Planning to sell your old Android phone?
It’s a good way to recoup some of your investment, but it also poses a risk to your privacy. The most common mistake users make is performing a factory reset (Factory Data Reset) without properly removing their Google account first. This can cause problems not only for you but also for the new owner due to security mechanisms like Factory Reset Protection (FRP).
In this article, we will clearly show you how to safely and technically prepare your device for the new owner, based on cybersecurity principles and the architecture of mobile operating systems.
For a broader explanation of why you must sign out of your Apple ID or Google account before selling, see our separate security guide.
Why is it not enough to just “delete everything”?
Mobile operating systems use complex encryption and security methods. Based on research on data remanence in Flash memory, simply deleting files does not guarantee that the data cannot be recovered using specialized forensic recovery tools.
Additionally, since Android version 5.1, the Factory Reset Protection (FRP) feature has been introduced. If the phone is formatted through Recovery Mode (not through the settings menu) without removing the Google account, after rebooting, the phone will ask for the last user’s email and password. If the buyer does not have them, the phone will become a “brick,” which is often mistakenly considered a scam.
Comprehensive guide: Step by step
1. Backup and sync data
Before removing the account, ensure that all recent data is in the cloud.
- Go to Settings > Google > Backup.
- Check that Google Photos and Contacts sync is complete.
- Use Google One if you have a large amount of app data.
2. Disable Find My Device feature
Although this feature turns off automatically when you remove the account, security experts still recommend doing it manually to avoid any errors on Google’s servers.
Settings > Security > Find My Device – set to Off.
3. Remove Google account from the device
This is the most important step that disconnects your digital identity from the physical device.
- Open Settings.
- Look for the Passwords & Accounts section (on some models – Users & Accounts or just Accounts).
- Tap your Google account (email address).
- Press the Remove Account button.
Note: If you have multiple accounts, you need to remove each one separately. The system will ask you to verify your identity (enter your PIN or use biometric data). This confirms to the operating system’s core that the account is being removed by an authorized user, thus deactivating FRP.
4. Remove screen lock
While not always mandatory, it is recommended to remove any PINs, patterns, or fingerprints before the final wipe. This ensures that the new owner does not encounter a locked screen after the first reboot.
Settings > Security > Screen lock – select None or Swipe.
5. Factory Data Reset
Only after completing all the steps above can you safely wipe the device.
Settings > System > Reset options > Erase all data (factory reset).
This process will erase your photos, messages, apps, and cryptographic keys used in File-Based Encryption (FBE).
Technical security aspect: Encryption and data security
Most new Android phones use File-Based Encryption (FBE). Unlike the older Full Disk Encryption (FDE), FBE allows each file to be encrypted separately with a unique key. When you perform a Factory Reset, the phone not only deletes pointers to files but also destroys the main encryption key. Even if someone later recovers fragments of your files from the memory chip, they would be a meaningless jumble of data without the recovery key.
Risks of older models
Research (e.g., Vidas et al.’s study on mobile device forensics) shows that factory resets on older Android models may leave certain metadata behind.
Additional recommendation
If you are selling a very old model, it is recommended to fill the phone with any irrelevant data (e.g., random large videos) after the first reset and perform the reset again.
What to do if you already sold the phone without removing the account?
If you forgot to remove the account and the buyer complains that the phone is asking for your data, you can try to do it remotely:
- Log in to Google My Account from a computer.
- Go to the Security section.
- Find Your devices and select Manage all devices.
- Locate the sold phone and click Sign out.
Quick guide: What to set?
| Step | Action | Importance |
|---|---|---|
| Account | Remove Account | Essential for deactivating FRP. |
| Security | Find My Device Off | Disables remote tracking. |
| Lock | Screen Lock None | Smooth first start for the new buyer. |
| Wipe | Factory Reset | Final destruction of data and keys. |
Summary: Quick checklist
- Sync: Sync data to the cloud.
- Unpair: Disconnect smartwatch and other Bluetooth devices.
- Deregister: If using specific services like iMessage (after switching from iPhone) or banking apps, deregister them.
- Remove Account: Remove Google account through settings.
- Cleanse: Perform Factory Data Reset.
Sources and recommended literature:
- Vidas, S., Zhang, C., & Richardson, T. (2011). Toward a general triaging framework for mobile device forensics.
- Google Android Developers Documentation. Factory Reset Protection (FRP) and Security.
- Chaudhary, A., & Gupta, P. (2020). Android Encryption and its Impact on Digital Forensics.
- National Institute of Standards and Technology (NIST). SP 800-88 Rev. 1: Guidelines for Media Sanitization.
