I bought an expired domain and set up Google Search Console. After verifying ownership, I found a multi-year ownership history containing unredacted email addresses, dates, times, and apparent verification attempts from previous owners, employees, freelancers, and agencies. Some of the records appeared to go back to 2023, even though the domain had clean DNS and hosting and no previous users still had access.
This seems like a serious privacy and security issue. If a domain is sold or allowed to expire, a competitor could potentially discover personal email addresses, internal staff accounts, and vendor relationships associated with the old site. I also couldn't find a way to delete this historical information permanently. Is this expected behavior, does the data eventually expire, and is there any way to remove it before transferring or abandoning a domain?
4 Answers
A domain transfer or clean DNS setup doesn't necessarily erase records held by an external service. If the history is genuinely visible to a new, unrelated verified owner, assume it can be exposed when a domain is sold or abandoned. For future projects, use generic company accounts rather than personal Gmail addresses, and remove every Search Console owner before transferring the domain, while recognizing that this may not immediately clear historical entries.
Some of the confusion may come from mixing current users and ownership history. Current Search Console permissions should disappear when access is removed, while historical verification events can remain separately. If the page is showing old verification attempts rather than active users, that appears to be retained audit data—not proof that the previous owners still control the property. Still, exposing full email addresses in that history would be a legitimate privacy concern.
Several people have observed that Search Console keeps ownership-verification history attached to the property, including older or failed verification attempts. The records may age out only after all owners have been removed for a long enough period, but reports of seeing roughly three years of history suggest the retention behavior is unclear or inconsistent. If you manage domains that may later change hands, avoid using personal addresses for verification and consider role-based or dedicated accounts instead.
This is different from ordinary domain-registration information. The concern here is the identity and timing of everyone who previously verified the property in Search Console, including agencies and consultants. Those relationships and addresses may be sensitive even if the domain's registered owner was publicly visible. I would document the behavior with screenshots and report it as a privacy issue through Google's support or bug-reporting channels.
I tested this with multiple purchased domains and still saw verification records from 2023 onward, even after removing the old owners and changing the registrar, DNS, and hosting. So the advertised expiration period may require a specific condition, or it may not be working reliably.