Delete an old Instagram account you cannot access: how our solicitors got a hacked childhood account permanently removed

Case led by Reagan Brien, Solicitor specialising in social media account recovery.

This case study is part of our social media account recovery section.

If there is an old Instagram or Facebook account in your name that you cannot get into, that you suspect has been hacked, and that you want gone rather than back, the law gives you a way to have it permanently deleted. That is what we did for our client, a young investment banker in Dubai, whose childhood Instagram account was still public more than a decade after he had last used it. Names and some details have been changed to protect the client; what happened, what we did and how it ended are as they were.

Old Instagram account you cannot access or delete: what happened to the client

Our client is in his early twenties and had recently joined the investment banking team of one of the world's largest banks, in its Dubai office. He had grown up in the Gulf, studied in London, and went straight from university into a role that keeps him in the office six days a week and in daily contact with colleagues in London. He hopes to spend part of his career in London or New York.

He had also made a decision that is becoming more common among young professionals: to have no social media at all. While still a student he had deleted every account he could find. Working in a sector where a new hire is searched online before the first handshake, he wanted to be the one who decides what appears under his name.

Then a friend sent him a link. An Instagram account he had created when he was about eleven years old was still live and public. It carried his name, photographs of him as a child and the kind of profile a child writes. He had forgotten it existed. When he tried to log in, he could not. The email address on the account had been changed, which he had never done, so the account had almost certainly been taken over by someone else at some point in the intervening years. Instagram's recovery process sent its codes to that stranger's address. Every attempt to recover or delete the account came to nothing.

Some of what was in the account, our client feared, was immature and could be read as harmful to him by someone who did not understand that it had been written by a child a good few years ago. Beyond that, the problem was control. An account he could neither manage nor close, in the hands of an unknown person, sitting on the first page of a search for his name, was the opposite of what he had worked to achieve. In investment banking, background checks are routine and an unexplained account is a question a candidate would rather be able to answer. He asked us to have it permanently removed.

Why Instagram's delete and recovery tools fail once a hacked account's email has been changed

Instagram only lets you delete an account from inside it. To get inside, you need the password or a recovery code, and the code goes to the email address or phone number on file. Once a hacker has replaced those, every code goes to the hacker. The identity checks that follow tend to fail as well, because the account has stopped matching the person asking. Our client had tried, more than once, and each time the process ended where it started.

It is worth saying plainly that this is a design limit of the tools and not a limit on your rights. The account was his personal data, and a platform's duty to deal properly with personal data does not switch off because an automated form has reached the end of its steps.

Instagram only lets you delete an account from inside it. Once a hacker has changed the email address, the door you need is the one you can no longer open.

The right to erasure: the piece of data protection law that gets a childhood social media account deleted

Data protection law gives every person a right to erasure. Fewer people know how it works, or that it has a particular strength when the data was collected from a child. Under the UK GDPR, a person can require an organisation to erase personal data where it is no longer needed for the purpose it was collected for, where the person objects to its continued use and the organisation has no overriding reason to keep it, and, specifically, where the data was collected from a child who signed up to an online service (the right to erasure, Article 17 of the UK GDPR). Instagram's own terms require users to be at least thirteen; our client was about eleven when the account was made.

A right on paper is one thing. Using it correctly is what makes a large platform act. The request has to go to the right company, identify the person and the account beyond doubt, set out the grounds in the order that matters, and deal in advance with the objections the platform would otherwise raise. Our client lives outside the UK, so we also set out why UK data protection law reached his case: he had lived and studied in London, kept close professional ties here, and the account had been in use during those years. A request that is framed this way gets read by a person with authority rather than fed into the same queue as everyone else's.

