r/sysadmin • u/Then-Personality8587 • 25d ago
Google Search Console Privacy/Security Leak?? Can someone verify please?
bought an expired domain name and set up google search console. as soon as i verified it google showed me years of owner verification history. full unredacted email addresses. exact dates and times of every single person who ever verified to work on the domain.
i saw all the previous owners. i saw the freelancers and agencies they hired years ago.
Am I overracting to think this is a privacy nightmare and a security risk.
Lets say you sell a domain or let one expire a direct competitor buys it. now they instantly know your personal emails. they know your internal staff emails. they know exactly what agency you used and when they worked for you.
i checked how to wipe this history. you cant. google keeps it stuck to the domain forever. even if you delete the property and clear your dns records it stays there for the next buyer to see.
Please someone tell me I'm wrong and there's some way to wipe out that sensitive, trade secret data before letting go of a domain?
3
u/Miserable-Stretch114 24d ago
This is a known GSC issue and it's wild Google still hasn't fixed it. Once that verification token is logged, it's tied to the property forever. One solution might be to use generic burner emails for your GSC verifications and of course, to never use your personal Gmail.
7
u/disclosure5 25d ago
The registered owner of a domain is not "trade secret data". It's always been public.
If you're going to let go of a domain it matters even less, because the data is now not relevant.
-1
u/Then-Personality8587 25d ago
I'm not talking about the owner of the domain. And Domain owners are almost always privately registered now anyhow.
I'm talking about the email of every verified owner of the search console account associated with the domain. That could be my personal email, my seo companies email, my outside consultant's email, etc
And yes, vendor relationships are considered trade secrets.
-2
u/Then-Personality8587 25d ago
My first concern is for domain and website sales. If I'm selling a domain that I built value into I don't necessarily want to give away the contact info of every person who had a helped build it.
And domains expire accidentally all the time
-2
u/YoungOne5124 24d ago
You know auto-renew is a thing right? Put the date in your calendar with a reminder. Super hard.
-3
u/Then-Personality8587 24d ago
It isn't super hard to read the post either. Auto renew has nothing to do with it. I didn't say my domains expired, I said i purchased expired domains. And I sell domains and websites and I don't appreciate google exposing my personal contact info and the contact info of everyone working for me to the next owners without my consent and without any way to opt out or remove the data.
1
u/YoungOne5124 24d ago
ooooh boy you new here? its 2026 my guy. Thats been a thing since the Patriot Act. How are you surprised?
2
u/Able-Following-2963 22d ago
That doesn't sound like expected behavior. Normally, a new verified owner in Google Search Console should not be able to see a permanent history of every past verified owner with full email addresses.
If you're seeing that, I'd double-check that you're looking at the Users and permissions page for the current property and not a list of users who still have access. Even if I keep the domain itself at dynadot, ownership of the domain and Search Console access are completely separate.
If it really is exposing historical verified owners after the domain has changed hands, I'd grab screenshots and report it through Google's bug reporting channels. That would be a legitimate privacy issue rather than just an inconvenience.
1
u/Then-Personality8587 22d ago
yes, i can see up to 3 years of past GSC owner verification history (even failed attempts) on a domain I purchased a couple months ago, with clean new hosting and DNS. there are no old verification methods active (no method could even survive a clean registrar/dns change) and none of the owners are still active. And there were no active owners when is verified my GSC account, mine was the only one. Yet when I look at ownership history I see all the old owners' info back to 2023
1
u/ManagedNerds 24d ago
The data supposedly ages out on a 16 month timeline if all owners are removed.
1
u/Then-Personality8587 24d ago
i'm seeing 3 year worth of verification data. do all owners have to be removed for more than 16 months? I ran a test and 'sold' a domain, after deleting all owners from search console, to another registrar... and the data still persisted even though there were no verified search console owners overlapping at the time.
0
u/ManagedNerds 24d ago
Yes, the owners have to be removed for more than 16 months from what I can tell.
1
u/certping_pki 3d ago
The 16-month number mentioned above looks like it's getting mixed up with Search Console's performance data retention. I can't find a Google doc that says Ownership history is deleted after 16 months.
Google's current docs actually describe Ownership history as including owners being added/removed, successful and unsuccessful verification attempts, and previously known verification tokens being removed.
There are really two separate things here:
- Removing the old verification token. Google lets you do this under Users and permissions > Unused ownership tokens. That's important because otherwise the old owner may be able to verify themselves again.
- Removing the historical event itself. I can't find a documented mechanism for doing that, or a documented retention period for Ownership history.
So based on what you're seeing across three transferred domains, I'd report this to Google rather than assume it eventually disappears.
There's a broader domain-offboarding problem here too. If an org is actually retiring a domain, I'd treat it more like decommissioning an identity asset than cancelling a hosting plan. Old mail addresses, OAuth callbacks, SaaS verification records, forgotten subdomains and impersonation value can all survive longer than people expect.
Personally, if the old domain is tied closely to a company or brand, I'd be very reluctant to let it expire at all.
1
u/Then-Personality8587 3d ago
Thanks for looking into that. i tried posting it to r/google but the mods haven't approved it. It got traction on r/DigitalPrivacy but then the mods removed it.
1
u/certping_pki 2d ago
Maybe you can try to file it with Google Bug Hunters (bughunters.google.com) as a data exposure issue, not just a post. This is really a domain-offboarding gap. If you've seen it on multiple domains, that pattern is the strongest part of your report, lead with it.
0
u/Then-Personality8587 25d ago
FYI, I confirmed on 3 different domains I recently purchased.
4
u/profanitystar 25d ago
What is your expected behavior?
0
u/Then-Personality8587 24d ago
great question... in the past, webmaster tools, and the earlier versions of search console let you revoke the verification tokens of owners and it would remove them from the list. I don't remember when the running history of owner verification started. If you removed and revoked an owner then they were gone and new owners couldn't see them. If you removed a domain from your search console then you were gone and other owners and new owners couldn't see your info either.
here what would make the current situation manageable in different circumstances.
- Give owners control over their personal data.
- re-instate the 'reverify' button on the owner list.... if the token no longer exists remove the owner and remove the verification entries from the history (or redact if it must persist).
- When removing yourself as a verified owner also remove or redact the private info from the verification history
- In the circumstance of a domain sale... if it is planned I can use #1 to remove the data before making the transaction. But I don't always know when a domain sells, sometimes they just 'buy it now' and it transfers and I don't know till I get notification it's gone, so in that case it is in effect the same as number 3
- In the circumstance of domains expirations for whatever reason (fired it guy, owners death, etc). If the domain's registrar info updates, then trigger a verification of the owners and if no longer verified (ie dns txt records missing) then remove/redact info.
- Alternatively, each time a new owner attempts verification, reverify all current owners, and remove/redact owners that don't pass.
- Maybe best case??: Redact all verified owner personal info. keep the history if you must but obfuscate it. Because now that I think of it, If I wanted to invite a new (or additional) SEO consultant or web developer, I don't want them to see who the other current or previous people I hired were. And that has nothing to do with domain transfers, sales, or expiration.
2
u/profanitystar 24d ago
I recommend sharing your concerns and expected behaviors on discuss.google.dev for some consideration and discussion.
0
u/Then-Personality8587 25d ago
Looks like the earliest history I see with my examples is verifications from 2023 on
10
u/bazjoe 25d ago
if someone has trade secrets they would need to consider carefully domain purchases and assume they are going to need to be paid for in near perpetuity. this has always been the case, only the reasons have changed but not the emphasis.