What Is the Right to Be Forgotten? A Strategic Guide to Digital Privacy

The right to be forgotten is probably the most requested — and most misunderstood — concept in online content removal. Clients come to us citing it weekly, usually hoping it means a legal power to erase anything unflattering from the internet. The reality is narrower, more interesting, and, for the right person in the right jurisdiction, genuinely powerful: a legal mechanism, anchored in European law, to have personal data deleted or delisted from search results when there is no longer a good reason for it to be processed.

We file removal requests and search delistings for a living, and we should be clear about our lane before going further: we are a removal firm, not a law firm. Nothing here is legal advice — it is a practitioner’s map of how the right to be forgotten actually works, who can use it, where its limits sit, and what people outside its reach (which includes most Americans) can realistically do instead.

If you have ever wondered whether that old article, court mention, or forum thread about you could be made to stop following you around in search results, this is the honest lay of the land.

Where the right to be forgotten comes from

The concept has two anchor points. The first is a 2014 ruling by the Court of Justice of the European Union in the Google Spain case, brought by a Spanish man, Mario Costeja González, who objected that searching his name surfaced a 1998 newspaper notice about a long-resolved debt proceeding. The court held that search engines are data controllers, and that individuals in the EU could require them to delist results for name searches when the information was inadequate, irrelevant, or no longer relevant — even if the underlying page was lawful and stayed online. That last clause is the key: the newspaper archive remained; the search result for his name went.

The second anchor is Article 17 of the General Data Protection Regulation (GDPR), in force since 2018, formally titled the “right to erasure.” It gives individuals in the EU the right to have organizations delete their personal data in defined circumstances — for example, when the data is no longer necessary for the purpose it was collected, when the person withdraws consent and no other legal basis applies, when the person objects and no overriding legitimate grounds exist, or when the data was processed unlawfully. The UK carried an equivalent right into its own law after Brexit, so in practice the regime covers the EU, the wider EEA, and the UK.

Neither anchor creates an absolute right. Article 17 contains explicit exceptions — freedom of expression and information, legal obligations, public interest archiving, and legal claims among them — and delisting decisions balance the individual’s privacy against the public’s interest in the information. A politician’s corruption coverage is not coming down; a private individual’s decades-old resolved debt notice very plausibly is.

Delisting vs. erasure: the distinction that decides your strategy

Most confusion about the right to be forgotten collapses once you separate its two very different operations:

Erasure: deleting the data at the source

An Article 17 request aimed at the organization holding your data — a company database, a website, a broker — seeks actual deletion. When it succeeds, the data is gone from that controller. This is the stronger remedy and the harder one: the controller may have valid grounds to refuse (journalism and archives most prominently), and each controller must be approached separately.

Delisting: removing the search result for your name

A request aimed at a search engine seeks removal of specific URLs from the results shown for searches of your name, within the relevant jurisdiction’s versions of the search engine. The page survives; its findability by name collapses. This is the Google Spain remedy, and it is often the practically decisive one — because for most reputational harm, the injury is not that a page exists but that it is the first thing your name returns. Search engines maintain dedicated legal request forms for EU/UK residents, weigh each request against public-interest criteria, and report accepting a substantial share of the URLs submitted.

The strategic takeaway we give clients: think of erasure as source control and delisting as visibility control, and note that delisting granted under EU/UK law applies to the search engine’s European services — someone searching from the US may still see the result. Sophisticated removal work usually runs both tracks at once, plus the platform-policy and broker-opt-out tracks that have nothing to do with GDPR at all — the everyday machinery of data broker removal works worldwide because it relies on sites’ own processes, not European law.

How the process works for EU and UK individuals

For a person in the covered jurisdictions, the practical route looks like this:

1. Inventory the URLs that surface for your name and identify what each contains and why its continued processing is unjustified — outdated, irrelevant, excessive, or unlawful.
2. For delisting, submit the search engine’s legal removal form (Google, Bing, and others each maintain one) listing the URLs, your identity, your connection to the content, and your grounds. Requests are assessed case by case against the public-interest balance.
3. For erasure, write to each source website or organization invoking the right to erasure, stating the grounds. Controllers must respond within a defined period — a month, extendable for complex cases.
4. If refused, escalate to your national data protection authority (or the UK’s ICO), which can review the decision — or pursue the matter through the courts, at which point you genuinely need a lawyer rather than a guide.

Success correlates with specificity: precise URLs, concrete grounds mapped to Article 17’s language, and a sober account of why the public interest does not require the information to remain attached to your name. Vague demands to “delete everything about me” fare poorly on every track.

The US reality: no federal right to be forgotten

Here is the part American readers need to hear plainly: the United States has no federal right to be forgotten, and the First Amendment makes a European-style regime unlikely — truthful, lawfully obtained information enjoys strong protection, and courts have repeatedly favored publication rights over erasure claims. A US resident cannot compel Google to delist a lawful news article about them because it is old and embarrassing.

