There's a drawer in nearly every household with old phones that were replaced years ago. Maybe you're planning to sell them, donate them to a charity, hand them down to a family member, or drop them off at an electronics recycling center. Whatever your plans, there's one step you absolutely must not skip: securely erasing all of your data first.
The risks of skipping this step are real. Studies of second-hand devices have repeatedly found that many still contain recoverable personal data. Photos, messages, login credentials, financial information, and location histories are among the data points that can be recovered from devices that weren't properly wiped. Some buyers of used electronics actively hunt for such data, and identity thieves understand that old phones are a goldmine of personal information.
Why Deletion Isn't the Same as Destruction
Here's a fundamental concept to understand: deleting a file doesn't actually erase it. On most storage systems, deleting a file simply removes the reference to it from the filesystem index, making the space available for new data. The actual data bytes remain on the storage drive until they're overwritten by something else. This is why data recovery software exists — it scans for those leftover data fragments and reconstructs the files.
On older phones without encryption, this meant that a factory reset could leave substantial amounts of recoverable data behind. If the storage was never overwritten, forensic tools could still locate deleted files. This is why blanking storage (overwriting with zeros) or physical destruction was historically necessary for truly secure disposal.
The good news: modern smartphones have largely solved this problem through encryption. Since Android 6.0, Android encrypts all user data by default using hardware-backed encryption keys. When you perform a factory reset on an encrypted device, the operating system destroys the encryption keys. Without the keys, the encrypted data on the storage is effectively unrecoverable trivia, regardless of whether the physical bytes are still present or not.
Before You Wipe: Back Up and Deregister
If there's any data on your old phone you want to keep, back it up now. Photos, contacts, messages, and documents can be moved to your new device, cloud storage, or a local computer. Verify that your backup is genuine before proceeding — there's nothing worse than erasing a phone only to discover the backup failed.
After backing up, you should deregister the device from your accounts. The specific steps depend on your device and ecosystem, but common tasks include: removing the phone from Google's Find My Device, signing out of your Google account, removing the SIM card, and ejecting any microSD card. On some devices, you may also want to remove Bluetooth pairings, revoke access tokens for connected apps, and disable account sync.
If your phone uses Factory Reset Protection (FRP), the device will require your Google account credentials after a reset before it can be set up again. This is a security feature designed to deter theft, but it can also be a nuisance when you've already moved on. Signing out of your Google account before performing the reset avoids this complication.
Performing the Factory Reset Correctly
With your data backed up and your accounts deregistered, you're ready for the actual wipe. On Android, navigate to Settings, then System, then Reset Options, then Erase All Data (Factory Reset). Before confirming, you'll typically be warned that this action can't be undone and that all data will be removed.
Here's a tip that many people overlook: after the first factory reset, some security experts recommend performing a second reset and then filling the phone with dummy data before resetting again. While this is generally unnecessary on modern encrypted devices, the extra resets provide peace of mind for users whose old phones are non-encrypted or who plan to sell to very security-conscious buyers.
If your phone is old enough not to have encryption enabled, you should treat the standard factory reset as insufficient for data that you consider sensitive. In that case, consider a dedicated data destruction app that performs multiple overwrite passes, or consult a professional electronics recycling service that offers certified data destruction.
Special Cases: Broken Phones and Non-Functional Devices
What if the phone is broken? A shattered screen or failing battery doesn't mean the storage chip is dead — in fact, data recovery professionals extract data from damaged phones all the time. If your phone is damaged but you're concerned about the data, you have several options.
If the phone still powers on, follow the factory reset procedure above even if you need to navigate the screen through a damaged display. If it powers on but the touchscreen is unresponsive, you may be able to use a USB cable and ADB commands to issue a factory reset. If the phone doesn't power on at all, the storage chip may still be readable by someone with the right tools.
For truly non-functional devices with sensitive data, physical destruction is the surest method. The storage chip can be removed and destroyed, or the phone can be professionally shredded by a certified e-waste service. This might sound extreme, but for users with sensitive professional data, it's the responsible choice.
The Extra Steps Most People Skip
Erasing the phone's storage is only part of the equation. Your data lives in more places than the device itself. Before you dispose of an old phone, log into the associated cloud accounts and remove the device from the list of trusted devices. This revokes the phone's ability to receive verification codes, access synced data, or otherwise act on your behalf.
Change the passwords for accounts that were heavily used on the old phone. If you suspect an attacker might have already copied data from a breached phone, password rotation is your defense. Enable 2FA on important accounts using an authenticator app rather than SMS, since SMS-based verification can be vulnerable to SIM swap attacks.
And finally, review any apps that might have stored data locally. Messaging apps, banking apps, and authentication apps like Google Authenticator or Authy store sensitive tokens on the device. A factory reset removes them, but you should set up your authenticator apps fresh on your new device before completing the migration.
Putting Security First When Disposing Devices
Disposing of an old phone responsibly is a two-step process: protect your data, then dispose of the hardware. By backing up what you need, deregistering devices and accounts, performing a proper factory reset on an encrypted device, and handling the physical hardware through a reputable channel, you can recycle or resell your old phone with confidence. If your phone gets lost or stolen before you have a chance to wipe it, having a remote wipe tool like CleanSlate ready ensures your data stays protected even in that scenario. Buyers should also be aware of the risks of buying a used phone.