Quick answer: Before you sell, trade in, donate, or recycle a phone or computer, back it up, sign out of your accounts, encrypt it if it isn’t already, and then use the built-in factory reset. Deleting files by hand is not enough, because the operating system often just marks the space as reusable and the data can sometimes be recovered. If a device holds extremely sensitive data and still works, keeping it locked away is safer than selling it.
Old phones and laptops hold years of email, photos, saved passwords, banking apps, and logins. Handing one over without wiping it properly can hand over all of that. The steps are mostly built into the device and take about half an hour.
A Real Example: Millions of Customers’ Data, Sold on an Auction Site
In September 2022, the U.S. Securities and Exchange Commission announced that Morgan Stanley Smith Barney agreed to pay a $35 million penalty for failures to safeguard personal information. According to the SEC, the firm hired a moving and storage company with no data-destruction expertise to decommission thousands of hard drives and servers containing the personal information of millions of customers. The company sold thousands of the devices to a third party, and some were resold on an internet auction site with customer data still on them. The SEC cited approximately 15 million customers, and said the recovered devices held unencrypted customer data. The firm neither admitted nor denied the findings.
The SEC also said the firm failed to monitor the vendor over several years and didn’t turn on available encryption on local devices for years. Two of those failures are ones you can avoid at home: trusting a stranger to handle disposal, and leaving data unencrypted. SEC, “Morgan Stanley Smith Barney to Pay $35 Million for Extensive Failures to Safeguard Personal Information” (September 2022).
Why Deleting Isn’t Enough
CISA’s training materials explain that deleting files often doesn’t erase them, because the operating system only marks the space for later overwriting. CISA advises against relying on deletion to protect data you no longer need. CISA, “Protecting Data on Old Devices You Don’t Use Anymore”.
Step by Step
1. Back up what you want to keep
The FTC says to start by backing up your data, whether you plan to trade in, sell, or donate the device. Use a cloud service (the FTC suggests picking one with multi-factor authentication), an external drive or USB flash drive, or the manufacturer’s transfer tool for your new device. Confirm that the backup opens before you erase anything. Sources: FTC, “What to know before you upgrade your phone” (January 2025) and FTC, “How To Remove Your Personal Information Before You Get Rid of Your Computer”.
2. Remove the device from your accounts
Sign out of email, shopping, banking, and social accounts. The FTC says to remove the device from trusted-device lists for accounts that use multi-factor authentication, and to confirm it’s no longer connected to your online accounts. Also turn off any “find my device” or activation lock feature tied to your Apple, Google, or Microsoft account, or the next owner won’t be able to use the device. See our two-factor authentication guide for why trusted devices matter.
3. Take out the SIM and memory cards
The FTC advises removing the SIM card, since it may contain personal information. Take out any microSD or other removable storage too.
4. Encrypt the device, then erase it
CISA’s advice for devices you plan to sell, recycle, or trade in is to encrypt first, then follow the manufacturer’s guidance for securely wiping. Many current phones are encrypted by default once you set a passcode, but check your device’s settings. On a computer, turn on the built-in disk encryption before you reset it.
5. Run the factory reset
The FTC says a factory reset restores the device to its original settings and erases personal data such as account numbers, passwords, messages, videos, and photos. For computers, it says to use the operating system’s built-in reset to remove files and restore factory settings, and it links to instructions for Windows, Chromebook, and Mac. Menus change between versions, so use your manufacturer’s current instructions. As a rough guide:
- iPhone or iPad: Settings > General > Transfer or Reset > Erase All Content and Settings
- Android: Settings > System > Reset options > Erase all data (varies by brand)
- Windows: Settings > System > Recovery > Reset this PC
- Mac: System Settings > General > Transfer or Reset > Erase All Content and Settings
These paths are from general knowledge, not from the FTC pages, and vary by version. Check yours.
6. Check that it worked
Turn the device back on. It should show the first-time setup screen, not your name or accounts.
7. Dispose of it responsibly
The FTC notes that most computers contain hazardous materials that don’t belong in a landfill, and points to the EPA’s electronics recycling and donation guidance, the manufacturer, or a local electronics store.
When to Go Further
Most people can stop at step 6. Consider more if the device held especially sensitive data:
- Keep it. CISA calls storing old devices in a secure place, such as a safe, the most effective method of data protection.
- Professional destruction. If you plan to destroy a device, CISA says to use a professional recycling or destruction service that lets you verify the hard drive was destroyed. The Morgan Stanley case shows why the vendor matters.
- Heightened risk. CISA says not to sell or recycle a device if you are at heightened risk of targeting by politically or ideologically motivated threat actors.
Organizations typically follow NIST’s Guidelines for Media Sanitization (SP 800-88 Rev. 2) (September 2025). It isn’t written for households, and the summary page we reviewed doesn’t describe specific methods, so we don’t rely on it here.
What About Wiping Tools and Drilling the Drive?
Our earlier version of this post recommended third-party wiping programs and physically destroying drives. We removed the specific tool recommendations because neither the FTC nor CISA pages we reviewed recommend them, and how well overwriting works varies by drive type, especially solid-state drives. If you decide to physically destroy a drive, CISA’s advice is to use a service you can verify, rather than doing it yourself.
If You Already Gave Away an Unwiped Device
- Change the passwords for every account that was signed in, starting with email and financial accounts, from a different device.
- Remove the device from your accounts’ trusted-device and signed-in-device lists.
- Turn on multi-factor authentication if it wasn’t on.
- Contact the buyer or recipient and ask them to wipe it or return it, if you can.
- Watch your accounts and credit for activity you don’t recognize, and consider a credit freeze if identity documents were stored on it. See what to do after a data breach.
- Report identity theft at IdentityTheft.gov.
For other ways to cut down on stored data, see digital minimalism for privacy and our cloud safety guide.
People Also Ask
For most people selling or donating a phone or computer, the FTC recommends a factory reset after backing up, and CISA recommends encrypting first. For very sensitive data, consider keeping the device or using a verifiable destruction service.
Not necessarily. CISA says deleted files are often recoverable because the operating system only marks the space for later overwriting.
Yes. The FTC advises removing it, since it may contain personal information.
Yes. Remove the device from your accounts and trusted-device lists. On Apple and Google devices, also turn off device-locking features tied to your account so the next owner can set it up.
No. Most computers contain hazardous materials, per the FTC. Use a recycling program, manufacturer take-back, or electronics store, and wipe the device first.
CISA’s advice is that if you plan to destroy a device, use a professional service that lets you verify it. Doing it yourself is hard to check.
Sources: U.S. Securities and Exchange Commission, “Morgan Stanley Smith Barney to Pay $35 Million for Extensive Failures to Safeguard Personal Information” (September 2022); Federal Trade Commission, “How To Remove Your Personal Information Before You Get Rid of Your Computer” (updated November 2024); Federal Trade Commission, “What to know before you upgrade your phone. And how to protect your new one” (January 2025); CISA, “Protecting Data on Old Devices You Don’t Use Anymore”; NIST, SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025)
Leave a Reply
You must be logged in to post a comment.