Google Warns Gmail And Photos Content Deletions To Start December 2023

There are a staggering 1.8 billion Gmail active users, according to the latest statistics. Regarding Google Photos, there are an estimated 2 billion active users. Google has recently warned that starting in December, inactive accounts will be purged on security grounds. But how does Google define an inactive account, and how can you prevent emails, photos, and other content from being deleted?

07/29 update below. This article was originally published on June 28.

What Has Google Said About Gmail And Photos Content Deletion?

Although billions of people use Google services such as Gmail and Google Photos, the percentage reading Google’s safety and security blogs will be insanely small. I read them because it’s my job, and even then, I occasionally miss something important. Such was the case with an update to inactive account policies in May when I took some time off work for health reasons. Yet this seemingly innocuous update contains a vital warning for Google users about a cross-service content purge. Google has also sent emails concerning the forthcoming account purging, but these were also missed by me and, I’m going to therefore assume, others. Hence the need for this reminder.

In the short policy update posting, Ruth Kricheli, a vice president of product management at Google, warned that users of inactive personal Google accounts could see those accounts, and their content stored within Gmail, Docs, Drive, Meet, Calendar, and Google Photos, deleted in a purge starting from December 2023.

Google’s inactive policy for accounts, Kricheli stated, now applies to those that have not been used or signed into “for at least two years” across all products.

Which Google Accounts Will Be Deleted In December?

Kricheli was at pains to point out that the account and content deletion process, which starts in December, will be rolled out “slowly and carefully, with plenty of notice.” So, for example, we know that the first accounts to be targeted will be those created but never actually used again.

MORE FROM FORBESGoogle Chrome: Update Now As 20 New Browser Security Fixes ConfirmedBy Davey Winder

Moving forward, users will be made well aware of the intention to delete accounts and Gmail and Google Photos content along with them. “We will send multiple notifications over the months leading up to deletion,” Kricheli said, “to both the account email address and the recovery email if one has been provided.”

Why Is Google Purging Inactive Accounts?

It might surprise you to learn that Google has made this change to the inactivity account policy for security reasons. The policy update posting pointed out that accounts going unused for extended periods are more likely to become compromised, not least as they may rely upon re-used or old passwords with a higher risk of compromise themselves. Then there’s the small matter that older, forgotten-about accounts are less likely to have implemented two-factor authentication. “Our internal analysis shows abandoned accounts are at least 10x less likely than active accounts to have 2-step verification set up,” Kricheli explained.

07/29 update: To address the security issues that Google has found associated with accounts that have gone unused for an extended period, namely credential compromise, you should consider using a password manager application alongside activating two-factor authentication.

Starting with the password manager application, this is something that I highly recommend you use for all accounts, Google-related or otherwise. Not only will your password manager application make it easy to select unique and strong passwords for every individual account or service, but you won’t have to struggle to remember them either. The only password you need to remember is the master password that unlocks access to your password vault. This, naturally enough, will need to be strong itself. So, how will you remember that? As insecure as it might sound, you could always write it down. The truth is that, for most users, most of the time, nobody is going to break into your house and then search for a master password you may or may not have written down and hidden somewhere. Some applications will let you choose between a long random string of characters and a passphrase comprising a number of random words. Passphrases can be just as secure and are easier to remember if you really don’t want to write them down. You could also employ a hardware security key if the password manager supports it.

Although naysayers a-plenty warn that putting all your passwords into one cloud-based basket is the opposite of good security, I would politely suggest that this is nonsense. Firstly, not all password managers are cloud-based, and those that are will often have the option to store your password database locally. Secondly, if you do your due diligence before settling on the password manager to use, you will discover some have your cloud-based password storage security well and truly covered. My go-to password manager has long been 1Password, which uses a cloud-based system to sync your credentials across different devices. “Our systems are designed so that your data would remain safe even if an attacker gained access to our servers,” 1Password says. All data stored within 1Password is fully encrypted, including vault names, website URLs associated with saved passwords, and the passwords themselves, of course. Even if a hacker were to get access to your master password, they could not decrypt your passwords without a separate secret key. This 128-bit secret key is account specific and generated on your device when the account is initially created and remains there. You don’t need to memorize it; 1Password automatically combines it with your master password to generate the encryption key. You can read the full technical detail here, but rest assured it means that unless someone has physical access to your computer or smartphone and knows your master password, your password vault is safe. If they do have those things, then it’s game over whatever. Just know that using such a service is way more secure than relying on a handful of easy-to-remember passwords shared between accounts.

Which leaves us with the two-factor authentication issue. Enable this on all your Google accounts, and do it now. Combined with solid password security, 2FA is an additional lock that attackers would need to those accounts. Your password manager may well have a 2FA feature, but a third-party application such as Google Authenticator or Authy is preferable as it adds a degree of separation to your defense. Even more secure would be using a hardware authentication key, although these are generally not as easy to set up for most people.

What You Need To Do Now To Protect Your Gmail And Google Photos Content From Deletion

If you only have one Gmail or Google Photos account, and you have used it within the last two years, then the answer is simple: nothing.

If you have multiple accounts, maybe used as a backup or archive, that may have been dormant for two years or more, then you can protect them by signing in at least once every two years and then doing one of the following to mark it as being active:

Read or send an email with Gmail. Perform a Google search. Use Google Drive. Watch a video on YouTube. Download an app from the Google Play Store.

Any of these actions will be enough to prevent your Google account from deletion and protect the content that you have stored with Gmail and Google Photos.

MORE FROM FORBESHere’s How To Hack Google For Sport And Money In 2023By Davey Winder

What About Accounts You Can’t Remember You Created?

Of course, one problem that could occur thanks to it being so easy to create multiple Google accounts is memory loss. I have many Gmail accounts, each attached to a different Google account, and I am certainly not alone in this. I’d like to think that I haven’t forgotten about any of them, and if I had then they probably don’t contain any content I’m desperate to retain. Your mileage may vary. So, how can you find those accounts if you’ve forgotten all about them?

The easiest way would be using the Google account recovery method. This asks you to input the recovery email or telephone number associated with the account concerned. Which could seem like something of a stumbling block, but if you use an existing email or number you’ve had for the longest time, then the chances are pretty good it will return results. Google will send a recovery verification code to the email or phone, and then provide details of any accounts associated with them. Which still leaves you with the password problem. Unless you have zero security sense and use the same password for everything, it’s unlikely you’ll remember a password for an account you have already long forgotten. A password manager won’t help, or you wouldn’t need to be taking this account memory-jogging route in the first place. Fear not, you can just go to sign-in and use the forgotten password option and you’ll get another verification code and the opportunity to enter a new password.