What Really Happens to Your Data When You Click ‘Delete’?

Deletion is a routine part of our digital existence. We often move files and folders to the recycle bin and cancel unnecessary personal accounts. But have you ever pondered what really occurs when you hit the “delete” button?

The deletion process is frequently poorly detailed by tech providers. Research shows a notable lack of clarity regarding how deletion requests are processed and inadequate confirmation of data removal.

This ambiguity extends beyond operating systems. Social media platforms and many subscription services often present deletion procedures that are just as unclear. Such misunderstandings can lead to serious implications for users’ safety, exposing them to security and privacy threats.

Additionally, many individuals fear unintentionally losing data, files, photos, and videos—this condition is often termed “diagraphephobia.” While not officially recognized, studies on digital hoarding indicate that numerous people experience significant anxiety over the potential of losing or accidentally deleting personal information like photos and music.

These anxieties result in a pileup of personal data that remains untouched, leaving it open to misuse.

Deletion vs. Erasure

A common misunderstanding is equating deletion with total erasure—the belief that once an item is removed, it is completely eliminated with no chance of recovery. This is largely untrue.

When users delete files by moving them to the trash and subsequently emptying it, the data is not actually destroyed. The system merely marks the storage area as free for use and updates the metadata to disconnect the file. However, the original data can often be restored with specific tools, particularly if it is duplicated across multiple systems or devices.

More secure deletion methods involve physically destroying the storage medium, overwriting memory spaces with new data to eliminate the original, or encrypting the data before discarding the key.

Nonetheless, these methods can be expensive and may render the storage device unusable (for example, when overwriting data on magnetic media). Furthermore, cloud systems complicate the secure deletion of data.

Similarly, content on public social networks is often not truly erased after deletion, due to replies, comments, and internet archives that might still hold the posts in some form. For instance, the context of a deleted tweet can still be partially reconstructed from replies and mentions.

Zombie Accounts

Another prevalent myth is that uninstalling an app from a device automatically deletes the associated account. Users often leave app accounts undeleted because they are unaware of their existence after the app is removed.

These neglected accounts are known as zombie accounts—abandoned profiles linked to various services, including shopping, storage, dating, finance, and streaming. Millions of users maintain such accounts, which contain personal data vulnerable to cyber threats and data breaches.

The rapid evolution of AI raises an additional question: can data truly be deleted once it has been used to train AI models? Machine learning systems tend to memorize the data they’re trained on, making “unlearning” a difficult challenge.

Theoretically, individuals in Europe and many locations around the world possess a legal “right to be forgotten.” This allows them to request the complete deletion of any personal data held by a platform or company. Under the EU’s General Data Protection Regulation (GDPR), AI developers are classified as data controllers, making them subject to this requirement.

Nonetheless, clear guidelines on effectively enforcing erasure within AI systems are still lacking. Regulators might mandate deletion, but AI companies could argue that compliance is impractical due to technical barriers.

Explainable Deletion

To address the risks associated with incomplete deletion, there is an urgent need for clear, concise, and accessible information about the actual deletion process.

One promising solution is the concept of “explainable deletion,” developed by Marvin Ramokapane at the UK’s National Research Centre on Privacy, Harm Reduction and Adversarial Influence Online (Rephrain), in collaboration with the University of Bristol.

This initiative aims to boost transparency and understanding of deletion processes without overwhelming users with excessive information.

Explainable deletion organizes information into six categories: what, how, when, who, where, and why (refer to diagram). Each category offers users manageable insights into that aspect of the process.

The Six Categories of Explainable Deletion:

Explainable deletion intends to empower users by allowing them to control their actions, choose the type of deletion that fits their requirements, and receive confirmation that their desired actions have been taken. Furthermore, it aims to reduce the anxiety associated with accidental data loss by providing recovery options.

Although explainable deletion has yet to be widely adopted, service providers—be they platforms or developers—could build increased trust with users by adopting such protocols. This framework could also serve as proof of compliance with GDPR regulations and the right to be forgotten.

Most individuals use systems that consistently gather and save their data. If these systems offered a clear explanation of the data they retain and what deletion truly means, it could assist us in identifying risky accounts and data—enabling us to reclaim control over our digital footprints.

Dana Lungu, Research Associate, National Research Centre on Privacy, Harm Reduction and Adversarial Influence Online, Rephrain, University of Bristol

This article is republished from The Conversation under a Creative Commons license. Read the original article.