Every time someone clicks “Sign in with Google” on a new shopping app, quiz site, or productivity tool, they hand that company a key to part of their Google Account. Most people do this dozens of times and forget almost every one. That quiet accumulation of forgotten permissions is exactly why Google has periodically emailed users to review risky or unused third-party apps, and why security teams keep telling people to audit those connections at least once or twice a year. The good news: revoking access takes less than a minute per app once you know where to look.
This guide walks through the exact steps, the traps that make people think they’ve revoked access when they haven’t, and how to tell the difference between a Google Account permission and an Android app permission. It’s written for ordinary users, not administrators, though there’s a short section for Workspace accounts too.
What Revoking Access Actually Does
Before touching any buttons, it helps to understand what a third-party app is in Google’s world. When an app asks to “Sign in with Google,” it’s using an authorization system that grants it specific scopes — permission to read your email, see your calendar, access Drive files, or simply confirm your name and email address. The app never sees your password. It receives a token instead.
Revoking access kills that token. Going forward, the app can no longer pull new data from your Google Account, and it typically can’t sign you in with Google anymore either.
Here’s the part people miss: revoking access does not delete the data the app already collected. If a photo-editing tool downloaded your Drive images last year, removing its access today doesn’t reach back in time and erase those copies. Google’s own help documentation has been clear on this point over the years. Revocation is a forward-looking control, not a cleanup crew. If an app has stored your data, you’ll need to contact that company directly or use whatever deletion tools it offers.
Step-by-Step: Removing a Third-Party App from Your Google Account
The main control lives on Google’s connections page, which you can reach directly at myaccount.google.com/connections or by navigating through your account settings. Here’s the full path:
- Sign in to your Google Account and go to myaccount.google.com.
- Select Security in the left-hand navigation.
- Scroll to the section labeled something like “Your connections to third-party apps & services” and click through to the full list.
- Review each app. Google shows the app name, when it last accessed your account, and which data it can see.
- Click an app to expand it. You’ll see a button offering to delete all connections you have with [app].
- Confirm the removal. The app disappears from the list, and its tokens are invalidated.
That’s it. No password change needed, no waiting period. The change is effectively immediate, though some apps may take a few minutes to notice their token has died.
A practical tip from experience: sort your review by “last accessed” if the interface offers it. Apps you haven’t touched in a year are the easiest candidates for removal. Anything you don’t recognize at all deserves an immediate revoke — especially if it claims access to Gmail or Drive, the two most sensitive scopes Google hands out.
Another tip that saves time: don’t agonize over each decision. If you can’t remember why an app has access and you haven’t used it recently, remove it. Re-authorizing later takes ten seconds if you actually need it back.
The Mistakes That Make People Think They’re Protected
Several common errors leave people with a false sense of security. These come up again and again in support forums and security discussions.
Revoking the wrong thing. On Android, people sometimes go to Settings > Apps > [app] > Permissions and remove permissions there, assuming they’ve cut Google access. They haven’t. Those are operating-system permissions like camera or location. The Google Account OAuth grant is a separate layer, managed on the connections page. You may need to do both, and doing one doesn’t do the other.
Confusing “sign out” with “revoke.” Signing out of an app on your phone ends your session. It doesn’t invalidate the app’s authorization to your Google data. The app can still hold a valid token and keep syncing in the background.
Assuming deletion of the app is enough. Uninstalling an app from your phone doesn’t automatically revoke its Google Account access. The connection persists server-side until you remove it from the connections page.
Forgetting browser extensions. Extensions that request Google access show up in the same list. A screenshot tool with Drive access is easy to forget because you never “sign in” to it consciously.
Missing the second Google Account. Many people have a personal account and a work or school account. Each has its own connections list. Revoking on one does nothing for the other.
If you’re the type who likes locking down your phone more broadly, the same review habit pairs well with tools covered in this roundup of best app blockers, which limit what can run in the first place rather than cleaning up after the fact.
Reading the Permission List Without Panic
When you open the connections page, the scope descriptions can look alarming. “See, edit, create, and delete all of your Google Drive files” sounds catastrophic. Context matters, though.
