7 ms·

Ask HN: Will Google delete inactive gmail accounts that forward email?

69 points by tikkun 3y ago

Google is doing their "deleting inactive account" thing. I have some old gmail accounts that forward email to my main account. I don't login to the old ones, but I read the mail that comes through. Does anyone know if they'll count those old ones as inactive and delete them?

kosherhurricane 3y ago
The way I read their deletion terms, if you have some money in the account's Play Store Balancee (say by depositing a $10 gift card), they won't delete those accounts.
- Terretta 3y ago
  Came to the thread to say this. The same is apparently not true about the old Grand Central phone numbers though. The account will still be active for phone but the number will be gone.
cj 3y ago
Google will send you notices to your backup/recovery email if and when a time comes that they want to delete the account. Make sure you have a backup/recovery email on the old accounts and you’ll be notified before anything irreversible happens.
- zuccs 3y ago
  Except Google blocks you from logging in to your own account even if you can receive the forwarded emails elsewhere.
totetsu 3y ago
Why not Just log into those accounts once?
- cute_boi 3y ago
  Many account don't log in because of security issue. They start to ask recovery email which I have forgotten or phone number that I don't have access anymore.
  - doc_gunthrop 3y ago
    Just set the forwarding address as the recovery email.
    - SamBam 3y ago
      They'd have to go back in time to do that if they can't get in... that's the point.
arkitaip 3y ago
Your forwarding accounts will probably be deleted according to their policy [0] as an active account is specified as "include these types of actions you take when you sign in or while you’re signed in to your Google Account: * Reading or sending an email * Using Google Drive * Watching a YouTube video * Downloading an app on the Google Play Store * Using Google Search * Using Sign in with Google to sign in to a third-party app or service" [0] https://blog.google/technology/safety-security/updating-our-inactive-account-policies/ https://blog.google/technology/safety-security/updating-our-...
- pmontra 3y ago
  "Downloading an app on the Google Play Store" is what will spare my account and any body's with am Android phone.
taneq 3y ago
Likewise curious about this, I haven’t actively used my gmail account for 5+ years but I still get the occasional genuine email forwarded to my real account from it. Also curious whether “deleted” means “actually erased” or just “removed from gmail and your mailboxes added to the pile”.
mattl 3y ago
Why not have something log into those accounts and pull the email into your main account?
- thatxliner 3y ago
  That's what email forwarding is, i.e. using IMAP or POP. OP is just asking if that counts as "logging into" the Google account
  - guraf 3y ago
    > That's what email forwarding is, i.e. using IMAP or POP. No, mail forwarding is SMTP and requires no access to pop/imap. What you're thinking of is the ability of Google to fetch from other accounts using POP. Once mail forwarding is setup you can lose access to the account and it will still with. In contrast pop fetch will only work as long as you can log in the account. They can both achieve similar goal (have mail from one account show up in another), but they work in fundamentally different ways
  - mattl 3y ago
    It’s not at all what email forwarding is.
rtuin 3y ago
Maybe sharing my experience helps in some way: I’ve been using a handful of these accounts nearly 10 years ago. Not much if any mails received on them for at least a few years, and received the inactive notification for all of them last month. Note the nuance that these account didn’t have mail to forward for several years.
arbuge 3y ago
All those people in this thread saying to just login to these accounts to reactivate their deletion timers are off track. It is virtually impossible to login to an old Google account for which you never set a recovery phone number - and completely impossible if you did set one but no longer own it. And there is no human support of any kind at Google that you can discuss it with.
- NoZebra120vClip 3y ago
  [flagged]
  - guraf 3y ago
    How do you subscribe to Google One if you can't sign onto your account? Create a new account just to give Google some money and pray that they'll give you support about another account?
    - b112 3y ago
      Not to mention, google is the flakiest company ever. Even if you paid for supoort, the second you tried to use it, you'd likely find it canceled, google having moved on, distracted by some new shiny. Oh, that support was for google video, but we transitioned your account to Android TV and then Play Video and that support isn't valid, because I'm a vapid airhead called google! Jesus Google, the average person doesn't want a soap opera and drama, just to use core services.
  - invalidname 3y ago
    I paid 400 USD per month for their support and this is completely untrue. Google has a culture of unhelpful support. They might have someone that answers the phone. But they will NEVER help you. It's against the Google DNA to help individuals.
    - VHRanger 3y ago
      We have AdWords accounts that spend 6-7 figures a year and it takes 3 weeks to escalate a ticket correctly.
xyzzy_plugh 3y ago
I receive emails on several accounts I never log in to, which forward through my main account and they do not appear to be flagged as inactive.
- layer8 3y ago
  Deleting inactive accounts is a new Google policy only starting this coming December: https://support.google.com/accounts/answer/12418290 https://support.google.com/accounts/answer/12418290
  - xyzzy_plugh 3y ago
    No. From the announcement email: > While the changes go into effect today, the earliest we would enforce any account deletion would be December 2023. > If your account is considered inactive, we will send several reminder emails to both you and your recovery emails (if any have been provided) before we take any action or delete any account content. These reminder emails will go out at least 8 months before any action is taken on your account. I have no indication that any of my accounts are inactive and thus there should be no action for the next eight months.
    - layer8 3y ago
      My understanding is that the reminders will only start in December, and then actual deletions will only follow after the appropriate grace period. My point is that you shouldn’t be surprised that you are not yet seeing any indications of your accounts being considered inactive. I have several inactive accounts myself and haven’t received any reminders as well.
      - xyzzy_plugh 3y ago
