is a valuable reputation signal but it isn't the only one.
  - 3y ago
thund 3y ago
[flagged]
rurp 3y ago
This is disappointing, albiet not that surprising. It's a good reminder to not rely on Google for long term storage of anything you care about. It's not uncommon for inidivduals in poor health to go through multi-year stretches of very limited activity, especially for elderly individuals. In the future, people in that situation, or their relatives, might be surprised to find a Google account they thought was secure no longer exists.
- bombcar 3y ago
  It's not just poor health, there's an entire subclass of Americans who don't have internet access for 2 years+ - most anyone in the prison system. Now as a secret unmentionable for any 2+ year sentence: lose access to all your google shit.
  - skissane 3y ago
    They can give their password to a trusted friend/family member, and have them log in once every few months to keep the account active. Yes, it’s a pain, what if they forget, etc, but it means a 2+ year sentence does not necessarily entail losing one’s account. Could someone start a subscription paid service for the incarcerated - “we keep your accounts alive while you are inside”? More broadly, could provide other “manage your affairs for you while you are incarcerated” services. I suppose many incarcerated people would have no income or assets to pay for it, but some would, or their family might be willing to pay for it.
    - echelon 3y ago
      Seems like an opportunity (sadly) for a service to manage these things. Google isn't the only provider that would need regular logins. Twitter, Twitch, etc. have account inactivity policies.
    - bombcar 3y ago
      Hell, the local police will probably happily login to your email whilst you're in jail, just sign away your 4th and 5th while you're at it ... It's one more thing you have to know to think about - though if the system counts automated logins as logins, then maybe fetchmail has a purpose again.
Eumenes 3y ago
This seems pretty reasonable. Google is a for-profit company, hosting your shit, for free, indefinitely, isn't their prerogative. They should offer some one-time fee or small reoccurring charge to keep your stuff in hibernation mode or something. Like literally $1.
- lakomen 3y ago
  Youtube is a defacto time travel machine when it comes to culture as video. You can watch videos from 2004 and earlier. It's the only platform that could allow itself to act against copyright laws. It's part of the cultural heritage of humanity.
  - Eumenes 3y ago
    Okay, what does that have to do with Google not maintaining history of the videos you watched? You can still bookmark links, download videos for offline use?
    - sacrosancty 3y ago
      The concern is about the account that posted the videos being deleted along with the videos.
qingcharles 3y ago
I wish I could get into my old Google account. I unexpectedly went to jail for 10 years and when I got out I couldn't log into my account because my 2FA (phone) was gone. I had 10 years of email in there. Would love to find another way to authenticate myself. Looks now like it is all going to be hosed anyway.
- vidar 3y ago
  Surely there was some buildup to it :)
  - lcnPylGDnU4H9OF 3y ago
    "Unexpectedly" in this context might be referring to the actual event in which they traveled from their home to their cell, in which case the unexpected nature could easily prevent them from securing the Google account. I hardly think it matters anyway. Take out "unexpectedly" and their complaint is exactly the same. Suggesting that someone who went to jail shoulda/coulda/woulda taken steps to avoid being locked out of their Google account is not practically different from victim-blaming.
  - stronglikedan 3y ago
    It's very easy to be arrested, denied bond, be convicted, and serve your time, without ever leaving the jail/prison system. Especially if you're poor.
    - qingcharles 3y ago
      This. I am a British citizen living in the USA so I waited nine and half years in custody to go to trial.
      - pb7 3y ago
        Why did it take so long?
        3y ago
thimkerbell 3y ago
Are there honest lawyers and honest lawyer referral services? Do email and web browsing still work for people who try to use them? My impression is that these are very much open questions.
UltimateEdge 3y ago
Does anyone know what the previous policy was?
- sowbug 3y ago
  It was originally 9 months. Here is an email my dad received on June 23, 2005. I replaced personal info with XXX. === Hi there, We've noticed that you haven't used your Gmail account, XXX@gmail.com, for quite some time. In order to make Gmail better for our users, we've added a lot of things in the last few months and we hope you'll want to start using your account again. Here are just some of the latest additions: - Free POP access: Take your messages with you. Download them, read them offline, access them using Outlook, your Blackberry or any other device that supports. - More free storage (today and tomorrow): Stop worrying about storage. Your account now has over 2000 megabytes of free storage and our plan is to continue growing your storage by giving you more space as we are able. - 12 more languages: The Gmail interface is now available in UK English, Dutch, French, German, Italian, Japanese, Korean, Portuguese, Spanish, Russian, and simplified and traditional Chinese. If you don't see the language you want on this list, look for it in the future because we're going to keep adding more. - Rich text formatting: Express yourself with fonts, bullets, highlighting and over 60 colors of the rainbow. - And lots more, including support for more browsers, an improved Contacts list, and an easier way to send photos. We're still working hard every day to build you the best email service around. But to keep Gmail great for our users, we may have to close inactive accounts after 9 months. So, we hope you'll give us another chance. To log in to your Gmail account, just visit: http://gmail.google.com http://gmail.google.com. Thanks, The Gmail Team == We sent you this message because we wanted to warn you of your account's inactivity and remind you of our dormant account policies. For more details, please visit our Help Center: http://gmail.google.com/support/bin/answer.py?answer=6563 http://gmail.google.com/support/bin/answer.py?answer=6563 *Protect your Gmail password and your personal information* Google takes your privacy and security very seriously. For your protection, Google will never ask you for your personal information, such as bank accounts numbers, credit card numbers, pin numbers, passwords, or Social Security numbers in an email. For more information on how to protect your Gmail password and your personal information, visit our Help page here: http://gmail.google.com/support/bin/answer.py?answer=8253 http://gmail.google.com/support/bin/answer.py?answer=8253 We sent you this message because as part of signing up for a Gmail account, you agreed to be periodically asked for your comments and suggestions to improve Gmail. If you do not wish to provide such feedback in the future, you may opt-out of receiving Gmail market research messages by visiting: XXX (If clicking the URLs in this message does not work, copy and paste them into the address bar of your browser)
lakomen 3y ago
... I'm about to explode. I have a very old youtube account which I can't recover, in fact there's 2 of them. They have content on them that I will never be able to reproduce, but I watch it from time to time for nostalgia. This post means that Alphabet will delete old legacy content on a huge scale. The world will be poorer for their culture. It will lose the ability to watch very old youtube videos.
- Efimeridopolis 3y ago
  you are right but for your case, yt-dlp.
- somegent 3y ago
  You can download youtube videos
- neltnerb 3y ago
  I only use YouTube through these third party privacy tools. https://libredirect.github.io/ https://libredirect.github.io/ I noticed that when you access YouTube videos through this you can just right click and download.
pcthrowaway 3y ago
I have a google account I haven't been able to log into for some time, because even though I know the password, it flagged "suspicious activity" at some point and has required me to verify with a phone number I no longer have, from when I lived in the U.S. (I now live in Canada, but it did let me log in from Canada when I first moved here) I was hoping that some day, someone would register that phone number and I'd be able to convince them to give me an authentication code, but it sounds like now the account will be deleted before this happens. This really sucks because I think that email was used to register with a bitcoin exchange that I may have some (formerly) tiny balance on. So effectively google has locked me out of an account that could have financial consequences, with no way for me to recover it.
- krackers 3y ago
  >and I'd be able to convince them to give me an authentication code Unless you got to know them well (as in personally face to face), a stranger asking for a 2fa code would appear to be an elaborate phishing campaign.
  - mkoryak 3y ago
    Not even elaborate. Try selling something in FB market place or craigslist. You will get many interested parties who just need to send you a quick verification code for reasons. What they are really doing is signing up for stuff using your phone number. If someone ever asked me to send them a 2fa I would send them the wrong one until they get mad and stop asking me to do it.
  - pcthrowaway 3y ago
    Most people honestly don't care. Also, my name is google-able and some "white pages" style sites still list my old phone number, so I could verify my identity in other ways. You'd be surprised what people will do if you talk them into it, lots of people wouldn't hesitate to give their own credentials up, they're not going to take issue giving a 2fa code for something they're not in the process of signing into. This isn't a silicon valley area code or any other area where people are tech-savvy, I'd wager there's a 99% chance that whoever registers the number could be persuaded. I can literally have my family with the same (rare) last name meet them face to face.
jeffbarr 3y ago
I understand the risks of inactive accounts, but as I have pointed out here before these binary policies do not address the all-too-common situation where someone is forgetful and/or incapacitated prior to their death. These people have more important things to think about than their email and their photos,and the transition from alive to dead (to be blunt) can easily take more than two years. By the time that the estate and the executor has control of the account it can easily be too late to save precious memories.
- deleted 3y ago
  [deleted]
crazygringo 3y ago