A note-taking app that syncs to Drive genuinely needs Drive scope to function. A weather app that requests Gmail access almost certainly doesn’t. The question to ask isn’t “is this scope scary?” but “does this app’s core function require this scope?”
| Scope level | Typical legitimate use | Red flag if requested by |
|---|---|---|
| Basic profile (name, email) | Any sign-in | Nothing — this is normal |
| Calendar read/write | Scheduling tools, meeting assistants | A game or wallpaper app |
| Drive full access | Note apps, backup tools, office suites | A simple photo filter |
| Gmail read/modify | Email clients, inbox organizers | Almost anything else |
Google has tightened its OAuth policies over the years, requiring verification for apps that want sensitive scopes like Gmail or Drive. That reduces the number of sketchy apps that can even request them, but it doesn’t eliminate the risk — and it doesn’t clean up grants made years ago before those rules tightened. (OAuth)
When You Can’t Find the App You’re Looking For
Sometimes the app you want to remove isn’t listed. A few explanations exist. The app may have been removed from Google’s systems entirely, in which case its access is already dead. Or you’re looking at the wrong Google Account. Or — and this is common with workplace accounts — your organization’s administrator has restricted which apps can connect, and the management interface looks different from the consumer version.
Workspace administrators control third-party access centrally through the Admin console, under Security > Access and data control > API controls > App access control. If you’re on a work account and the connections page seems limited or missing options, that’s usually why. Ask your IT team rather than assuming something is broken. (Manage third-party apps & services with access to your account)
On the consumer side, Google has also been nudging users toward better habits. Periodic security checkups flag apps that haven’t been used recently, and the account security page surfaces connection counts. It’s worth running that checkup occasionally rather than only reacting to a news story about a data breach.
A Realistic Maintenance Routine
The honest truth is that a one-time cleanup decays fast. New apps get authorized constantly — every free trial, every “continue with Google” button. A workable routine looks like this:
- Quarterly: open the connections page and scan for anything unfamiliar. Two minutes.
- After any breach headline: check whether the named company had Google access, and revoke if so.
- Before switching phones: do a full review, since old apps often linger.
- Whenever you cancel a subscription: revoke that service’s access at the same time.
For people who manage multiple accounts — say, a personal Gmail plus a work profile — a password manager or authenticator setup makes the whole process less painful. If you’re weighing options there, this comparison of Authy vs Google Authenticator covers the tradeoffs between the two most common choices.
There’s a broader principle at work here too. The same OAuth plumbing that powers “Sign in with Google” sits underneath nearly every modern app ecosystem, including the ones under regulatory scrutiny for their fee structures and data practices, as covered in this analysis of the Apple SCOTUS 27 percent App Store fee case. Understanding who holds a key to your account is a basic digital literacy skill now, not a niche security hobby.
Conclusion
Revoking third-party app access on Google is genuinely a two-minute job: open the connections page, scan the list, remove anything you don’t recognize or no longer use. The complexity isn’t in the steps — it’s in remembering that the list exists, that uninstalling an app doesn’t clean it up, and that Android permissions are a separate system from Google Account grants. Do the review quarterly, treat unfamiliar apps as guilty until proven useful, and remember that revocation stops future access but doesn’t erase data already collected. That last point matters more than any button on the page.
Frequently Asked Questions
Does revoking access delete the data an app already collected?
No. Revoking access stops the app from pulling new data and typically breaks its ability to sign you in with Google, but any information it already stored stays with that company. If you want existing data deleted, you have to contact the app developer directly or use whatever deletion request process they offer.
Will removing an app from my Google Account log me out of it?
Usually yes, eventually. Once the token is invalidated, the app can no longer verify your identity through Google, so most apps will either sign you out or prompt you to create a separate password-based account. Some apps keep their own local session running until it expires, so you may not notice immediately.
Is it safe to revoke access to an app I still use?
It’s safe, but it will break things. If you revoke access to an app you rely on, it will lose the ability to sync or sign you in until you re-authorize it. The fix is simple: open the app again and go through the Google sign-in flow, which regenerates the permission grant.
Why can’t I find an app in my Google connections list?
Three likely reasons. You may be signed into a different Google Account than the one you used for that app. The app may have already been removed from Google’s systems, which kills its access automatically. Or you’re on a work or school account where an administrator has restricted third-party connections, changing what you can see and manage.
Do I need to revoke access on every device separately?
No. The connections page is tied to your Google Account, not to a specific phone or computer. Revoking an app once removes it everywhere at the same time. However, Android app permissions — camera, location, contacts — are managed per device, so those do need to be handled separately on each phone or tablet.
How often should I review third-party app access?
A quarterly check is a reasonable baseline for most people, plus an extra review after any major data breach in the news or whenever you cancel a subscription. The list grows faster than most people expect, and apps you authorized years ago for a one-time task are the ones most likely to still be sitting there with access you’d never grant today.