There is a wider reason a request of this kind now carries weight with a US platform, and it helps clients far beyond the UK. British regulators have spent the last two years showing that they can reach companies with no office here at all: Ofcom under the Online Safety Act, and the Information Commissioner under the UK GDPR, which in February 2026 fined the US platform Reddit £14.47 million for handling the personal data of children under thirteen without a lawful basis. A platform that knows the regulator is watching how it treats children's data is a platform that would rather settle a well-founded request about a child's account than argue about it. Finding that leverage, and using it in the right order, is where lawyers who deal with these platforms every week earn their fee. The bigger picture of how UK law now reaches American platforms is told in Yair Cohen's series on his own blog, for readers who want it; for this page, the point is simply that the reach is real and it works in your favour.

Writing to Meta and to the lawyers who act for Meta: what we did and why we did it that way

We began by taking a full account from our client and by gathering what Meta would need in order to trust us: a copy of his identification and a signed authority confirming that we acted for him and that the account was his. That part is easy to overlook and it is often the reason requests stall.

Then we wrote formally to Meta Platforms, Inc. in the United States. Meta publishes no email address for correspondence of this kind, so the communication goes by post to California, which feels old-fashioned and is still a necessary step. It set out the history of the account, the fact that it had been created by a child, the years it had sat unused, the change of email address that pointed to an unauthorised takeover, and the legal grounds on which we required its permanent deletion. We also pointed Meta to its own terms, which give it the power to act on compromised and inaccessible accounts.

At the same time we sent a copy to the international law firm that regularly acts for Meta on matters of this kind. Because we have dealt with Meta many times, we know which firm that is, how to put them on notice, and the individual lawyers who work on these cases, so that we can address them directly. A member of the public writing to them directly is highly unlikely to be dealt with, because without instructions from Meta a law firm will usually decline to engage. It took a few days and a couple of communications, and we kept our client's matter on their desk until Meta instructed them. Persistence, in our experience, is most of what gets a result from a platform of Meta's size.

We know which law firm acts for Meta on these cases, and the individual lawyers who handle them. We kept our client's matter on their desk until it was dealt with.

Outcome: the hacked childhood account permanently deleted

Once instructed, Meta's lawyers began dealing with us directly. Meta then provided our client with a secure link through which he could get back into the account for one purpose only, which was to delete it.

Even then it took some back-and-forth. The link gave our client difficulty at first, and it needed further communications with Meta's lawyers to sort out. That is a recurring feature of these cases: once a platform agrees to help, the technical steps of getting a person back into a long-dormant, compromised account can still be awkward. We know when to persist, how, and in which direction to send any further communication, and that could be tricky if you try to do it on your own. The account was permanently deleted. Our client had the clean slate he had set out to achieve, and he had it without any proceedings and without ever having to deal with Meta himself.

The whole matter was handled remotely. We act for a growing number of clients in Dubai and across the Gulf, for whom a UK legal route is often the most effective way to get a US platform to act, and the distance made no difference to the outcome.

Advice if you want an old Instagram or Facebook account deleted and you cannot get into it

Everything on this page applies just as much if your account was never hacked and you have simply lost access to it: the email address or telephone number linked to it is long gone, or for whatever reason you are unable to verify the account. The law treats the data in it the same way.

Start with one proper attempt through the platform's own recovery process, so that there is a record that you tried. If the email address or phone number on the account has been changed, expect that attempt to fail, and move on rather than repeating it for months. Each failed attempt is a sign that the account is no longer yours to operate, and that is the position the law then deals with.

Keep what you find. Screenshots of the profile, the date you discovered it, the email address you remember using, the messages the recovery process sent you, and anything that shows the account was created when you were a child. Together those make the request to the platform credible and hard to refuse.

Think about what you actually want. Many people assume they have to recover an account before they can delete it, and spend a long time trying. A request for erasure under data protection law does not require you to get back in first. It requires the platform to deal with your data, and deletion is one of the things you are entitled to ask for.

Then put the request in front of someone at Meta who is obliged to read it. In our experience that means a formal legal communication to the company and to the lawyers who act for it, framed on your data protection rights and sent with the identification Meta will need. Our guide to recovering a lost social media account explains the law, and how we recover a lost social media account when the platform says no sets out the steps we take, which are the same whether the aim is to get an account back or to have it gone. If your account was hacked and you want it restored rather than deleted, the route is told in hacked Facebook and Instagram accounts recovered.