I'm seeing a lot of criticism here in the comments, but what's the alternative for free accounts? If you're not using it, how long is Google (a for-profit company) supposed to hold onto your data for free? 100 years? 50 years? 15 years? 2 years seems pretty reasonable to me for something provided by a for-profit corporation. And as other reporting has noted, they're not deleting YouTube videos (makes sense, since while nobody else views your e-mails, public videos are public). People here are saying, what about if you go to jail for more than 2 years, or you're in poor health for multi-year stretches? Then pay for a cheap Google One subscription, export your data with Takeout, or have a trusted friend log in once a year. These are lots of options. If this were a government-provided service then it would be one thing. But it's not, it's a for-profit company that gives you free products in exchange for ads. There are lots of options for keeping an account active. I see no reason why we should expect a company to keep providing storage for dormant accounts beyond 2 years though.
- cj 3y ago
  Photobucket (remember them!) kept hundreds and hundreds of photos in my account with them despite complete inactivity for over a decade. I simply forgot the account existed, and remembered one day to find a ton of amazing decade old photos. There’s something to be said for doing things that earn your company respect from consumers. Had photobucket deleted my decade old photos because I didn’t log in frequently enough, I’d be pissed and wouldn’t use them in the future. If a small photo storage company can afford to keep customer photos for decade+ with no login, I hope Google can store some text emails for at least 5 years. Re: the jail/health issue, making sure Google doesn’t delete my account would (literally) be the last thing on my todo list if I were on my way to prison or a coma.
  - dingusdew 3y ago
    See, I read this situation as entirely differently. Google is not being unreasonable in understanding that they can't afford to store all data from everyone indefinitely. They are not being unreasonable that it is a potential security risk. Where they are being unreasonable is that they have basically gotten everyone addicted to their "free" product, and then, a decade after promoting the idea that no one should run their own services, they should just use free offers in the cloud: they are now admitting the downsides to this arrangement. That Google account that your dead friend had that you keep on your buddy list because it gives you memories? Gone. That Facebook account with your dead family members photos and timeline? Gone. The Twitter account with all the tweets from you child who died too soon? Gone. The lesson should be that if you're hoping for someone else to be the steward of all your digital histories, you're in for a bad time. If you're on someone else's servers, you're bound by their rules, because much like going to their building, you are on their private property. The thing is, they spent over a decade making sure that people trusted that their data would always be there, and that storing it in someone else's private property indefinitely, somehow, wasn't a problem. It was always a problem. If you want to keep your data indefinitely, you have to know how to store it yourself on your own storage mediums that you keep in your own home and on your own computers/servers. So, Google is currently doing nothing wrong, based on the realities of security and cost of data storage. The wrong they did was convincing users for over a decade that this wouldn't happen, knowing full well that eventually it would.
deleted 3y ago
[deleted]
sacrosancty 3y ago
[dead]
grose 3y ago
I seem to have lost my old YouTube account. I used a username (not email) to login, and then I used that same email for a different account, and now YouTube doesn't let you log in with usernames anymore, so it's in limbo. Now it looks like they'll delete all my videos and there's nothing I can do about it.
- tech234a 3y ago
  You can still use a username to login at https://www.youtube.com/gaia_link https://www.youtube.com/gaia_link which will let you link the channel to a Google account if you still have the password.
  - grose 3y ago
    Thank you! I will give it a shot. Much appreciated.
pentagrama 3y ago
This can be bad for many cases, but also good for people who lost access to their accounts and finally that embarrassing YouTube videos and Blogger posts posted with they real names from 2005 when they were 15 year olds will be erased from the internet.
JohnFen 3y ago
> Starting later this year, if a Google Account has not been used or signed into for at least 2 years, we may delete the account and its contents This is great news! I have a couple of Google accounts that I couldn't delete because I lost the login credentials. I appreciate that Google will go ahead and do that for me.
- ryandrake 3y ago
  Honestly, I wish more online services would do this. My password manager has accumulated hundreds of accounts, many for services I haven't used for years. Probably half of them are "one off" accounts that I had to create because the stupid web site makes you create an account to do some basic thing (that shouldn't require an account). So here all these accounts are, sitting out there probably with my real name and maybe a few other bits of PII in them, just waiting to get p0wned. At one point I started going through them one by one logging in to look for a "Delete Account" button but surprisingly most of them offer no way to do so, or hide it well. Even HN doesn't let you delete your account. I understand they will if you E-mail them, but even then, I don't think they will delete your content. The web needs to be more ephemeral. It by default retains too much "forever and just because".
  - Gigachad 3y ago
    I think it will as the data backlogs become larger and the expense greater. Imagine how much Google is spending to store user data on accounts that will never log in again. All the people who have died and had gigabytes of content stored. Eventually it becomes unsustainable to keep everything.
    - charcircuit 3y ago
      >Eventually it becomes unsustainable to keep everything. The number of people on the earth grows exponentially. Babies can subsidize dead people.
      - Gigachad 3y ago
Wowfunhappy 3y ago
> if an account hasn’t been used for an extended period of time, it is more likely to be compromised. This is because forgotten or unattended accounts often rely on old or re-used passwords that may have been compromised, haven't had two factor authentication set up, and receive fewer security checks by the user. Our internal analysis shows abandoned accounts are at least 10x less likely than active accounts to have 2-step-verification set up. Ah yes, because as we all know, the best way to prevent a robbery is to preemptively burn down the whole building. Good luck stealing from me once all my belongings have been turned to ash! --- To be a bit more charitable, it may true that in some cases, getting hacked is worse than just having your account deleted. I'd posit this is the case for a small minority of users, especially when the overall chance of being hacked is still far from 100%. By the way, what about accounts that do have two-factor authentication enabled? Are those exempted? If Google wants to delete inactive accounts, that's their prerogative, but don't hide behind some security argument.
password4321 3y ago
Shutterfly recently purged photos from inactive accounts (no purchase in 18 months) in April, but apparently extended the deadline to the end of May. https://twitter.com/Shutterfly/status/1649072987725864960 https://twitter.com/Shutterfly/status/1649072987725864960
lamontcg 3y ago
If compromised accounts is the problem, then google could change the authorization on them, and require proof to get back into them. Of course that would require some kind of functional consumer-oriented support line where a human working at google could receive identifying information, check that against Google's internal records and public databases (your old phone numbers, addresses, etc) and check against the contents of the account and the old logs in order to determine that the person was who they said they were. That would also solve the problem of so many people in the comments who have old google accounts that they've lost the 2FA/passwords to who are locked out of their accounts, they'd now have a process to go through in order to prove who they are and that they owned the account and get it back. But that would cost Google a lot more money than just even hanging onto the storage, so they're gonna nuke it and make it all go away. Big Tech really needs to be regulated more like a government agency.
- kccqzy 3y ago
  > Of course that would require some kind of functional consumer-oriented support line where a human working at google could receive identifying information, check that against Google's internal records and public databases (your old phone numbers, addresses, etc) and check against the contents of the account and the old logs in order to determine that the person was who they said they were. This is a highly unreliable, easily gamed non-solution to the problem. If people are determined enough to compromise your accounts, it's easy enough for them to find your old phone numbers, addresses, etc. Websites like https://www.fastpeoplesearch.com/ https://www.fastpeoplesearch.com/ exist, and it provides generally accurate information on people. Humans are always the weakest link. If you allow a random person to convince a Google employee that are the owner of the account, they are going to be tricked. People on HN are always very quick to come to the conclusion that Big Tech not doing something is because of cost, whereas the reality is that the thing HN commenter proposes but Big Tech is not doing is flawed in the first place.
  - lamontcg 3y ago
    No, I'm suggesting that you need to prove who you are using a high level of authentication (ideally things like passports). That identification can then be used to associate you with addresses, e-mails, phone numbers, etc using sources like credit agencies and probably Google's own existing information, which can then be associated with the logs on the account. And this should be used for accounts with significant amounts of inactivity so it isn't a process that could be used for actively used accounts. I'm not suggesting that Google employees just trust someone who just says they lived somewhere and had some phone number.
starkparker 3y ago