        That may be true, but then I fail to see how it is possible that an account could be deleted per this policy in December. The wording seems to clearly indicate that deletions could happen in December, which implies that notice would have to already have been given.
nickdothutton 3y ago
Trite reminder: Google sells advertising, not email accounts. P**ing off an individual email user (or many tens of thousands of them) is not something they are going to worry about. What are you going to do, stop using the Internet?
- tourmalinetaco 3y ago
  > What are you going to do, stop using the Internet? No, simply cut them out of my life while using AdNauseum to bleed them dry. The Internet existed before Google and will continue existing after they are gone.
- prepend 3y ago
  What I’m going to do is not trust google. Not trust their AdWords and look for alternatives. Not trust GCP and use aws and azure. Not trust new products. Google’s brand is interconnected and it’s shortsighted of them to think “it’s just a few thousand inconvenienced.” Imagine if Whole Foods also had a product line that sold caviar and they swapped it out for dog shit and they didn’t care because it only affected a few thousand customers. It’s not the number of customers that are important, it’s the reflection of the organization. It’s deontology vs utilitarianism. Trying to do spot based utilitarian calculations without considering what principles lead to overall good is a stupid thing for an org to do.
  - justin66 3y ago
    Somewhere a Google executive is writhing on the floor, moaning from pain and despair. "Prepend's words burn like fire." As the OP said, What are you going to do, stop using the Internet?
    - allarm 3y ago
      I use the Internet just fine without google, not sure what you’re on.
    - prepend 3y ago
      I am Spartacus.
erlkonig 3y ago
Putting any personally important email account in the hands of some huge corporate provider is pretty much always a recipe for eventual problems. Although big companies also have some leeway to steal domains (and the associated email addresses) from small companies and hobbyists, so just trying to keep your email to yourself doesn't solve everything. Of course, that nearly every domain anyone wants is taken already is also a bane on us caused by a big company - Network Solutions, the privatized descendant of the Internic, as they realized their old rule of one entity / on domain didn't have to be followed, and blithely made their first evil sale of 80-odd domains to some household name drug company that wanted a domain for each common ailment or something. The idea of saving readable domains for future generations went right out the windows once someone waved money under their nose (and they didn't use that money to improve their UX for over a decade), and now virtually all registers are shills for shoving domains you don't need down your throats. Ugh. At least the old Internic had ethics. Just like Google had the do-no-evil motto - somehow I doubt that's still a thing. Good luck getting a lost email account of them - they didn't give my Google phone number back even though the system still knows it's mine. A bit off topic at this point, sorry.
- fortran77 3y ago
  Owning the domain is a good compromise. I own my domain but it’s managed by Outlook. If I ever lose my Microsoft login, I can update the DNS and switch email providers.
  - jacekm 3y ago
    It's good as long as you don't forget to pay the yearly fee. Sure, they send reminders, but if you don't log in to your account often then it's easy to miss them. I lost a couple of domains this way...
- theshrike79 3y ago
  In Finland we have Iki Ry[0], which is basically a non-profit that does nothing except give people access to @iki.fi email addresses. They've been running since 1995 IIRC and they collect no monthly fees, just a one-time joining fee. They don't do homepages, shells, mail hosting or anything - just an email address you can forward anywhere you want. Nothing is stopping anyone from doing the same elsewhere in the world, all you need to do is NOT try to make it into a billion dollar unicorn startup with a hockey stick growth curve. Just make enough money to keep the lights on and maybe pay something to person or two who manage the stuff part-time. [0] http://www.iki.fi/ http://www.iki.fi/ (Iki is a version of the Finnish word "ikuinen" meaning forever)
glennos 3y ago
Not sure but sounds like you’ll have time to try avoid the deletion. The warning emails should forward to your main account. “Before deleting an account, we will send multiple notifications over the months leading up to deletion, to both the account email address and the recovery email (if one has been provided).”
lagniappe 3y ago
This is oddly comforting tbh.
freitzkriesler2 3y ago
One of the best ways to prevent the count down timer from even starting is to take an old android or iOS burner phone, sign into Google services, leave the phone powered on and connected to a Wi-Fi network, and then walk away. The countdown timer will never start and it satisfies one of googles requirements. Another way is to deposit cash into something like Google voice or playstore. I used to use Google voice to call internationally and have like $4 in there. Google won't ever delete this account because of my unused funds. Annoying but worth it if the account is valuable to you. Regardless, remember when Google used to have that storage counter that kept going up? I do.
ajonit 3y ago
So I checked with Google One support, here is the answer from them: (and they were fine with me quoting them in a public forum) Q: if I have an email account X and it auto-forwards email to an email account Y , will X be considered as an active account A: “The short answer will be NO. Google considers an account active if there is a recent login to the account.”
- kyleee 3y ago
  Disgusting position, thanks for sharing though
shinryuu 3y ago
Anecdata of one. I've got a Gmail address that forwards emails to another address. Somehow I can no longer login to the address that forwards these emails and I can't reset my password. It's been like that for a long time. Suffice to say I'm transitioning away from Gmail. I also assume that there are more people like me in this situation.
- gsuuon 3y ago
  What are some good alternatives?
llimos 3y ago
What about delegated account access? Is that considered a login, given it wasn't using the credentials of the account being accessed?
andrei_says_ 3y ago
Does checking the email via the iOS gmail app count as logging in? Or does one need to explicitly log in via a browser?
replwoacause 3y ago
Posts like these make me so happy I cut all Google services out of my life. It really is an evil, unreliable company.

