July 29, 2026 (Conversation) Deletion is a common part of modern life. We send files and folders to the recycle bin all the time, and often get rid of unwanted personal accounts. But do you know what really happens when you hit the “delete” button?
The process of deletion is often poorly explained by tech providers. Lack of transparency around how requests are processed, and the absence of clear confirmation that data has been removed, are frequently highlighted in research.
These issues are not limited to operating systems. On social media platforms and a wide range of subscription services, deletion mechanisms are often just as unclear. Such misconceptions can have serious implications for the wellbeing of users, exposing them to security and privacy vulnerabilities.
A further complication is that many users fear losing data, files, photos and videos through accidental deletion – a condition dubbed “diagraphephobia”. Though this is not a recognised pathology, studies of digital hoarding behaviour show that some people get very anxious at the thought of losing or accidentally deleting personal information such as photos and music.
Such concerns extend the amount of personal data that sits untended but undeleted, ready for potential misappropriation.
Deletion vs erasure
A common misconception is thinking deletion means erasure – the idea that once a deleted item is no longer visible, it has been completely erased with no means of retrieving it. This is largely wrong.
When users delete files – moving them to the trash bin, then deleting permanently – the data isn’t actually erased. Rather, the system marks storage space as reusable and updates metadata to unlink the file. But the underlying content often remains recoverable with the right tools, especially when data is duplicated across multiple systems or devices.
More robust forms of deletion include physical destruction of the storage medium, overwriting the memory blocks with new data to bury the original, or encrypting the data and then destroying the key.
However, such methods can be expensive and may render the storage device unusable (for example, when overwriting data on magnetic media). The characteristics of cloud infrastructure also pose challenges to secure data deletion.
Similarly, content on public social networks may not really be erased after deletion due to replies, comments and internet archives which can all store the posts in some fashion. The meaning of a deleted tweet can, for example, be recreated based on replies and mentions.
Zombie accounts
Another misconception is that deleting an app from a device automatically deletes the associated account. Users often leave mobile app accounts undeleted because they are unaware of their existence, having deleted the related app.
These are called zombie accounts – abandoned profiles for a wide array of services, from shopping and storage to dating, finance and streaming. Millions of users possess zombie accounts, with personal data that is vulnerable to cyber-attacks and data breaches.
The exponential growth of AI raises a further question: can data really be deleted once it has been used to train AI models? Machine learning modules easily memorise the data they have been trained on, but “unlearning” is difficult.
In theory, people in Europe and many other countries around the world have a leagal “right to be forgotten”. This means they can request the full erasure of any personal data a platform or a company may hold. AI developers are considered data controllers under the EU’s General Data Protection Regulation (GDPR) laws, for example, and are subject to this obligation.
However, there are no clear guidelines on how erasure should be enforced within AI systems. Regulators may request deletion, but AI companies can argue that compliance is infeasible on account of technical constraints.
Explainable deletion
To counter the risks posed by incomplete deletion, I believe there is a pressing need for provision of concise, accessible and clear information about how deletion really works.
One potential approach is “explainable deletion” – a protocol developed by Marvin Ramokapane at the UK’s National Research Centre on Privacy, Harm Reduction and Adversarial Influence Online (Rephrain), based at the University of Bristol.
The intention is to make deletion processes more transparent and understandable without overwhelming the user with too much information in one go.
Explainable deletion breaks down information into six categories: what, how, when, who, where and why (see diagram). Each offers a user bite-size information about that part of the process.
Explainable deletion’s six categories:
Explainable deletion is designed to give users control over their actions, the autonomy to choose the deletion type that is right for them, and the assurance that their desired actions have been fulfilled. It may also tackle the anxiety of accidentally losing data by giving options for data recovery.
While explainable deletion has not yet been adopted in practice, service providers – both platforms and developers – could heighten user trust by adopting such protocols. This framework can also be proof of compliance with GDPR regulations and the right to be forgotten.
Most of us use systems that collect and store our data on a daily basis. If these systems clearly explained what they store and what deletion really means, it could help us to spot the accounts and data that pose a real risk – and to take back control of our digital footprints.