Avast researchers purchased some 20 used phones from pawn shops in New York, Paris, Barcelona, and Berlin. Each shop owner assured the researchers that the devices were cleaned of all personal files ahead of time. 12 of the phones had not been wiped at all, and some had forgotten to log out of their Gmail accounts. The previous owners had simply forgotten to execute a factory reset or delete their personal data. Users are responsible for cleaning all sensitive and personal data from their devices prior to sale, security company Avast says.”]
Source: https://grahamcluley.com/2000-personal-photos-emails-info-used-smartphones/