Many users are convinced that simply deleting an app from their smartphone and changing their password is enough to make a third-party service lose access to their Google data. However, as it turns out, this logic only works halfway. Upon the first sign-in via Google, a third-party service receives what is known as an OAuth token — a digital "copy of a pass" that is stored not on the user's device but on the developer's servers. That is exactly why deleting the program from a phone or tablet does not notify the external server that the partnership has ended: the token remains valid until it expires or until the user revokes it manually.
The OAuth token mechanism: why "deletion" is not the same as "revocation"
When you first log in to a third-party app via the "Sign in with Google" button, the system issues the service a time-limited access token. The standard lifetime of such a token is six months. But here lies the main trap: if the app accesses your calendar, contacts, or Drive at least once a week — for example, for background synchronization — the token's expiration is reset to zero and counted anew. As a result, with regular background activity, access becomes effectively indefinite, even if you haven't opened the app in months.
Changing your password and two-factor authentication: why standard measures are not enough
The widely known advice to "change your password and enable two-factor authentication" only works partially in this case. Updating your password invalidates tokens only for services that have access to your Gmail mailbox. Meanwhile, authorization on websites, as well as access to Google Drive, Calendar, and your contact list, remain fully active even after changing your main password. Two-factor authentication also does not protect against data leaks through already stolen or compromised tokens, because the token itself is considered a verified pass — the system does not request re-verification if the token is still valid.
Contradictory data
Standard cybersecurity recommendations, promoted for years by both tech companies and regulators, come down to two steps: changing your password and enabling 2FA. These are the measures presented as a "sufficient" level of protection. However, according to the data presented in an RBC.ua publication, these measures are categorically insufficient for revoking access to files, the calendar, and contacts. On the one hand, Google does confirm that changing your password affects session tokens associated with email. On the other hand, the token "renewal" mechanism through background activity and the storage of keys on the developer's servers makes the standard "deleted and forgot" scenario ineffective. Thus, there is a significant gap between the accepted practice and the actual mechanics of OAuth authorization, which is not disclosed in Google's own interface when changing a password.
What to do: a step-by-step check of authorized apps
To fully close off access, users need to manually check the lists of authorized applications. In the Google connected apps dashboard, you should review all three categories: "Sign in with Google," "Account access," and "Connected accounts." For the Apple ecosystem, the check is performed in the "Sign-In & Security" → "Sign in with Apple" section of your Apple account or in iPhone settings. Microsoft users should go to the privacy and app access tab in their account settings. Similar sections exist in the settings of X (Twitter) and Meta — in the blocks managing connected apps and websites. It is important to understand: removing a connection in these interfaces only stops automatic authorization and further data collection.
What can no longer be returned: data on the developers' servers
It is critically important to bear in mind that revoking a token does not erase data that has already been transferred. All files, contacts, calendar events, or login history copied to a third-party service's servers before the access was revoked remain there. To delete them completely, you must contact the specific app's support team and submit a separate request to delete your personal data. Without this step, "cleaning" your Google account remains formal: your digital footprint continues to be stored in other people's databases, even if access to the account is no longer granted.