Lawyers' thoughts about the case

What stays with us from this matter is how the law treats an account that was made by a child. Most erasure requests turn on an argument about whether the platform still needs the data, and platforms are practised at arguing that they do. Data collected from a child who signed up to an online service sits on different ground. The right to have it erased is written into the law in those terms, and a request that says so, with the evidence to back it, leaves the platform very little to argue with. People who created accounts in their early teens and have since lost them often assume the age of the account counts against them. In our experience it is the strongest card they hold, and the regulators' recent interest in how platforms handle children's data has made it stronger still.

The second lesson is about dormancy. An account nobody looks at is an account nobody is guarding. Over ten or fifteen years the email provider changes, the phone number changes, the password gets reused somewhere that is later breached, and one day the account quietly belongs to someone else. By the time the owner notices, the platform's own tools cannot tell owner from intruder. The earlier a forgotten account is dealt with, the simpler the job, and the simplest version of the job is to find your old accounts now, while you can still get into them.

The third is for anyone who, like this client, wants a clean slate. A clean slate is a reasonable thing to want and a legitimate thing to ask for, and it does not depend on anything being wrong with the content. The question the law asks is whether the organisation still has a good reason to hold your data against your wishes. For an abandoned account made by a child, the answer, properly put, is usually no.

One last thought. There are many companies offering services to restore access to social media accounts. What I love about our law firm is that we are always encouraged to think outside the box and find the angles that increase by miles the likelihood of our clients getting the result they need, and I am very pleased that in this case, as in so many others, that is exactly what happened.

Frequently asked questions

Instagram says it cannot delete an account for me and that I must be logged in. Is that the end of it?

No. That is Instagram's own process, and it is true as far as it goes: the app only deletes an account from the inside. Data protection law sits above the app. Under the UK GDPR, Meta has to deal with a properly made request to erase your personal data whether or not you can log in. In this case our client never regained his password; Meta, through its lawyers, provided a link for the account to be deleted once our request was in front of the right people.

I have an old Instagram account I cannot log in to. Can I have it deleted without the password?

Yes. Instagram's own process needs you to get inside the account first, but a request for erasure under data protection law does not. In this case we obtained the permanent deletion of an account our client had been locked out of for years, by writing to Meta and to its lawyers on his behalf.

The email on my old account has been changed and I did not do it. What does that mean?

It usually means someone else has taken the account over. Instagram's recovery codes will go to them rather than to you. Hacking an account is a criminal offence under the Computer Misuse Act 1990, though the quickest practical route is a legal request to the platform to secure and delete the account.

Does it matter that I created the account as a child?

It helps. The right to erasure applies with particular force to personal data collected from a child who signed up to an online service, and Instagram's own terms require users to be at least thirteen. An account made at eleven, as in this case, is on strong ground.

I live in Dubai. Can a UK law firm help me with a Meta account?

Often, yes. We act for many clients in Dubai and the Gulf. Where there is a UK connection, as there was here, UK data protection law can be used, and in any event a formal request from solicitors to Meta and its lawyers is dealt with very differently from a request through the app. Everything is handled remotely.

How long does it take to get Meta to delete an account?

It varies. In this case it took a few communications to bring Meta's lawyers into the matter, and the deletion followed after some further correspondence about the access link. Persistence is usually needed, and we tell you at the first call what to expect.

Can I just write to Meta's lawyers myself?

You can try, but a law firm acting for Meta is unlikely to engage with a member of the public without instructions from Meta. A communication from solicitors, with the right identification and the legal grounds set out, is treated as what it is.

I want a clean slate online. Is that a good enough reason to ask for deletion?

Yes. You do not need to show that the content is harmful. The question is whether the platform still has a good reason to keep your personal data against your wishes, and for an abandoned account that is usually a hard case for the platform to make.