How to permanently delete emails (Gmail, Outlook, iCloud, IMAP — 2026)

“Delete” is one of the most misleading words in email. In Gmail, Outlook, Apple Mail and most IMAP clients, pressing Delete moves a message to a Trash folder where it sits for 30 days before being auto-purged — and on managed business accounts, an admin can recover it well after that. In April 2025 the French data regulator CNIL fined a French company €240,000 partly for failing to honour erasure requests within the legal one-month window, a reminder that “deleted” and “permanently deleted” are very different things in the eyes of GDPR. Here is how to truly permanently delete emails across every major provider, what you can and cannot bypass, and when to escalate to a formal erasure request.

---

TL;DR — Delete vs Permanently Delete

When you press Delete in any modern email client, the message is moved to a Trash (or Bin, or Deleted Items) folder where it remains recoverable for a default retention window — 30 days in Gmail and Outlook.com, 30 days in Apple iCloud Mail, configurable in IMAP. “Permanently delete” means bypassing that window with an explicit action: “Delete forever”, “Empty Trash now”, Shift+Delete on Outlook web, or EXPUNGE on IMAP. After that action, your account no longer shows or holds the message. On managed accounts (Google Workspace, Microsoft 365), an admin can still recover it within the organisation’s retention or hold policy.

I learned the difference the hard way three years ago, when I needed to permanently wipe a leaked draft of a client contract I had accidentally saved with the wrong account. “Delete” left it sitting in Trash, indexed by Gmail search, recoverable by anyone with my password for the next 30 days. The drill below is what I should have known on day one.

The mental model to keep in mind:

Action	Where the message lives	Recoverable by you	Recoverable by admin
Delete (inbox → Trash)	Trash / Bin / Deleted Items	Yes, drag back	Yes
Empty Trash / Delete forever	Removed from account view	No	Yes (within retention window)
Admin retention expiry / hold release	Truly purged	No	No

This guide focuses on the first two rows — the actions you control from your client. The third row is governed by your provider or employer’s policy.

---

Why “Delete” doesn’t actually delete

Every major email provider keeps deleted messages in a recovery folder for a fixed period as a user-safety feature. Gmail and Outlook.com hold deleted messages for 30 days. Apple iCloud Mail holds them for 30 days by default (and the Trash folder is one of the few places iCloud does not encrypt end-to-end). Yahoo Mail holds Trash items for 7 days. IMAP behaviour depends on the client — some clients expunge on delete, others queue deletions until you trigger expunge manually.

The reason providers built the two-step model is simple: accidental deletion is the single most common email support ticket. A soft-delete with a 30-day grace period turns most “I lost my email” panics into a recoverable problem. The cost is that the word “Delete” no longer matches its colloquial meaning.

The relevant retention defaults across major providers (verified 2026-05-16):

• Gmail (personal & Workspace user): 30 days in Trash, then auto-purged. Workspace admins can recover for an additional 25 days after that via Admin Console.
• Outlook.com (personal): 30 days in Deleted Items, then permanently deleted. Recoverable from Recoverable Items for an additional period.
• Microsoft 365 (work/school): 14 days by default in Recoverable Items, configurable up to 30 days by admin. eDiscovery and Litigation Holds can extend this indefinitely.
• Apple iCloud Mail: 30 days in Trash, then auto-purged on the server.
• Yahoo Mail: 7 days in Trash, then auto-purged.

The takeaway: pressing Delete in 2026 is essentially “soft delete.” Permanent removal is a deliberate second action.

---

How to permanently delete emails in Gmail

In Gmail, pressing Delete moves a message to Trash where it stays for exactly 30 days before being auto-purged by Google. To permanently delete now: open the Trash folder, select the messages, and click “Delete forever” — or click “Empty Trash now” to wipe all Trash contents in one action. Both bypass the 30-day window. Google’s documentation confirms that once this action is taken, “you can’t recover them.”

Step-by-step on Gmail web:

1. Go to mail.google.com in a desktop browser.
2. In the left sidebar, click More to expand the folder list, then click Trash (also labelled “Bin” in en-GB).
3. To purge everything: click the “Empty Trash now” link at the top of the Trash view. Confirm the dialog.
4. To purge selectively: tick the messages you want, then click the trash icon labelled “Delete forever”.

Step-by-step on the Gmail mobile app:

1. Tap the hamburger menu, scroll down to Trash.
2. Tap “Empty Trash now” at the top of the list to purge all, or long-press individual messages and tap the trash icon to delete forever.