DistractionRect 3y ago

Except we see this all the time on HN. Google support is yelling loudly into HN/Twitter and hoping a Googler picks up your case internally. The way Google has proven to work, is you have support until the AI/ML model says terminate the account. Essentially, support exists until you need it most. There's no warning, no explanation, just one day you're done, locked out. You can't even export your content off the platform once terminated. I don't see how Google One is expected to help users when developers for Android/Stadia which pay Google a heck of a lot more end up the same creek [0] [1] etc. You even concede it probably won't be helpful. [0] https://news.ycombinator.com/item?id=37224391 https://news.ycombinator.com/item?id=37224391 [1] https://news.ycombinator.com/item?id=26061935 https://news.ycombinator.com/item?id=26061935 They eventually get reinstated (looks like d4rken got reinstated last night), but not before they take to social media and Google gets requests for comment from a handful of news outlets. And still, they usually have no idea what they did/didn't do to cause it. They're left guessing but ultimately could have the rug pulled again at anytime.

d4rken 3y ago
Your description is pretty on point. It was eerily casual in relation to how much turmoil it creates for me. One day it was gone, another day, it was back. I have no idea why anything happened. I also think that social-media reach has helped my case. It feels very dystopian that this is de-facto way to approach these issues with mega-corps.
- DistractionRect 3y ago
  It's ridiculously dystopian. At a whim they can end a person's livelihood, and depending on how integrated one is in their ecosystem, just erase their whole interface with the world. Unless you get a personal comment from a Googler on social media, there isn't a drop of humanity in the whole thing. Heck, it's almost ritualistic, like how some religions pray/yell out to the God's and craft offerings to appease them. Instead of rain, we pray for access.

0x0000000 3y ago

I'm in this boat. I have valid credentials for my (now deceased) dad's Gmail account. But I can't login because Google doesn't trust my valid credentials and insists on sending a recovery code to a phone number that hasn't been in service for a decade. His hotmail account I can get into no problem. There used to be a time when you would trust Google ten times more than Microsoft not to mess with your account, lock you out, delete you for inactivity. Those days are long gone, fuck Google.