However expected these policies are, they're always a massive pain in the ass for people who continue to maintain accounts for the dead, and that use case never seems to be considered, except maybe to push those maintainers to just delete everything. For example, one Gmail account I maintain for my deceased partner has another older Gmail account delegated to it. I have the credentials for the newer account, but not the older account. That delegated access is the only way I can get at about 10 years of their life; since I can't login to the account, I can't run a Google Takeout on it, I can't pull it via IMAP, etc. (I'm sure it turned some heads when I logged back into their Twitter account, which became their de facto public online memorial after death, to prevent Twitter from deleting it as inactive.) All of my efforts to recover actual capital-A Google Account access to the delegated account have been either declined or ignored by Google because I'm not the account owner — which, obviously, because I'm not dead. I've offered them death certificates and small-estate proof, but they don't want it or seem to care. Since I can't login to the account, I can't prove activity on it, so this means one day in December that'll just be it. 10 years of correspondence, wedding planning, travel plans, memories straight down the shitter. (Google already "lost" all of the photos in that account that were more than 10 years old; cf. other complaints: https://www.reddit.com/r/GMail/comments/jgr0j9/help_missing_attachments_in_old_emails/ https://www.reddit.com/r/GMail/comments/jgr0j9/help_missing_....) If you want content from a dead person's account, you have to get a court order, and then only if Google accepts your request, which they probably won't: https://support.google.com/accounts/troubleshooter/6357590?hl=en#ts=6357650 https://support.google.com/accounts/troubleshooter/6357590?h... Judging from the contents I think it consumes about 150MB of storage. I'd pay quite a lot to get that account dumped onto a $10 thumb drive so I can back it up. I'd already printed out a binder full of it, which is comical considering it's fucking _email_. Anyway — figure out your digital estates while you're awake and alive because it gets way harder — for everyone, much less you — once you're incapacitated or dead.
Gustomaximus 3y ago
Also note google have a trusted contact option for inactive accounts. I haven't seen this mentioned in the thread and worth doing for some peeps. I set this up so after 6 months of no activity my sister and wife get access to my accounts. https://support.google.com/accounts/answer/3036546?hl=en https://support.google.com/accounts/answer/3036546?hl=en Quite useful if you die or become incapacitated etc so emails, files and photos etc can be kept as needed.
- TheSpiceIsLife 3y ago
  This is as good a time as any to remind people to get their estate planning sorted. I recently turned <significant milestone>, and had a death in the family who was nearly 100 and had their estate in order which made things a lot less complicated their executor and kin. We now have Enduring Power of Attorney and Enduring Guardian delegated to each other plus two other well trusted people, one local and one distal, jointly and severally; and set up our wills. So our lives now have a trusted back-up operator and a redant pair of back-up operators. N+3. Don't wait till it's too late. This is not legal advice. I am not a lawyer, and I am especially not your lawyer.
  - TheSpiceIsLife 3y ago
    redundant* pair
dot5xdev 3y ago
Am I the only one who (mostly) likes this new policy? I actively try to delete my online accounts—and it's _hard_ (or impossible for some companies). I definitely have some Google accounts from like 10 years ago that I lost access to. I'm glad to know they'll be deleted. That being said, 2 years does seem a little short. But, I do like the idea of my data expiring. It seems creepy as hell that someone could go back 10 years and dig up a bunch of information about you that you forgot existed: blog posts, comments, photos, videos, emails, home addresses, phone numbers, credit cards. Data breaches happen. Data brokers find your stuff. Stalkers exist.
Animats 3y ago
Oh, good. My abandoned Google account will finally get deleted.
silverpepsi 3y ago
This is unbelievably generous, I'm happy. I feel like people forget Hotmail et al. circa 2001 when 60 days passed and you lost everything. Sometimes you could keep your account and just the data was wiped out. This was ABSOLUTELY THE NORM on the internet. Google overturned it single-handedly. In Texas my automatic payment for my storage garage where I have $10,000s of my designer clothing collection didn't go through because my bank removed overdraft payments and I missed the email. They made very little attempt to contact me, pathetically little in my opinion, and when I finally caught it barely 30 some days later they said my possessions were all days away from going to auction. It really disgusted me. My whole life is stored there since going nomadic. They don't have a prepay option otherwise I'd gladly pay annually or biannually to play it safe. Based on the US culture, I believe it is their actual goal to take possession of all my things. My only copy of school yearbooks and college degrees are also there. I really doubt any other country is as hostile and would love to move it all to my storage in Thai or France if not for customs and import taxes complications. I didn't use my Hong Kong subway card for 9 years and the balance was still there, in America at almost 0 cost to them to keep it active, the NY subway system 100% would have stolen my money. I fundamentally HATE whan the culture tolerates as normal. Google ain't bad at all.
- woodruffw 3y ago
  > in America at almost 0 cost to them to keep it active, the NY subway system 100% would have stolen my money. MetroCards expire every 12 months, but every MVM in the city (and every subway station has 2-50 of them) will take an expired one and exchange it for an active one for free. My understanding of the expiry window is that it's meant to correspond roughly to how long a MetroCard survives in a wallet, not to steal your money. (None of this will matter in a few years anyways, the replacement system integrates with existing contactless payment systems.)
  - silverpepsi 3y ago
    Very interesting, so perhaps a poor example. I'm used to aggressive policies in the US to take you balance or similarly clean themselves of any financial obligation to you, but off the top of my head I don't have examples handy. Guess I'll document them in the future to see if I have a legitimate argument comparing countries here
Ekaros 3y ago
I wonder if this opens up the addresses for reuse? As these could potentially allow many types of attacks. Or even accessing other accounts. Data can be deleted, but if gmail addresses can be reused in just 2 years that is rather short...
deleted 3y ago
[deleted]
iggldiggl 3y ago
I wonder, does using a delegated calendar also count as activity, or do I now actively have to sign in into that account from time to time? At least some time ago there used to be some wonkiness regarding replies to calendar invitations if somebody sent an invitation to my private mail and I would then accept or decline that invitation via my calendar on my regular Google account, which is linked to a google-specific mail address. So ultimately I ended up creating a secondary Google account for my private mail address and then delegated full calendar access from there to my main account, which is also the one signed-in on my phone.
hacky11 3y ago
[dead]
deleted 3y ago
[deleted]
turtleyacht 3y ago
As a part of the criteria for an active account, I wish they would include "forwards to another active account." Otherwise, you need to sign in on those accounts every so often, but they are essentially empty.
- bhelkey 3y ago
  > Before deleting an account, we will send multiple notifications over the months leading up to deletion, to both the account email address and the recovery email (if one has been provided).
  - tjoff 3y ago
    ... still need to sign in.
asah 3y ago
related question: given plummeting prices per GB for raw storage, I'd have expected the cost of hosting storage to drop per GB as well, and yet we haven't seen a commensurate drop, even given competitive pressure. What gives? Yes, I know there's many other costs but I'm talking about * PER GB * and just for storage not access. A disk drive roughly takes the same amount of space/power/cooling regardless of capacity, so if you install 2x larger drives then cost ** PER GB ** should fall in half. And yet, we haven't seen that among cloud providers. This should mean that inactive accounts quickly drive to near-zero cost, since they're nothing but storage capacity. Photo hosting should drive to zero. etc etc etc Can anyone explain ??
- pradn 3y ago
  No, storage costs aren't plummeting. They've been largely stagnant the past 3-4 years. I don't think the reduction in the number of drives for the same amount of storage is as significant as the cost of the drives themselves. https://www.backblaze.com/blog/wp-content/uploads/2022/11/2.jpg https://www.backblaze.com/blog/wp-content/uploads/2022/11/2....
  - extheat 3y ago
    I'm curious if this chart accounts for inflation
  - asah 3y ago
    Thx!!! Looks like the big changes have been with SSD: https://blocksandfiles.com/2021/01/25/wikibon-ssds-vs-hard-drives-wrights-law/ https://blocksandfiles.com/2021/01/25/wikibon-ssds-vs-hard-d...
exabrial 3y ago
Makes me wonder what’s going to happen 100-200 years from now with user names… Can i will mine?
nashashmi 3y ago
The most notorious problem with deleting accounts is the accounts that are used as third-party login. Google can lock me out of my account and I will also be locked out of the other services that don't belong to Google. There needs to be legislation for this kind of thing. Another problem: emails on my old account need to be transferred over. That's the only reason why I need the old account. But there is no simple way to do this. And two accounts cannot be merged either. I have been using a ninja technique that adds something like a Hotmail address as a sign in. Takes out the email data. And then deletes the email account. And then creates a new one. And then reuploads the emails. Annoying as hell. The Hotmail address is the only way my login method remains.
atomicfiredoll 3y ago
I wish they would let me sign in to my account with my old last name, but even though I know the password and have had it for a decade, that's apparently just unacceptable. The company trajectory and the fact that there doesn't seem to be any support for this sort of thing is why I'm ultimately un-googling my current accounts, documents, etc. Edit: The kicker is that I get security notifications about the failed login attempt at the recovery email, so I know they could send recovery information to that address. I trusted them to use the "recovery email" for account recovery when issues like this occur and now that basic trust is gone. It's been said over and over, but this is all another reason not to build your online identity around Google. That said, this policy change makes me really concerned about how difficult it is to run your own email solution that people trust. Today's email ecosystem feels very focused on Gmail and those accounts just became more ephemeral.
Simulacra 3y ago
Suddenly everyone logs into that random Gmail account you created ages ago and never use thereby resetting the clock.

