What Is the Right to Erasure?
The right to erasure, also called the right to be forgotten, is a legal right to ask an organization to delete your personal data. It is not absolute in any regime I know of. Two matter most for people in the US and Europe: Article 17 of the EU’s GDPR, and the deletion rights in California’s privacy laws.
I’m not a lawyer, and this is not legal advice.
GDPR Article 17
Under Article 17, a person can ask a controller to erase their data without undue delay when certain grounds apply. Examples include the data no longer being necessary for its original purpose, the person withdrawing consent, a valid objection, or unlawful processing. A controller that made the data public has to take reasonable steps to tell other controllers handling it. Article 12 sets the timing: respond within one month, extendable by up to two more months for complex requests, with the person told of any extension within the first month.
Article 17 also lists exceptions: freedom of expression and information, legal obligations, public health, archiving and research, and legal claims.
California
California’s Civil Code section 1798.105 gives a consumer the right to request that a business delete personal information the business has collected from the consumer. Read that wording closely. It covers data the business collected from you. A data broker mostly collects data about you from other places, not from you, which is one reason the state passed a separate law for brokers.
That law is the Delete Act. It created DROP, the Delete Request and Opt-out Platform, where a California resident files one request that goes to every registered broker. The state’s privacy agency says brokers must begin processing requests on August 1, 2026. It is free.
Where it stops
- Exceptions. Businesses can refuse in listed cases, such as completing a transaction, security and fraud detection, or legal compliance.
- Identity checks. A business can ask you to verify who you are. If you use an authorized agent in California, the business may require you to confirm your identity with it directly or confirm that you authorized the agent. This is why some removals can’t be fully handed off.
- Coverage. The right applies where the law applies. Outside the EU and a few US states, you are asking politely.
- Reappearance. Deleted data can be collected again. See data broker and people-search site for why records return.
Why I care
How Kidnappers Choose Their Targets says unless you are lucky enough to be European, or live in California, a removal request has to go to each site, with essentially no legal backing. That is still mostly true, with DROP as the big change for California residents. A privacy broker works the gaps these laws leave.
Sources
- GDPR Article 17 and Article 12.
- California Civil Code section 1798.105, as amended by Proposition 24.
- California Privacy Protection Agency, Information for Data Brokers, checked October 22, 2026.