How to Clean Up Your Google Account for Better Privacy

Set aside 30 to 45 minutes and work through five things in this order: the Security Checkup, 2-Step Verification, third-party app access, your Activity Controls, and finally your 15 GB of shared storage. Doing them in that sequence closes the biggest security gaps first, then tightens privacy, then clears clutter, so even if you get interrupted the most important work is already done.

Start with the Security Checkup#

Go to myaccount.google.com/security-checkup. This dashboard surfaces the four things that actually matter: which devices are signed in, recent security events, your 2-Step Verification status, and which third-party apps hold access. A green shield means nothing needs attention; a yellow or red one flags a specific issue with a direct link to fix it. Let this page set your priorities instead of hunting through menus.

Remove devices you no longer own#

Open the "Your devices" panel (myaccount.google.com/device-activity). You will likely see a phone you traded in, a work laptop you returned, or a browser session left open on a hotel or library computer. Click any entry and choose "Sign out" to revoke that session. If you see a device or location you genuinely do not recognize, do not simply sign it out. Click "Don't recognize a device?", change your password immediately, then sign out everywhere.

Fix your recovery details#

Under Security, in "How you sign in to Google", confirm your recovery email and recovery phone still point to accounts and numbers you control. Stale recovery info is the single most common reason people get permanently locked out. A recovery phone tied to a number you gave up years ago is worse than useless, because if a carrier later recycles that number to a stranger, it becomes a way in rather than a way back.

Turn on 2-Step Verification, or a passkey#

If you do only one thing, do this. Go to myaccount.google.com/signinoptions/two-step-verification. 2-Step Verification (Google's name for 2FA) means a stolen or leaked password is no longer enough to get in on its own.

Not all second factors are equal, so choose deliberately:

• SMS codes are the weakest option because of SIM-swap attacks, where someone convinces your carrier to move your number to their phone. Better than nothing, but treat it as a last resort.
• Google prompt (a tap on your already signed-in phone) is stronger and the easiest for most people.
• Authenticator app codes from Google Authenticator, Authy, or 1Password work even with no signal.
• Passkeys (set up at g.co/passkeys) and hardware security keys like a YubiKey or Google Titan use the FIDO2/WebAuthn standard and are effectively phishing-proof, because the key only responds to the real google.com domain.

Whatever you pick, download your 10 backup codes and store them offline, in a password manager or on paper in a drawer. Losing your phone with no backup codes is exactly how people lock themselves out the day after securing the account.

Revoke third-party app access#

Every time you clicked "Sign in with Google" or let an app reach your Gmail or Drive, you handed out an OAuth token that often persists for years. Go to myaccount.google.com/connections to see the full list.

Read the scope on each entry, the line describing what it can do. "See your primary email address" is harmless; "Read, compose, send, and permanently delete all your email" attached to some forgotten browser extension is exactly the access you want gone. Click any app and choose "Remove access". This does not delete your account on that service; it only revokes Google's key, and you can always sign in again later.

Pay special attention to old email plugins, calendar tools, "productivity" extensions, and anything you installed once to test. These are the connections most likely to be abandoned by their developers and left unpatched, which quietly turns them into a side door into your data.

Prune your activity data and set auto-delete#

Google logs a lot to personalize its products, and you decide how much it keeps. Go to myaccount.google.com/activitycontrols, where you will find three main toggles:

• Web & App Activity covers your Search, Assistant, and app usage. For accounts created in recent years this auto-deletes after 18 months by default, but older accounts may still be set to keep everything until you delete it manually.
• Timeline (formerly Location History) is now stored on your device rather than Google's servers for new setups. Check whether it is on and set a retention window.
• YouTube History records both watches and searches, which is what drives your recommendations.

Set auto-delete instead of a one-time purge#

For each control that is on, open "Auto-delete" and choose 3, 18, or 36 months. Three months is the tightest window that still keeps search suggestions and recommendations reasonably useful. Auto-delete beats a manual wipe because it keeps your history trimming itself forever, instead of quietly piling up again the day after you clean it.

While you are in Data & privacy, also open My Ad Center at myadcenter.google.com. You can switch off personalized ads entirely, or leave them on while removing specific sensitive topics and blocking individual advertisers.

Reclaim your 15 GB of storage#

Gmail, Google Drive, and Google Photos all share one free 15 GB pool, which is why a stuffed inbox is often the real reason Drive says it is full. Go to one.google.com/storage/management, which ranks your biggest space hogs in a single view.

The usual culprits and their fixes:

• Gmail: search has:attachment larger:10M or older_than:5y to surface giant or ancient messages, then delete them and empty Trash. Empty the Spam folder too, since it counts against your quota.
• Drive: sort files by size, delete what you no longer need, then empty the Trash, because items there keep counting for 30 days.
• Photos: delete blurry duplicates and old screenshots, then empty the Photos trash. Remember that since Google ended free unlimited "High quality" backups in June 2021, every new photo now counts against the shared 15 GB.

Common mistakes people make#

The biggest error is stopping after changing the password and assuming the job is done. A strong password does nothing against a still-valid OAuth token or a second-factor an attacker already enrolled, so always check the connections list and your 2-Step methods.

Second, people delete history once and never set auto-delete, so it rebuilds within weeks. Third, they rely on SMS as their only second factor, leaving a SIM-swap hole wide open. Fourth, they forget the recovery phone and email, which silently become the weakest link. Fix all four, then revisit twice a year, and the account stays genuinely secure rather than secure-looking.

FAQ#

Does revoking an app's access delete my account with that service?#

No. Removing access at myaccount.google.com/connections only cancels Google's permission token. Your account on the other service still exists, and you can grant access again by signing in with Google whenever you want.

Will turning on auto-delete break my recommendations or search?#

Only mildly. With a 3-month window, Search suggestions and YouTube recommendations stay reasonably tuned, because recent activity is what matters most. You mainly lose the long-tail personalization built from years-old data, which most people never notice missing.

Is a passkey better than an authenticator app?#

Yes, for phishing resistance. A passkey or hardware key uses FIDO2/WebAuthn and only authenticates on the genuine Google domain, so a fake login page cannot capture it. An authenticator code can still be stolen if you type it into a convincing copycat site.

How do I download my data before deleting things?#

Use Google Takeout at takeout.google.com. You can export Gmail, Drive, Photos, and more as a single archive, choosing the file formats and delivery method. Do this before any large cleanup so you keep a backup that is fully under your own control.