231 points by msla 3y ago

> To reduce this risk, we are updating our inactivity policy for Google Accounts to 2 years across our products. Starting later this year, if a Google Account has not been used or signed into for at least 2 years, we may delete the account and its contents – including content within Google Workspace (Gmail, Docs, Drive, Meet, Calendar), YouTube and Google Photos. Note the may. It is not a guarantee that they will delete!

thimabi 3y ago
That seems to be merely legalese to prevent people from relying on the deletion period and then suing Google when it ends up not deleting something for one reason or another.

paraboul 3y ago

Account handles will not recyclable (for obvious security considerations). So this seems more akin to "permanently disabled" rather than "deleted"

xenago 3y ago
It has been reported that they will not be reusable for exactly that reason. https://9to5google.com/2023/05/16/google-account-delete/ https://9to5google.com/2023/05/16/google-account-delete/
- SoftTalker 3y ago
  There's an argument that this should be done with domain names as well. Right now, anyone can buy an expired domain, set up a wildcard email address, and read any email that's still being sent to addresses in that domain. Conversely, if you take the advice of some to set up a personal domain for your email, you are basically committing to a lifetime obligation. If you later change your mind and let that domain expire, any future owners of that domain will receive any email that was sent to your old addresses.
  - kube-system 3y ago
    And if you don't take that advice, you are committing to someone else's lifetime obligation. Or the extent of their funding/desire/or attention span.
  - davchana 3y ago
    Domains are like real estate. You may end up with a nuce prime real estate in cheap & do nothing. You bought a good domain long ago and not using it. You may buy a domain/property, raize everything & start from scratch. If you abandon a plot/property, domain, and not pay the dues (taxes) or registration fees, anybody can come & claim it through defined procedures. Same way I may buy a home & get mail. Tomorrow if I sell that home I need to do change my address with senders, and make sure to put forwarding (maybe keep the old domain for few weeks/ this year)
  - renewiltord 3y ago
    Interesting. Is there a 302 equivalent for mail so I can start people getting off a particular address?
    - SoftTalker 3y ago
      No standard way to inform the sender of a new address, AFAIK. You can set up a forward to your new email, and keep the old address active and forwarding messages until you're satisfied you've updated (or canceled) all the uses of your old address. Then maybe start bouncing messages for a period of time before you finally shut down your domain.
hackernewds 3y ago
Isn't this a vector for username squatting then?
- nkozyra 3y ago
  How is this more a vector than it is now, though?