toomuchtodo 3y ago
Have you considered filing a complaint with the FTC? I’ve contacted them recently with regards to how Big Tech unilaterally handles account security with no consumer recourse for these cases, so follow on complaints from those experiencing this would be helpful.
- kamilm 3y ago
  "Federal Trade Commission | Protecting America's Consumers" - what about the rest of the world? Does anyone know whether it makes sense to exercise this option for non-American citizens? I can't log in into my Google account either. And yeah, the account was free (money-wise) - judging by FTC's forms, the paid accounts are the ones that matter.
  - basisword 3y ago
    Most countries have an equivalent body and given Google operates globally they could help.
  - lazide 3y ago
    Might be worth trying since Google is headquartered in the US. More complaints on the pile get more attention.
dataflow 3y ago
Long shot, but have you tried contacting the person with that phone number?
- NoZebra120vClip 3y ago
  Seems legit: <Total stranger> Hi, when you receive some TOTP codes on your phone, those are supposed to be mine. Could you be a lad and just forward those on to <random number>? Thx!
  - dataflow 3y ago
    If you want to sabotage your chances, that's one way to do it. Or you could write something else that's more likely to be successful.
  - lazide 3y ago
    “Hi, my Dad died a number of years ago and this was his old number. I’m trying to reactivate one of his old accounts as there are a lot of old memories that mean a lot to me in there. Any chance you could forward the signin texts you get so I can do that? I’d greatly appreciate it, and I’ll change the info as soon as I can so you stop getting spammed. Thank you for any help you can offer!”
    - dataflow 3y ago
      And you can get a lot more creative than that. Even paying them, verifying your identity for them, etc. See the thread from the last time I mentioned this for a few ideas: https://news.ycombinator.com/item?id=32862891 https://news.ycombinator.com/item?id=32862891
      - IvanMilatForPM 3y ago
        [dead]
    - NoZebra120vClip 3y ago
      “Hi, I'm a Nigerian Prince, and my Dad, the King, was brutally assassinated by the opposition a number of years ago and this was his old number. I’m trying to reactivate one of his old accounts as there are a lot of evidence that mean a lot to me in there. Any chance you could forward the signin texts you get so I can do that? I’d greatly appreciate it, and I’ll change the info as soon as I can so you stop getting spammed. Thank you for any help you can offer!” "Oh and I have $500 to sweeten the deal, just send me your bank deets." In seriousness, it is not impossible to envision a near future when it would be illegal to share TOTP codes or other secrets related to security/authentication. If someone is the target of your scam and shares these things, perhaps he can just be sued into the Stone Age by the allegedly dead grandfather with all the nice photos. I don't care how you sugar-coat your cutesy text messages, this sort of scheme sets off every social-engineering red flag possible. How rude, to ask a total stranger to share secrets. Many of these texts are explicit: "don't share this with anyone!"

judge2020 3y ago

Human support of any time opens up tons of social engineering situations that enable account takeovers - and these hurt Google’s reputation more than any abandoned account story. What do you suggest would be sufficient proof to the Google human support representative that would verify that you actually did own that account? They already have a process in account recovery that includes inputting the last password you know, entering the month you think you opened the account, and answering some extra questions, after which a human reviews your answers to determine if it’s really you. I’ve had this done for one of my old accounts and I was granted a link to reset the password for that account and set up new recovery details.

dotnet00 3y ago
>Human support of any time opens up tons of social engineering situations that enable account takeovers - and these hurt Google’s reputation more than any abandoned account story. That's an absurd assertion to make. Amazon makes it very easy to get a hold of a human for support (particularly compared to Google), they have no issue with social engineering driven account takeovers despite that it'd be pretty easy to cause significant financial damage within just a few hours.
- morpheuskafka 3y ago
  All Amazon accounts that have ever purchased something are linked to a name, payment card, and address. A random Google account might not have any of those. How could Google possibly tell who has access to it?
  - dotnet00 3y ago
    For example, if an account has been inactive for years and suddenly someone is trying to login, is consistently making an effort over a reasonably long period and is willing to prove their own identity in some official way (such that if it turned out they were lying they could be trivially identified and prosecuted), then they can reasonably allow access. On the other hand, if an account is still actively logged into, it would be obvious that anyone else trying to get access should not be allowed to do so.
    - judge2020 3y ago
      This happens all the time via credential stuffing - or even after credential stuffing someone's email inbox and searching through all relevant account activation emails. Just saying "lower the security if it's been x years" isn't adequate and could cause serious harm if the abandoned account has important or secret information on it. Better to keep it secure and inaccessible if there is any doubt that the human is an attacker.

flangola7 3y ago

> It is virtually impossible to login to an old Google account for which you never set a recovery phone number Define impossible? If you've forgotten the old password obviously you can't get in. I don't see why it would otherwise be impossible.

