Why is it prohibited to leave your “Apple ID” or “Google” Account when selling a device?

Why is it strictly prohibited to leave your “Apple ID” or “Google” account when selling a device?

The market for used smart devices is constantly growing, but so is the risk of cyber security and privacy breaches. One of the biggest and, unfortunately, still common mistakes is to sell, gift, or give away a smartphone, tablet, or computer without logging out of the main cloud accounts: Apple ID (in the iOS/macOS ecosystem) or Google Account (in the Android/ChromeOS ecosystem).

Sometimes sellers do this out of ignorance, and sometimes thinking they are helping the new owner, for example, by leaving purchased apps. However, this action can have very serious consequences for both the former and the new device owner.

In this comprehensive article, we will discuss the technical, financial, legal, and privacy reasons why account removal is a necessary step before transferring a device to another person.

1. Complete compromise of personal data and privacy

Modern operating systems are closely linked to cloud services. By leaving your account, you are essentially handing over the keys to your digital life.

• Continuous Syncing: If your Apple ID or Google account remains on the device, everything you do on your other devices may appear on the sold phone. New photos, browsing history, search queries, and even personal meetings in the calendar will sync with the sold device.
• Data Merging phenomenon: This applies in reverse as well. Everything the new owner photographs, browses, or saves will be automatically uploaded to your iCloud or Google Drive. This means that your personal cloud storage will be filled with someone else’s data, which will be extremely difficult to delete and separate from your own.
• Access to personal messages: iMessage, Google Messages, WhatsApp (if synced with Google Drive/iCloud) backups can be restored or directly read by the new owner.

2. Financial risk and identity theft

Leaving an active account means the device will continue to be considered a “trusted device.” This creates significant gaps in your financial security.

• Password Managers: Using iCloud Keychain or Google Password Manager, your saved passwords for social networks, email accounts, or even banking portals remain accessible (Autofill feature) to the new owner.
• Payments and subscriptions: The account is often linked to a payment card. The new owner can freely purchase apps, in-game currency (in-app purchases), or subscribe to expensive services at your expense through the App Store or Google Play Store. Depending on the settings, small purchases may not even require re-entering the password.
• Two-Factor Authentication – 2FA: Since the left device is linked to your account, it may receive 2FA confirmation codes (prompts) intended for logging into your other systems. A malicious actor could take complete control of your digital identity, as the system “trusts” that device.

3. Technical locks: Activation Lock and FRP (Harm to the new buyer)

By giving away a device with an unremoved account, you harm not only yourself but also the buyer. Both Apple and Google have implemented theft prevention systems.

4. Legal aspects and violations of Terms of Service

Technology giants clearly outline the limits of account usage in their legal documentation.

• Account sharing prohibition: Both Apple Media Services Terms and Conditions and Google Terms of Service clearly state that the account is personal and sharing it with third parties is strictly prohibited.
• Account suspension: If the system algorithms detect unusual activity, your account may be automatically suspended due to suspected hacking.
• Data protection regulations (GDPR): By giving away a device with your contacts or correspondence data, you theoretically violate the privacy of third parties.

How to properly prepare a device for transfer?

To avoid all the risks mentioned above, it is essential to perform proper device wiping.

“By leaving your account, you are essentially handing over the keys to your digital life to a stranger.”

– Insight from security experts

Quick guide: What to do?

Sources and literature

• Apple Support. (n.d.). What to do before you sell, give away, or trade in your iPhone or iPad.
• Google Help. (n.d.). Reset your Android device to factory settings.
• Vidas, T., Christin, N., & Cranor, L. (2013). Curbing Android Data Remnants. “IEEE Pervasive Computing”, 12(1), 24-29.
• Balebako, R., et al. (2015). The Privacy and Security Behaviors of Smartphone Owners. “NDSS Symposium”.
• Mylonas, A., et al. (2013). Smartphone Security Evaluation: The Malware Attack Case. International Security and Cryptography Conference (SEC).