xenago 3y ago

Oof. The end of YouTube as we know it

janosdebugs 3y ago
How so?
- bombcar 3y ago
  There are many content creators on YouTube who have gone silent or died, two years from now all those videos will be lost like tears in rain.
  - sphars 3y ago
    In this article[0], it says that YouTube accounts with videos won't be deleted: > At the moment, Google is not planning to delete accounts with YouTube videos. (That would be tricky as some old abandoned clips might have historical relevance.) [0]: https://9to5google.com/2023/05/16/google-account-delete/ https://9to5google.com/2023/05/16/google-account-delete/
    - deleted 3y ago
      [deleted]
    - rurp 3y ago
      For now. It feels like a small leap to go from deleting a person's photos, documents, and emails to deleting their videos.
      - crazygringo 3y ago
        No it doesn't because public videos are designed for public usage. They have comments, are part of recommendations, playlists, and so forth. Deleting private content and deleting public content are two entirely different things. There's zero reason why the former would imply the latter, and many reasons why it wouldn't.

withinboredom 3y ago

This ... is not what is going on. When I worked at $bigcorp serving billions in traffic, what happened is that botnets would create accounts and leave them dormant for weeks/months/years (thousands of them), then start doing their bot thing. Account age says a lot when it comes to trust (usually) and spam detection. That's more than likely what they're seeing, not 'compromised' accounts. All this does is tell the spammers exactly how long they are going to be allowed to have 'sleeper accounts' for, the problem won't magically go away.

vore 3y ago
I am sure Google of all companies has enough insight into account behavior to conclude this is the case for them. It's not like they can't verify it either: if the account previously had legitimate activity and is now compromised, it's not really a sleeper account.
- orbital-decay 3y ago
  Bots, antidetect browsers, and residential proxies exist specifically to imitate the activity and circumvent fraud prevention systems like Google's. Most accounts get caught, but many slip under the certainty threshold. This is a cat and mouse game, and sometimes mouse wins by blending into the crowd. With LLMs it suddenly became much easier. I suspect that the timing of this decision might be not random.
nullityrofl 3y ago
> This ... is not what is going on. I am reasonably confident that Google are more aware of what's going on with dormant accounts on their platform than you are. I previously worked at Google in Security and while it wasn't in user protection, I know they have quite a few signals for determining compromise. It's pretty trivial to see that an account that was in legitimate use for 5 years and then dormant for 5 vs one that was created and left dormant for 10. Yes, on Google and on other platforms, account age is a valuable reputation signal but it isn't the only one.
- 3y ago

thund 3y ago

[flagged]

rurp 3y ago

This is disappointing, albiet not that surprising. It's a good reminder to not rely on Google for long term storage of anything you care about. It's not uncommon for inidivduals in poor health to go through multi-year stretches of very limited activity, especially for elderly individuals. In the future, people in that situation, or their relatives, might be surprised to find a Google account they thought was secure no longer exists.

bombcar 3y ago
It's not just poor health, there's an entire subclass of Americans who don't have internet access for 2 years+ - most anyone in the prison system. Now as a secret unmentionable for any 2+ year sentence: lose access to all your google shit.
- skissane 3y ago
  They can give their password to a trusted friend/family member, and have them log in once every few months to keep the account active. Yes, it’s a pain, what if they forget, etc, but it means a 2+ year sentence does not necessarily entail losing one’s account. Could someone start a subscription paid service for the incarcerated - “we keep your accounts alive while you are inside”? More broadly, could provide other “manage your affairs for you while you are incarcerated” services. I suppose many incarcerated people would have no income or assets to pay for it, but some would, or their family might be willing to pay for it.
  - echelon 3y ago
    Seems like an opportunity (sadly) for a service to manage these things. Google isn't the only provider that would need regular logins. Twitter, Twitch, etc. have account inactivity policies.
  - bombcar 3y ago
    Hell, the local police will probably happily login to your email whilst you're in jail, just sign away your 4th and 5th while you're at it ... It's one more thing you have to know to think about - though if the system counts automated logins as logins, then maybe fetchmail has a purpose again.

Eumenes 3y ago

This seems pretty reasonable. Google is a for-profit company, hosting your shit, for free, indefinitely, isn't their prerogative. They should offer some one-time fee or small reoccurring charge to keep your stuff in hibernation mode or something. Like literally $1.

lakomen 3y ago
Youtube is a defacto time travel machine when it comes to culture as video. You can watch videos from 2004 and earlier. It's the only platform that could allow itself to act against copyright laws. It's part of the cultural heritage of humanity.
- Eumenes 3y ago
  Okay, what does that have to do with Google not maintaining history of the videos you watched? You can still bookmark links, download videos for offline use?
  - sacrosancty 3y ago
    The concern is about the account that posted the videos being deleted along with the videos.

qingcharles 3y ago

I wish I could get into my old Google account. I unexpectedly went to jail for 10 years and when I got out I couldn't log into my account because my 2FA (phone) was gone. I had 10 years of email in there. Would love to find another way to authenticate myself. Looks now like it is all going to be hosed anyway.

vidar 3y ago
Surely there was some buildup to it :)
- lcnPylGDnU4H9OF 3y ago
  "Unexpectedly" in this context might be referring to the actual event in which they traveled from their home to their cell, in which case the unexpected nature could easily prevent them from securing the Google account. I hardly think it matters anyway. Take out "unexpectedly" and their complaint is exactly the same. Suggesting that someone who went to jail shoulda/coulda/woulda taken steps to avoid being locked out of their Google account is not practically different from victim-blaming.
- stronglikedan 3y ago
  It's very easy to be arrested, denied bond, be convicted, and serve your time, without ever leaving the jail/prison system. Especially if you're poor.
  - qingcharles 3y ago
    This. I am a British citizen living in the USA so I waited nine and half years in custody to go to trial.
    - pb7 3y ago
      Why did it take so long?
      - 3y ago

thimkerbell 3y ago

Are there honest lawyers and honest lawyer referral services? Do email and web browsing still work for people who try to use them? My impression is that these are very much open questions.

UltimateEdge 3y ago

Does anyone know what the previous policy was?

