Right to Be Forgotten: Removing Your Information from the Internet

The right to be forgotten allows individuals to request that organizations delete their personal data and that search engines remove links to information about them. Established by the landmark 2014 Google Spain ruling in the EU and codified in GDPR Article 17, this right has been exercised millions of times. Google alone has processed over 5 million URL removal requests since the ruling. Understanding when and how to exercise this right helps you control your digital legacy.

When the Right Applies

Under GDPR, you can request erasure when: the personal data is no longer necessary for its original purpose, you withdraw consent and no other legal basis supports processing, you object to processing and no overriding legitimate grounds exist, the data was processed unlawfully, or the data was collected from a child.

The right is not absolute. It does not apply when processing is necessary for exercising freedom of expression, compliance with legal obligations, public health purposes, archiving in the public interest, or legal claims.

Google Search Delisting

Google provides a web form for EU residents to request removal of search results. The request must specify which URLs you want removed and why they are irrelevant, outdated, or harmful. Google evaluates each request individually, balancing your privacy against the public’s right to information. Removal applies only to European Google domains; the information may remain accessible through Google.com in other regions, though Google has expanded geographic coverage in response to court orders.

As of 2023, Google has received requests to delist over 5.4 million URLs and has removed approximately 48 percent of them. Requests related to professional or legal history are more frequently denied than requests involving private personal information.

Requesting Data Deletion from Companies

Under GDPR, CCPA, and similar regulations, you can submit data deletion requests directly to companies. Most companies provide privacy request forms on their websites or respond to requests sent to their Data Protection Officer or privacy email.

For social media platforms, use the platform’s account settings to download and then delete your data. For other services, submit deletion requests through their privacy pages. Document all requests and responses. Companies must respond within regulatory timeframes (30 days for GDPR, 45 days for CCPA).

Practical Limitations

The right to be forgotten cannot erase information that has been screenshot, archived by the Wayback Machine (which generally honors removal requests for personal information), or republished by third parties. News articles about matters of public interest are generally protected. Court records and government databases have separate legal frameworks.

For removing your data from data brokers specifically, see our data broker removal guide. To understand the broader privacy legal landscape, explore our privacy legislation worldwide guide.

Practical Challenges and Limitations

The right to be forgotten faces inherent limitations in the digital age. Information shared publicly on the internet may be cached, archived, or republished by third parties beyond the reach of deletion requests. The Wayback Machine (archive.org) generally honors requests to remove personal information but does so voluntarily, not through legal obligation in most jurisdictions.

Court records, news articles about matters of public interest, and information necessary for the exercise of freedom of expression are generally exempt from erasure requests. The balancing test between privacy rights and public interest is applied case by case, and outcomes are not always predictable.

For individuals facing persistent unwanted online content, a combination of erasure requests, search engine delisting, and online reputation management may be necessary. In severe cases involving defamatory or harassing content, legal action against the publisher may be the only effective remedy.