Per the official Gmail Help documentation on Trash, messages stay in Trash for 30 days “before they’re permanently deleted,” and “Delete forever” removes them immediately and irreversibly from the user’s perspective.

For workflows that delete in bulk and then need to empty Trash, the related guide on how to delete promotional emails walks through the full select-all-in-Promotions pattern, which ends with the same Empty Trash step.

---

How to permanently delete in Outlook / Outlook.com / M365

Outlook uses a Deleted Items folder rather than Trash. To permanently delete an email in Outlook on the web, select the message and press Shift+Delete — Outlook prompts to confirm permanent deletion, bypassing Deleted Items entirely. To empty Deleted Items, right-click the folder and choose “Empty folder.” On Microsoft 365 work and school accounts, items removed this way still sit in the hidden Recoverable Items folder for 14 days (default) before being purged from the mailbox database — and admins can extend this with retention policies or eDiscovery holds.

On Outlook web (outlook.live.com or outlook.office.com):

1. Open the Deleted Items folder in the left pane.
2. To permanent-delete selectively: select messages, then press Shift+Delete. Outlook shows: “This item will be permanently deleted. Continue?” — click OK.
3. To empty the entire folder: right-click Deleted Items, choose “Empty folder”.

On Outlook desktop (Windows / Mac):

1. Select messages in any folder.
2. Press Shift+Delete to bypass Deleted Items and remove directly.
3. Or, from the Folder menu, choose “Empty Folder” on Deleted Items.

Important on M365 work accounts: Even after Shift+Delete or Empty Folder, the message moves into Recoverable Items (sometimes called the “dumpster”). Per Microsoft’s documentation on retention and Recoverable Items, default retention is 14 days but can be extended to 30 days by an admin. If your mailbox is on a retention policy or eDiscovery hold, items can be preserved for years regardless of your “permanent delete” action. A 30-day delay hold applies after a hold is released, meaning even hold removal does not instantly purge.

If you genuinely need provable, audit-trail permanent deletion on a managed account, only your tenant admin can confirm and enforce it. End-user actions alone are not enough.

---

How to permanently delete in Apple Mail / iCloud

Apple Mail’s behaviour depends on whether the account is iCloud, IMAP, or POP. On iCloud, pressing Delete moves messages to the Trash folder, which iCloud auto-purges after 30 days. To permanently delete now: open Trash, select the messages, and choose Mailbox > Erase Deleted Items, or right-click Trash and select Erase Deleted Items. On iCloud.com web, the action is “Empty Bin.” Apple’s Advanced Data Protection does not retroactively encrypt previously deleted emails — once purged from Trash on the server, they cannot be restored by Apple or by you.

On macOS Mail:

1. Open Mail and select the Trash mailbox under your iCloud account.
2. From the menu bar, choose Mailbox > Erase Deleted Items, then select your account.
3. Confirm. This issues the IMAP EXPUNGE command and removes the messages from the iCloud server.

On iOS / iPadOS Mail:

1. Tap Mailboxes > Trash under your iCloud account.
2. Tap Edit > Select All > Delete to purge the visible items, or rely on the 30-day auto-purge.

On iCloud.com web:

1. Sign in to iCloud.com Mail.
2. Click the Bin folder in the sidebar.
3. Click the gear icon and choose “Empty Bin”.

One detail many users miss: Apple Mail on macOS can be configured to bypass Trash entirely. Under Mail > Settings > Accounts > Mailbox Behaviors, you can disable “Move deleted messages to the Trash mailbox” — in which case pressing Delete issues an immediate EXPUNGE. Use this with caution; you lose your safety net.

---

How to permanently delete on IMAP clients

IMAP — the protocol underlying Thunderbird, Apple Mail, and most third-party email clients — uses a two-stage delete. Step one marks a message with the \Deleted IMAP flag, hiding or striking it through. Step two issues the EXPUNGE command, which physically removes all flagged messages from the mailbox file on the server. Most clients hide this distinction. To force true permanent deletion, configure your client to expunge on delete, or invoke “Compact Folders” / “Expunge” manually.

In Thunderbird:

1. Account Settings > Server Settings > check “Clean up (‘Expunge’) Inbox on Exit” — this forces expunge on every session end.
2. To purge immediately, select the folder and choose File > Compact Folders. Thunderbird issues EXPUNGE on every IMAP folder that contains \Deleted-flagged messages.
3. For Trash specifically: right-click Trash > Empty Trash.