sowbug 3y ago
It was originally 9 months. Here is an email my dad received on June 23, 2005. I replaced personal info with XXX. === Hi there, We've noticed that you haven't used your Gmail account, XXX@gmail.com, for quite some time. In order to make Gmail better for our users, we've added a lot of things in the last few months and we hope you'll want to start using your account again. Here are just some of the latest additions: - Free POP access: Take your messages with you. Download them, read them offline, access them using Outlook, your Blackberry or any other device that supports. - More free storage (today and tomorrow): Stop worrying about storage. Your account now has over 2000 megabytes of free storage and our plan is to continue growing your storage by giving you more space as we are able. - 12 more languages: The Gmail interface is now available in UK English, Dutch, French, German, Italian, Japanese, Korean, Portuguese, Spanish, Russian, and simplified and traditional Chinese. If you don't see the language you want on this list, look for it in the future because we're going to keep adding more. - Rich text formatting: Express yourself with fonts, bullets, highlighting and over 60 colors of the rainbow. - And lots more, including support for more browsers, an improved Contacts list, and an easier way to send photos. We're still working hard every day to build you the best email service around. But to keep Gmail great for our users, we may have to close inactive accounts after 9 months. So, we hope you'll give us another chance. To log in to your Gmail account, just visit: http://gmail.google.com http://gmail.google.com. Thanks, The Gmail Team == We sent you this message because we wanted to warn you of your account's inactivity and remind you of our dormant account policies. For more details, please visit our Help Center: http://gmail.google.com/support/bin/answer.py?answer=6563 http://gmail.google.com/support/bin/answer.py?answer=6563 *Protect your Gmail password and your personal information* Google takes your privacy and security very seriously. For your protection, Google will never ask you for your personal information, such as bank accounts numbers, credit card numbers, pin numbers, passwords, or Social Security numbers in an email. For more information on how to protect your Gmail password and your personal information, visit our Help page here: http://gmail.google.com/support/bin/answer.py?answer=8253 http://gmail.google.com/support/bin/answer.py?answer=8253 We sent you this message because as part of signing up for a Gmail account, you agreed to be periodically asked for your comments and suggestions to improve Gmail. If you do not wish to provide such feedback in the future, you may opt-out of receiving Gmail market research messages by visiting: XXX (If clicking the URLs in this message does not work, copy and paste them into the address bar of your browser)

lakomen 3y ago

... I'm about to explode. I have a very old youtube account which I can't recover, in fact there's 2 of them. They have content on them that I will never be able to reproduce, but I watch it from time to time for nostalgia. This post means that Alphabet will delete old legacy content on a huge scale. The world will be poorer for their culture. It will lose the ability to watch very old youtube videos.

Efimeridopolis 3y ago
you are right but for your case, yt-dlp.
somegent 3y ago
You can download youtube videos
neltnerb 3y ago
I only use YouTube through these third party privacy tools. https://libredirect.github.io/ https://libredirect.github.io/ I noticed that when you access YouTube videos through this you can just right click and download.

pcthrowaway 3y ago

I have a google account I haven't been able to log into for some time, because even though I know the password, it flagged "suspicious activity" at some point and has required me to verify with a phone number I no longer have, from when I lived in the U.S. (I now live in Canada, but it did let me log in from Canada when I first moved here) I was hoping that some day, someone would register that phone number and I'd be able to convince them to give me an authentication code, but it sounds like now the account will be deleted before this happens. This really sucks because I think that email was used to register with a bitcoin exchange that I may have some (formerly) tiny balance on. So effectively google has locked me out of an account that could have financial consequences, with no way for me to recover it.

krackers 3y ago
>and I'd be able to convince them to give me an authentication code Unless you got to know them well (as in personally face to face), a stranger asking for a 2fa code would appear to be an elaborate phishing campaign.
- mkoryak 3y ago
  Not even elaborate. Try selling something in FB market place or craigslist. You will get many interested parties who just need to send you a quick verification code for reasons. What they are really doing is signing up for stuff using your phone number. If someone ever asked me to send them a 2fa I would send them the wrong one until they get mad and stop asking me to do it.
- pcthrowaway 3y ago
  Most people honestly don't care. Also, my name is google-able and some "white pages" style sites still list my old phone number, so I could verify my identity in other ways. You'd be surprised what people will do if you talk them into it, lots of people wouldn't hesitate to give their own credentials up, they're not going to take issue giving a 2fa code for something they're not in the process of signing into. This isn't a silicon valley area code or any other area where people are tech-savvy, I'd wager there's a 99% chance that whoever registers the number could be persuaded. I can literally have my family with the same (rare) last name meet them face to face.

jeffbarr 3y ago

I understand the risks of inactive accounts, but as I have pointed out here before these binary policies do not address the all-too-common situation where someone is forgetful and/or incapacitated prior to their death. These people have more important things to think about than their email and their photos,and the transition from alive to dead (to be blunt) can easily take more than two years. By the time that the estate and the executor has control of the account it can easily be too late to save precious memories.

deleted 3y ago
[deleted]

crazygringo 3y ago

I'm seeing a lot of criticism here in the comments, but what's the alternative for free accounts? If you're not using it, how long is Google (a for-profit company) supposed to hold onto your data for free? 100 years? 50 years? 15 years? 2 years seems pretty reasonable to me for something provided by a for-profit corporation. And as other reporting has noted, they're not deleting YouTube videos (makes sense, since while nobody else views your e-mails, public videos are public). People here are saying, what about if you go to jail for more than 2 years, or you're in poor health for multi-year stretches? Then pay for a cheap Google One subscription, export your data with Takeout, or have a trusted friend log in once a year. These are lots of options. If this were a government-provided service then it would be one thing. But it's not, it's a for-profit company that gives you free products in exchange for ads. There are lots of options for keeping an account active. I see no reason why we should expect a company to keep providing storage for dormant accounts beyond 2 years though.

cj 3y ago
Photobucket (remember them!) kept hundreds and hundreds of photos in my account with them despite complete inactivity for over a decade. I simply forgot the account existed, and remembered one day to find a ton of amazing decade old photos. There’s something to be said for doing things that earn your company respect from consumers. Had photobucket deleted my decade old photos because I didn’t log in frequently enough, I’d be pissed and wouldn’t use them in the future. If a small photo storage company can afford to keep customer photos for decade+ with no login, I hope Google can store some text emails for at least 5 years. Re: the jail/health issue, making sure Google doesn’t delete my account would (literally) be the last thing on my todo list if I were on my way to prison or a coma.
- dingusdew 3y ago
  See, I read this situation as entirely differently. Google is not being unreasonable in understanding that they can't afford to store all data from everyone indefinitely. They are not being unreasonable that it is a potential security risk. Where they are being unreasonable is that they have basically gotten everyone addicted to their "free" product, and then, a decade after promoting the idea that no one should run their own services, they should just use free offers in the cloud: they are now admitting the downsides to this arrangement. That Google account that your dead friend had that you keep on your buddy list because it gives you memories? Gone. That Facebook account with your dead family members photos and timeline? Gone. The Twitter account with all the tweets from you child who died too soon? Gone. The lesson should be that if you're hoping for someone else to be the steward of all your digital histories, you're in for a bad time. If you're on someone else's servers, you're bound by their rules, because much like going to their building, you are on their private property. The thing is, they spent over a decade making sure that people trusted that their data would always be there, and that storing it in someone else's private property indefinitely, somehow, wasn't a problem. It was always a problem. If you want to keep your data indefinitely, you have to know how to store it yourself on your own storage mediums that you keep in your own home and on your own computers/servers. So, Google is currently doing nothing wrong, based on the realities of security and cost of data storage. The wrong they did was convincing users for over a decade that this wouldn't happen, knowing full well that eventually it would.

deleted 3y ago

[deleted]

sacrosancty 3y ago

[dead]

grose 3y ago

I seem to have lost my old YouTube account. I used a username (not email) to login, and then I used that same email for a different account, and now YouTube doesn't let you log in with usernames anymore, so it's in limbo. Now it looks like they'll delete all my videos and there's nothing I can do about it.

tech234a 3y ago
You can still use a username to login at https://www.youtube.com/gaia_link https://www.youtube.com/gaia_link which will let you link the channel to a Google account if you still have the password.
- grose 3y ago
  Thank you! I will give it a shot. Much appreciated.

pentagrama 3y ago

This can be bad for many cases, but also good for people who lost access to their accounts and finally that embarrassing YouTube videos and Blogger posts posted with they real names from 2005 when they were 15 year olds will be erased from the internet.

