You probably can’t name every service that has your email, your address, or an old password on file. The average employee juggles around 87 passwords, and most people never go back to close the accounts they no longer use. That pile-up matters: 79% of U.S. adults say they’re concerned about how companies use their data, yet few ever audit where their own data actually sits.
How a dormant account becomes a live risk
Every account you create leaves a trail: an email address, a password (often reused), sometimes a phone number or a saved payment method. When you stop using the service, none of that disappears. The company keeps the record on a server somewhere, often with no deadline for deletion. Over years, you accumulate shopping sites from a one-time purchase, forums you joined for a single question, apps you tried once, and newsletters you never unsubscribed from. Each one is a separate place where your personal details sit, unmonitored. If that company suffers a breach, your old password resurfaces in a leaked database, and if you reused it anywhere active, attackers can walk straight into your current accounts. The more forgotten accounts you have, the wider the surface an attacker — or just a careless data broker — has to work with, and you won’t even know which ones to worry about until something goes wrong. This is partly why the average person ends up managing so many credentials in the first place: with 87 passwords to track, it’s practically guaranteed that some of them belong to services you haven’t thought about in years. Add to that the fact that 79% of U.S. adults already say they feel they’ve lost control over how their data is used, and it becomes clear that dormant accounts aren’t a minor annoyance — they’re one of the main reasons that feeling of lost control exists. Companies rarely advertise how long they retain inactive account data, and many retention policies default to “indefinitely” unless a user actively requests deletion. That default puts the burden entirely on you to go looking, since no notification will ever arrive reminding you that a service you used once in 2017 still has your home address on file.
A familiar pattern
x
The following is a composite scenario built to illustrate the pattern, not an account of a real person. A user signed up years ago for a recipe site, a now-defunct deal-of-the-day service, and a fitness app she used for three weeks before giving up. All three still hold her name, email, and in one case a saved card. She reused the same password across two of them because it felt easier at the time. Years later, one of those services is breached and the credentials leak online. She doesn’t find out until a login attempt on her email account triggers a security alert. Tracing the leak back takes her an evening of searching old inboxes for sign-up confirmations she barely remembers receiving. None of this required a sophisticated attack — just an old account nobody thought to close. What makes this scenario so common is how unremarkable each individual decision was: skipping account deletion after a trial period, reusing a password because the sign-up form felt unimportant, letting a confirmation email sit unread. No single choice looks risky in isolation. It’s only the accumulation, spread across years and dozens of services, that turns into a real exposure — and that accumulation is exactly what most people never stop to measure.
Close the accounts before they close in on you
Finding old accounts is mostly a search problem, and deleting them is mostly persistence. You don’t need to hunt down every account that ever existed on the first afternoon — you need a repeatable process that steadily shrinks your footprint over a few weeks.
Search your inbox for sign-up trails
Search your email for terms like “welcome,” “confirm your account,” “verify your email,” or “password reset.” These searches surface services you forgot you joined, often years apart. Make a simple list as you go: service name, the email used, and whether you still need it. Don’t delete anything yet — this step is purely reconnaissance, and a thorough pass through several years of inbox history usually turns up more accounts than people expect. It helps to work backward chronologically, starting with the oldest messages your mail provider will show you, since the accounts most likely to be forgotten are the ones you created years before you started paying attention to privacy at all.
Check your password manager and browser-saved logins
If you’ve used a password manager or let your browser save logins, open the full list rather than just the autofill suggestions. Entries you haven’t touched in over a year are good candidates for deletion. Cross-reference this list against the one from your inbox search — together they give a far more complete picture than either one alone, and they often reveal reused passwords that need changing regardless of whether you close the account. While you’re in there, note which passwords are duplicates of each other; a single reused password across five dormant accounts is five separate points of failure, even if you never log into any of them again.
Request deletion, not just deactivation
For each account you no longer need, look for an account deletion option in settings, not just a sign-out or deactivation toggle, since deactivation often just hides the account while keeping your data intact. If you can’t find a deletion option, email support directly and ask them to delete your personal data. In regions covered by data protection law, companies are generally required to act on that request within a defined timeframe, so keep a copy of your request in case you need to follow up.
Set a recurring reminder to repeat the process
A single cleanup pass only fixes the backlog that already exists — it does nothing about the new accounts you’ll inevitably create over the next six months for a one-time purchase or a trial subscription. Put a recurring reminder on your calendar, every three to four months, to repeat the inbox search and review your password manager list. Treating this as a short recurring task rather than a one-off project is what actually keeps your footprint small over time, instead of letting it quietly rebuild itself.
Why a privacy-focused browser makes this easier to repeat
The hardest part of cleaning up old accounts isn’t the first pass, it’s remembering to do it again. A privacy-oriented browser helps on both fronts. It blocks third-party trackers that quietly link your browsing across the very sites you’re trying to leave behind, so closing an account actually reduces how much a company can infer about you afterward. Built-in breach alerts can also flag when a login tied to one of your old accounts shows up in a leak, giving you a concrete reason to go back and finish deleting it. Some privacy browsers also surface a dashboard of saved logins and trackers per site, which doubles as a rough inventory of where your data lives — exactly the list you need when doing this kind of audit. None of this replaces the manual work of requesting deletion, but it removes the guesswork about which accounts are still actively tracking you versus which ones are simply sitting dormant, and it makes repeating the cleanup every few months far less tedious. Over time, the combination of a shrinking account list and fewer active trackers compounds: each deleted account removes a potential breach source, and each blocked tracker removes a way for remaining companies to reconstruct a profile of you from the accounts you still use.
NordVPNaffiliate link
Encrypts your connection on public Wi-Fi and on the go