In Apple Mail (on a non-iCloud IMAP account like Fastmail or a custom domain):

1. Mail > Settings > Accounts > your account > Mailbox Behaviors.
2. Set Erase deleted messages to “Right away” instead of “After one month.”

Via raw IMAP (if you administer the server):

A001 SELECT INBOX
A002 STORE 1:* +FLAGS (\Deleted)
A003 EXPUNGE
A004 LOGOUT

This flags every message in the inbox for deletion, then EXPUNGE physically removes them. Most modern IMAP servers (Dovecot, Cyrus) will still keep server-side backups for some period — true byte-level secure-delete requires action by the server operator, not just an IMAP client.

For workflows that involve cleaning inbox subscriptions before mass-deleting them, see how to remove newsletters from inbox and best way to mass unsubscribe — both reduce the volume you need to delete in the first place.

---

Server-side recovery and what you cannot undo

Even after you “permanently delete” via the user interface, server-side recovery can still reach the message for a finite window. On Google Workspace, an admin can recover deleted items for 25 days after Trash purge via the Admin Console. On Microsoft 365, the Recoverable Items folder retains items for 14-30 days by default, and eDiscovery or Litigation Holds can preserve them indefinitely. On personal Gmail and Outlook.com, no such admin recovery exists — once the user purges, the message is gone from the user’s perspective, though providers retain backup copies for short internal periods (Google states up to 60 days for personal accounts).

The hierarchy of “gone” from your perspective:

1. In Trash — recoverable by you and admin.
2. Purged from Trash — recoverable by admin if on Workspace/M365 (within their retention window), not by you.
3. Outside admin recovery window — gone from production systems. Provider backups may retain copies for additional days/weeks.
4. Backups expired — truly gone, no party can recover.

For most personal use cases, “purged from Trash” is effectively gone — Google and Microsoft do not return personal-account messages to users once Trash is emptied. For business compliance use cases, only your admin can confirm with certainty whether a message has been removed from all server-side stores.

A practical implication: if you are leaving a job and want to be certain emails are removed before handing back the laptop, you cannot enforce this yourself on a managed account. The IT admin controls retention policy. The right move is a formal data-handling request through HR, not a Shift+Delete spree on your last day.

---

GDPR right-to-erasure & secure-delete considerations

GDPR Article 17 (the “right to erasure” or “right to be forgotten”) gives EU residents the right to demand that data controllers delete personal data held about them, including in email systems. The controller must respond within one month and apply the deletion across primary stores, backups, and any third-party processors. For your own personal mailbox, GDPR is not the right frame — you are not a data controller for yourself. But when you ask a company to delete the emails it sent you, or when you process emails on behalf of clients, Article 17 applies.

The CNIL (France’s data protection authority) reported in its 2024 activity report, published April 2025, that erasure-request complaints continue to be a top category, and that fines for failure to honour valid erasure requests have grown year-on-year. In one 2025 case, a French company was fined €240,000 in part for failing to delete personal data within the one-month statutory window. The lesson: for any organisation handling personal data via email, “we deleted it from the inbox” is not enough — the deletion has to propagate to Sent items, server backups, archive copies, and any forwarded copies on other systems.

For sensitive material, three additional considerations:

1. Backups: most providers run rolling backups (Google, Microsoft) for 30-60 days. True deletion from backups happens when the backup retention window passes.
2. Forwards and CCs: if you emailed a sensitive document to five people, deleting your copy removes one of six. The other five hold full copies on their own servers.
3. Secure-delete on disk: provider-side, the bytes are not zeroed — the database row is marked deleted. Standard data-erasure standards (NIST SP 800-88) apply to physical disks at end-of-life, not to live cloud mailboxes.

If you need provable deletion for legal or compliance purposes, ask your provider in writing for a deletion attestation and the applicable retention windows. Most enterprise providers (Google Workspace, Microsoft 365) have published documentation on this.

---

Bulk permanent delete strategies

For large purges — multi-year inbox cleanouts, leaving a job, or pre-archive cleanup — the fastest path is a date-filtered search followed by select-all and “Empty Trash now.” In Gmail, search older_than:1y, select all matching, delete, then empty Trash. In Outlook web, use the Filter > date sort then select-all-shift-delete. For ongoing inbox hygiene, the most efficient approach is to combine unsubscribing (stops new mail) with a recurring bulk-delete cadence (clears the backlog).