JohnFen 3y ago

> Starting later this year, if a Google Account has not been used or signed into for at least 2 years, we may delete the account and its contents This is great news! I have a couple of Google accounts that I couldn't delete because I lost the login credentials. I appreciate that Google will go ahead and do that for me.

ryandrake 3y ago
Honestly, I wish more online services would do this. My password manager has accumulated hundreds of accounts, many for services I haven't used for years. Probably half of them are "one off" accounts that I had to create because the stupid web site makes you create an account to do some basic thing (that shouldn't require an account). So here all these accounts are, sitting out there probably with my real name and maybe a few other bits of PII in them, just waiting to get p0wned. At one point I started going through them one by one logging in to look for a "Delete Account" button but surprisingly most of them offer no way to do so, or hide it well. Even HN doesn't let you delete your account. I understand they will if you E-mail them, but even then, I don't think they will delete your content. The web needs to be more ephemeral. It by default retains too much "forever and just because".
- Gigachad 3y ago
  I think it will as the data backlogs become larger and the expense greater. Imagine how much Google is spending to store user data on accounts that will never log in again. All the people who have died and had gigabytes of content stored. Eventually it becomes unsustainable to keep everything.
  - charcircuit 3y ago
    >Eventually it becomes unsustainable to keep everything. The number of people on the earth grows exponentially. Babies can subsidize dead people.
    - Gigachad 3y ago

Wowfunhappy 3y ago

> if an account hasn’t been used for an extended period of time, it is more likely to be compromised. This is because forgotten or unattended accounts often rely on old or re-used passwords that may have been compromised, haven't had two factor authentication set up, and receive fewer security checks by the user. Our internal analysis shows abandoned accounts are at least 10x less likely than active accounts to have 2-step-verification set up. Ah yes, because as we all know, the best way to prevent a robbery is to preemptively burn down the whole building. Good luck stealing from me once all my belongings have been turned to ash! --- To be a bit more charitable, it may true that in some cases, getting hacked is worse than just having your account deleted. I'd posit this is the case for a small minority of users, especially when the overall chance of being hacked is still far from 100%. By the way, what about accounts that do have two-factor authentication enabled? Are those exempted? If Google wants to delete inactive accounts, that's their prerogative, but don't hide behind some security argument.

password4321 3y ago

Shutterfly recently purged photos from inactive accounts (no purchase in 18 months) in April, but apparently extended the deadline to the end of May. https://twitter.com/Shutterfly/status/1649072987725864960 https://twitter.com/Shutterfly/status/1649072987725864960

lamontcg 3y ago

If compromised accounts is the problem, then google could change the authorization on them, and require proof to get back into them. Of course that would require some kind of functional consumer-oriented support line where a human working at google could receive identifying information, check that against Google's internal records and public databases (your old phone numbers, addresses, etc) and check against the contents of the account and the old logs in order to determine that the person was who they said they were. That would also solve the problem of so many people in the comments who have old google accounts that they've lost the 2FA/passwords to who are locked out of their accounts, they'd now have a process to go through in order to prove who they are and that they owned the account and get it back. But that would cost Google a lot more money than just even hanging onto the storage, so they're gonna nuke it and make it all go away. Big Tech really needs to be regulated more like a government agency.

kccqzy 3y ago
> Of course that would require some kind of functional consumer-oriented support line where a human working at google could receive identifying information, check that against Google's internal records and public databases (your old phone numbers, addresses, etc) and check against the contents of the account and the old logs in order to determine that the person was who they said they were. This is a highly unreliable, easily gamed non-solution to the problem. If people are determined enough to compromise your accounts, it's easy enough for them to find your old phone numbers, addresses, etc. Websites like https://www.fastpeoplesearch.com/ https://www.fastpeoplesearch.com/ exist, and it provides generally accurate information on people. Humans are always the weakest link. If you allow a random person to convince a Google employee that are the owner of the account, they are going to be tricked. People on HN are always very quick to come to the conclusion that Big Tech not doing something is because of cost, whereas the reality is that the thing HN commenter proposes but Big Tech is not doing is flawed in the first place.
- lamontcg 3y ago
  No, I'm suggesting that you need to prove who you are using a high level of authentication (ideally things like passports). That identification can then be used to associate you with addresses, e-mails, phone numbers, etc using sources like credit agencies and probably Google's own existing information, which can then be associated with the logs on the account. And this should be used for accounts with significant amounts of inactivity so it isn't a process that could be used for actively used accounts. I'm not suggesting that Google employees just trust someone who just says they lived somewhere and had some phone number.

starkparker 3y ago

However expected these policies are, they're always a massive pain in the ass for people who continue to maintain accounts for the dead, and that use case never seems to be considered, except maybe to push those maintainers to just delete everything. For example, one Gmail account I maintain for my deceased partner has another older Gmail account delegated to it. I have the credentials for the newer account, but not the older account. That delegated access is the only way I can get at about 10 years of their life; since I can't login to the account, I can't run a Google Takeout on it, I can't pull it via IMAP, etc. (I'm sure it turned some heads when I logged back into their Twitter account, which became their de facto public online memorial after death, to prevent Twitter from deleting it as inactive.) All of my efforts to recover actual capital-A Google Account access to the delegated account have been either declined or ignored by Google because I'm not the account owner — which, obviously, because I'm not dead. I've offered them death certificates and small-estate proof, but they don't want it or seem to care. Since I can't login to the account, I can't prove activity on it, so this means one day in December that'll just be it. 10 years of correspondence, wedding planning, travel plans, memories straight down the shitter. (Google already "lost" all of the photos in that account that were more than 10 years old; cf. other complaints: https://www.reddit.com/r/GMail/comments/jgr0j9/help_missing_attachments_in_old_emails/ https://www.reddit.com/r/GMail/comments/jgr0j9/help_missing_....) If you want content from a dead person's account, you have to get a court order, and then only if Google accepts your request, which they probably won't: https://support.google.com/accounts/troubleshooter/6357590?hl=en#ts=6357650 https://support.google.com/accounts/troubleshooter/6357590?h... Judging from the contents I think it consumes about 150MB of storage. I'd pay quite a lot to get that account dumped onto a $10 thumb drive so I can back it up. I'd already printed out a binder full of it, which is comical considering it's fucking _email_. Anyway — figure out your digital estates while you're awake and alive because it gets way harder — for everyone, much less you — once you're incapacitated or dead.

Gustomaximus 3y ago

Also note google have a trusted contact option for inactive accounts. I haven't seen this mentioned in the thread and worth doing for some peeps. I set this up so after 6 months of no activity my sister and wife get access to my accounts. https://support.google.com/accounts/answer/3036546?hl=en https://support.google.com/accounts/answer/3036546?hl=en Quite useful if you die or become incapacitated etc so emails, files and photos etc can be kept as needed.