lawn 3y ago
Clearly you haven't done this yourself, because it's not enough with just your password.
- flangola7 3y ago
  So what happens? If there's not a backup phone number or email set, what could they possibly ask for beyond the password?
  - bassdart 3y ago
    They ask for your current mobile number -- at least in germany and without any anonymization beside standard browser configuration like e.g. uBlock Origin. So it's simply to suck in numbers. I have not tried if they ask for more data after giving a phone number and so I can't log into two google/youtube test accounts any more since a few years.
    - jacekm 3y ago
      The phone number is the last step, at least it was for me. I had luck with virtual phone numbers, not the freely available ones, but paid apps like e.g. Vyke.
    - flangola7 3y ago
      So what happens after you use Chrome and type in your number?
SamBam 3y ago
Because Google can unilaterally reject valid credentials if it doesn't feel it's certain it's you. Although I can see why this would be impossible if you have a phone number set that you no longer own. I'm not sure what exactly Google would ask for if you never had a phone number set.
- headsman771 3y ago
  I never gave a recovery phone number for any of my accounts. While they regularly ask for one to improve my security, I've never given one and they continue to accept my logins from all over the US as well as granting some apps (thunderbird) access to the account. I do however get notifications on my phone asking if the login was me.
- duskwuff 3y ago
  > Because Google can unilaterally reject valid credentials if it doesn't feel it's certain it's you. Unbelievably, this even includes rejecting credentials for a non-GMail Google account, even after the user has clicked a link to confirm ownership of the email account the account is associated with. Ask me how I know!
epc 3y ago
I have an ancient alternate identity Yahoo account which I used as the recovery account when I created a similarly named Gmail account. Have used each every few months. Each specifies the other as the recovery or backup account. Neither has 2FA set up because I did not want to tie my cell phone to the identity. I am now locked out of both accounts because…each sends a second factor code to the other. It isn't a huge loss to me…though recruiters trying to recruit the related but obviously fake LinkedIn profile may be saddened to never get a reply. I totally understand why Google, Yahoo, and others are purging inactive accounts. Between GDPR and widespread account takeovers it's an expensive nuisance (and if the account is "inactive" then it's not generating meager advertising revenue to pay for the nuisance).

gnu8 3y ago

The thing that baffles me the most is that literally no one at Google has thought of this. They should be having meetings where they come up with scenarios like this and plan out realistic ways of dealing with them. Google isn't responsible enough to run an email service, it's a toy business where techbros fuck around all day.

lazide 3y ago
They have and do. The issue is fraud and account compromises are so common (due to password reuse being the norm and every other site under the sun getting compromised), that they’re in a catch-22. Support can be Social Engineered easily (especially if you don’t spend massive amounts of money on it). Making support not socially engineer-able is essentially impossible too with their user base, as the user base is too diverse. Technical solutions currently suck, even if we ignore that most of the population is unable to effectively use them. There is no consistent way across their user base to even verify a person exists, let alone that they are who they say they are, let alone that they are who created or owns the account! And no one even puts the closest local equivalent into their Google account for legitimate reasons anyway. Like who would want to upload their Birth certificate? Or passport? Or DL/ID? That’s a terrible idea. And many people don’t have the US equivalent to one anyway. Not to mention, deep fakes have gotten really good. Not that a US company is going to have much luck identifying a fake (or real!) Belgian equivalent for instance anyway. So they go with heuristics, which always have edge cases, try to hide what rules they use to avoid being gamed at scale, and hope for the best. Not great. But seriously, what else are they going to do?
- gnu8 3y ago
  Thank you for the thoughtful reply. I will admit I was fulminating a bit. I'm just extremely frustrated that their solution to edge cases is to drop them on the floor and there's nothing to be done. No individual Google user actually matters to the company, but many people actually need their email account. The asymmetry of power and money here just isn't sustainable.
  - lazide 3y ago
    I get it. It really sucks. Banks doing it too is also really shitty. I didn’t take it personally, I hope you didn’t either. At some point I’m hoping a sane plateau becomes apparent. Or at least a realistic ‘plan B’ for how to recover from this. Generative AI though is really poisoning the online well, and I don’t know what we’re going to do about it. Captchas were never great, but near as I can tell they’re literally only stopping real humans now, for instance. When someone can easily gin up thousands of impossible-to-tell-they’re fake IDs for people that never existed? That breaks almost every verification process anyone has right now. Except in person ‘show up and provide the actual physical ID’. and that’s the reality we live in.