Gmail bulk permanent delete by age:

1. Search bar: older_than:1y (or older_than:6m, older_than:2y).
2. Tick the select-all checkbox, click “Select all conversations that match this search”.
3. Click the trash icon — moves to Trash.
4. Open Trash > “Empty Trash now”.

Outlook bulk permanent delete by sender:

1. Search bar: from:newsletter@example.com.
2. Press Ctrl+A to select all results.
3. Shift+Delete to bypass Deleted Items.

For broader inbox hygiene strategies, see the companion guides on archiving emails in bulk (a non-destructive alternative) and how to delete promotional emails (focused on the Promotions category).

---

---

Sources & references

1. Google Help Center, “Delete & restore Trash in Gmail” — confirms 30-day auto-purge of Trash, “Delete forever” action, “Empty Trash now” behaviour. Accessed 2026-05-16. support.google.com/mail/answer/7401
2. Microsoft Learn, “Create eDiscovery holds in an eDiscovery case” — confirms Recoverable Items default retention (14 days, extensible to 30), 30-day delay-hold mechanic after release. Accessed 2026-05-16. learn.microsoft.com/en-us/exchange/security-and-compliance/in-place-and-litigation-holds
3. CNIL, “Rapport d’activité 2024” (published April 2025) — erasure-request complaint volumes and enforcement trends, including the €240,000 fine for failure to honour erasure within the one-month statutory window. Accessed 2026-05-16. cnil.fr/fr/la-cnil-publie-son-rapport-dactivite-2024
4. European Data Protection Board, “Guidelines on the right to erasure (Article 17 GDPR)” — scope of erasure, one-month response deadline, propagation to backups. Accessed 2026-05-16. edpb.europa.eu
5. IETF RFC 3501, “Internet Message Access Protocol — Version 4rev1” — definition of the \Deleted flag and EXPUNGE command. Accessed 2026-05-16. datatracker.ietf.org/doc/html/rfc3501
6. Apple Support, “Use Mail on iCloud.com” — Bin folder behaviour and Empty Bin action on iCloud Mail. Accessed 2026-05-16. support.apple.com/guide/icloud

---

Frequently asked questions

What does “permanently delete” actually mean in Gmail?

Pressing Delete in Gmail moves a message to Trash, where it sits for 30 days before Gmail auto-purges it. “Permanently delete” means bypassing that window — either by selecting the message in Trash and clicking “Delete forever”, or by clicking “Empty Trash now”. After that, the message is gone from your account view and not recoverable by you.

Can Google or Microsoft still recover an email I permanently deleted?

On a personal Gmail or Outlook.com account, no — once you “Delete forever” or empty Trash, you cannot recover it from the UI. On Google Workspace and Microsoft 365, however, an admin can recover items for up to 25 days (Workspace) or 14-30 days by default (M365 Recoverable Items), and longer if a retention policy or eDiscovery hold is in place. True permanence on a managed account requires admin policy review.

How do I permanently delete emails on IMAP (Thunderbird, Apple Mail, etc.)?

IMAP uses a two-step model: marking a message with the \Deleted flag, then issuing an EXPUNGE command that physically removes flagged messages from the mailbox. Most clients hide this — “Delete” in Thunderbird marks and expunges depending on settings. To force true removal, set the client to “Expunge on delete” or run the EXPUNGE command manually.

Does permanently deleting an email remove it from the recipient’s inbox?

No. Once an email is sent and delivered, the recipient holds their own copy on their server. Deleting it from your Sent folder only removes your copy. Removing the recipient’s copy requires a recall (M365 Exchange, limited conditions) or asking them directly.

What’s the difference between “Empty Trash” and “Delete forever”?

“Empty Trash” (or “Empty Bin”) purges every message currently in the Trash folder in one action. “Delete forever” targets selected messages already in Trash and removes only those. Both bypass the 30-day auto-deletion window.

Does GDPR’s right to erasure apply to my personal Gmail account?

GDPR’s Article 17 (right to erasure) applies to data controllers processing personal data — typically employers, services, or third parties holding your information. For your own personal Gmail or Outlook account, Google and Microsoft are the data controllers for service-level data, and you control the message content. Deleting your own emails is a self-help action, not a GDPR request.