TheSpiceIsLife 3y ago
This is as good a time as any to remind people to get their estate planning sorted. I recently turned <significant milestone>, and had a death in the family who was nearly 100 and had their estate in order which made things a lot less complicated their executor and kin. We now have Enduring Power of Attorney and Enduring Guardian delegated to each other plus two other well trusted people, one local and one distal, jointly and severally; and set up our wills. So our lives now have a trusted back-up operator and a redant pair of back-up operators. N+3. Don't wait till it's too late. This is not legal advice. I am not a lawyer, and I am especially not your lawyer.
- TheSpiceIsLife 3y ago
  redundant* pair

dot5xdev 3y ago

Am I the only one who (mostly) likes this new policy? I actively try to delete my online accounts—and it's _hard_ (or impossible for some companies). I definitely have some Google accounts from like 10 years ago that I lost access to. I'm glad to know they'll be deleted. That being said, 2 years does seem a little short. But, I do like the idea of my data expiring. It seems creepy as hell that someone could go back 10 years and dig up a bunch of information about you that you forgot existed: blog posts, comments, photos, videos, emails, home addresses, phone numbers, credit cards. Data breaches happen. Data brokers find your stuff. Stalkers exist.

Animats 3y ago

Oh, good. My abandoned Google account will finally get deleted.

silverpepsi 3y ago

This is unbelievably generous, I'm happy. I feel like people forget Hotmail et al. circa 2001 when 60 days passed and you lost everything. Sometimes you could keep your account and just the data was wiped out. This was ABSOLUTELY THE NORM on the internet. Google overturned it single-handedly. In Texas my automatic payment for my storage garage where I have $10,000s of my designer clothing collection didn't go through because my bank removed overdraft payments and I missed the email. They made very little attempt to contact me, pathetically little in my opinion, and when I finally caught it barely 30 some days later they said my possessions were all days away from going to auction. It really disgusted me. My whole life is stored there since going nomadic. They don't have a prepay option otherwise I'd gladly pay annually or biannually to play it safe. Based on the US culture, I believe it is their actual goal to take possession of all my things. My only copy of school yearbooks and college degrees are also there. I really doubt any other country is as hostile and would love to move it all to my storage in Thai or France if not for customs and import taxes complications. I didn't use my Hong Kong subway card for 9 years and the balance was still there, in America at almost 0 cost to them to keep it active, the NY subway system 100% would have stolen my money. I fundamentally HATE whan the culture tolerates as normal. Google ain't bad at all.

woodruffw 3y ago
> in America at almost 0 cost to them to keep it active, the NY subway system 100% would have stolen my money. MetroCards expire every 12 months, but every MVM in the city (and every subway station has 2-50 of them) will take an expired one and exchange it for an active one for free. My understanding of the expiry window is that it's meant to correspond roughly to how long a MetroCard survives in a wallet, not to steal your money. (None of this will matter in a few years anyways, the replacement system integrates with existing contactless payment systems.)
- silverpepsi 3y ago
  Very interesting, so perhaps a poor example. I'm used to aggressive policies in the US to take you balance or similarly clean themselves of any financial obligation to you, but off the top of my head I don't have examples handy. Guess I'll document them in the future to see if I have a legitimate argument comparing countries here

Ekaros 3y ago

I wonder if this opens up the addresses for reuse? As these could potentially allow many types of attacks. Or even accessing other accounts. Data can be deleted, but if gmail addresses can be reused in just 2 years that is rather short...

deleted 3y ago

[deleted]

iggldiggl 3y ago

I wonder, does using a delegated calendar also count as activity, or do I now actively have to sign in into that account from time to time? At least some time ago there used to be some wonkiness regarding replies to calendar invitations if somebody sent an invitation to my private mail and I would then accept or decline that invitation via my calendar on my regular Google account, which is linked to a google-specific mail address. So ultimately I ended up creating a secondary Google account for my private mail address and then delegated full calendar access from there to my main account, which is also the one signed-in on my phone.

hacky11 3y ago

[dead]

deleted 3y ago

[deleted]

turtleyacht 3y ago

As a part of the criteria for an active account, I wish they would include "forwards to another active account." Otherwise, you need to sign in on those accounts every so often, but they are essentially empty.

bhelkey 3y ago
> Before deleting an account, we will send multiple notifications over the months leading up to deletion, to both the account email address and the recovery email (if one has been provided).
- tjoff 3y ago
  ... still need to sign in.

asah 3y ago

related question: given plummeting prices per GB for raw storage, I'd have expected the cost of hosting storage to drop per GB as well, and yet we haven't seen a commensurate drop, even given competitive pressure. What gives? Yes, I know there's many other costs but I'm talking about * PER GB * and just for storage not access. A disk drive roughly takes the same amount of space/power/cooling regardless of capacity, so if you install 2x larger drives then cost ** PER GB ** should fall in half. And yet, we haven't seen that among cloud providers. This should mean that inactive accounts quickly drive to near-zero cost, since they're nothing but storage capacity. Photo hosting should drive to zero. etc etc etc Can anyone explain ??

pradn 3y ago
No, storage costs aren't plummeting. They've been largely stagnant the past 3-4 years. I don't think the reduction in the number of drives for the same amount of storage is as significant as the cost of the drives themselves. https://www.backblaze.com/blog/wp-content/uploads/2022/11/2.jpg https://www.backblaze.com/blog/wp-content/uploads/2022/11/2....
- extheat 3y ago
  I'm curious if this chart accounts for inflation
- asah 3y ago
  Thx!!! Looks like the big changes have been with SSD: https://blocksandfiles.com/2021/01/25/wikibon-ssds-vs-hard-drives-wrights-law/ https://blocksandfiles.com/2021/01/25/wikibon-ssds-vs-hard-d...

exabrial 3y ago

Makes me wonder what’s going to happen 100-200 years from now with user names… Can i will mine?

nashashmi 3y ago

The most notorious problem with deleting accounts is the accounts that are used as third-party login. Google can lock me out of my account and I will also be locked out of the other services that don't belong to Google. There needs to be legislation for this kind of thing. Another problem: emails on my old account need to be transferred over. That's the only reason why I need the old account. But there is no simple way to do this. And two accounts cannot be merged either. I have been using a ninja technique that adds something like a Hotmail address as a sign in. Takes out the email data. And then deletes the email account. And then creates a new one. And then reuploads the emails. Annoying as hell. The Hotmail address is the only way my login method remains.

atomicfiredoll 3y ago

I wish they would let me sign in to my account with my old last name, but even though I know the password and have had it for a decade, that's apparently just unacceptable. The company trajectory and the fact that there doesn't seem to be any support for this sort of thing is why I'm ultimately un-googling my current accounts, documents, etc. Edit: The kicker is that I get security notifications about the failed login attempt at the recovery email, so I know they could send recovery information to that address. I trusted them to use the "recovery email" for account recovery when issues like this occur and now that basic trust is gone. It's been said over and over, but this is all another reason not to build your online identity around Google. That said, this policy change makes me really concerned about how difficult it is to run your own email solution that people trust. Today's email ecosystem feels very focused on Gmail and those accounts just became more ephemeral.

Simulacra 3y ago

Suddenly everyone logs into that random Gmail account you created ages ago and never use thereby resetting the clock.