But “no federal equivalent” does not mean “no tools.” The American toolkit is a patchwork, and worked properly it accomplishes more than most people expect:

• State privacy laws. California’s CCPA/CPRA and a growing roster of other state statutes grant deletion rights over personal data businesses hold about you, plus opt-outs from sale and sharing. California’s Delete Act is building a one-stop deletion mechanism aimed squarely at data brokers. These rights have carve-outs (notably for publicly available information and journalism) — they are consumer-data rights, not content-removal rights — but against brokers they have real teeth.
• Google’s own voluntary processes. Independent of any law, Google removes results exposing personal contact information (home address, phone, email), non-consensual explicit imagery, imagery of minors, doxxing content, and certain other categories; its “Results about you” tooling surfaces and streamlines some of these requests. Its outdated-content tool clears results for pages already changed or deleted at the source. This is the closest thing the US has to routine delisting, and using it well is the core of removing yourself from Google.
• Platform and site policies. Most damaging content lives on platforms with removal policies broader than any statute — harassment, doxxing, impersonation — and most brokers honor opt-outs regardless of your state. The bulk of practical personal data removal in the US runs on these mechanisms.
• Actual legal claims. Defamation, false light, and similar causes of action exist for content that is unlawful rather than merely unwanted — a question for an attorney, and one where a removal firm’s role is executing takedowns once counsel establishes the basis.

The honest US framing: you cannot erase the lawful public record, but you can usually control the searchable surface — suppress the brokers, invoke the removal categories that exist, de-index what qualifies, and maintain the result. That maintenance clause matters: broker data re-populates from refreshed records, so one-time deletion decays without recurring suppression — the premise behind our protection plans.

A practical filing route, wherever you are

Distilled into a working sequence:

1. Map your name’s search surface — every URL on the first several pages for your name and its variants, categorized: broker listings, press, social, forums, official records.
2. Sort each URL by available mechanism. EU/UK residents: Article 17 erasure and delisting candidates. Everyone: broker opt-outs, platform policy violations, Google’s removal categories, outdated-content candidates, and — for genuinely unlawful content — the see-a-lawyer pile.
3. File the no-brainers first. Broker opt-outs and Google personal-information removals are fast, free, and high-yield.
4. Draft the judgment-call requests carefully. Delisting and erasure requests live or die on specific grounds; platform reports live or die on mapping content to the exact policy violated.
5. Escalate methodically. Unanswered requests get follow-ups; refusals get the next mechanism on the list (DPA complaint in Europe; alternative categories or suppression in the US).
6. Re-check quarterly. Removed broker listings return, and new content appears. The searchable surface is a garden, not a sculpture.

For a private individual with one or two problem URLs, this is a manageable DIY project. Where it stops being one — dozens of URLs, resistant sites, cross-jurisdictional questions, a public role that raises the public-interest bar — is where a managed online privacy service earns its keep, and where visible individuals in particular tend to route the whole problem through programs like our executive service rather than fielding it form by form.

Frequently asked questions

Does the right to be forgotten apply to Americans?

Not as such. GDPR rights attach to people in the EU/EEA (and the UK under its own law) — not to US residents searching from the US. An American with sufficient EU connection may have options worth exploring with counsel, but the practical answer for most Americans is the US toolkit: state-law deletion rights, broker opt-outs, and search engines’ voluntary removal processes.

Can the right to be forgotten remove news articles?

Rarely at the source — journalism sits squarely inside Article 17’s freedom-of-expression exception, and publishers usually refuse. The realistic remedy in Europe is delisting: the article stays published, but qualifying requests can remove it from name-search results where the person’s privacy outweighs the public interest — a balance that tilts with time, resolution of the underlying matter, and the person’s public role. In the US, lawful articles are essentially immovable by demand; the levers are corrections requests to the publisher and long-term search suppression.

If Google delists a result in Europe, is it gone worldwide?

No. The CJEU held in 2019 that EU delisting obligations extend to EU-facing versions of the search engine, not globally. Someone searching from New York can see a result delisted for searches from Paris. That geographic limit is a core reason comprehensive removal work targets sources and brokers directly — a page deleted at the source is gone everywhere.

Is there a form I can just fill out to be forgotten?

For EU/UK delisting, genuinely yes — the major search engines maintain legal removal request forms, and a well-grounded submission needs no lawyer. For erasure, it is a written request to each controller, one by one. For Americans, the equivalent is a stack of different forms: broker opt-outs, Google’s removal request types, state privacy-rights portals. The mechanism is never the hard part; the completeness and the follow-through are.

Find out what your name actually surfaces

Whatever jurisdiction you are in, strategy starts with an inventory. Run our free exposure scan to see exactly which broker listings, search results, and data exposures are attached to your name today — and which removal mechanism, from opt-outs to delisting requests, applies to each one.