“This is because forgotten or unattended accounts often rely on old or re-used passwords that may have been compromised, haven’t had two-factor authentication set-up and receive fewer security checks by the user,” writes Kricheli.
“Our internal analysis shows abandoned accounts are at least 10 times less likely than active accounts to have two-step verification set-up.
“Meaning, these accounts are often vulnerable, and once an account is compromised, it can be used for anything from identity theft to a vector for unwanted or even malicious content, like spam.”
The earliest Google will begin deleting accounts is December, in a process Kricheli said would be undertaken “slowly and carefully, with plenty of notice”.
Anyone having their accounts deleted will receive multiple messages before any action is taken.