The Right to Be Forgotten: Everything to Know About Erasing Digital Footprints

The internet never forgets.

What we post in words or images, what we tweet, what we “like” and what we criticize remains somehow, somewhere in a growing, great global memory.

What we buy, if we divorce or buy a house, and what has happened to us in court, will most likely reside — seemingly forever — in online records or in social media accounts, for all the world to find.

But in a movement that has taken hold in the European Union and nations including Canada, the United Kingdom and Argentina, laws establish various forms of a “right to be forgotten” or, more formally, a right to data erasure.

That movement and those laws aim to keep personal data hidden or to prevent it from being found online by search engines and social media users.

In the U.S., such laws requiring content to be removed or unpublished would violate the First Amendment, though news organizations may adopt such policies if they choose to do so.

Here's everything you need to know about the right to be forgotten.

What is the “right to be forgotten?”

The “right to be forgotten,” which exists in Europe and in other nations, provides for a person to ask websites or other online data storage operations either to erase entirely or block from public view information a person does not want to be accessible through an online search.

The right to be forgotten is different than a total erasure of information from official records, known as expungement. Expungement generally does not raise First Amendment issues because the government is removing speech from its own records and websites after a review process rather than demanding that a private entity do so.

California’s 2015 Online Eraser law was followed in 2023 by the state’s DELETE Act. The earlier bill allowed minors to demand removal only of information they had posted themselves, such as an embarrassing photo. The 2023 law empowered people of all ages to delete personal information being collected by data brokers who gather and resell consumer information for business use.

Some U.S. newspapers have chosen to operate programs that remove stories about minor crimes from online searches of the media outlet’s own online materials.

Life records have always been on display in some fashion. For hundreds of years, if someone had the time and skills to parse through official paper records and journals in a county courthouse, search church files, or wade through news organizations’ paper or electronic archives, personal information was there to be found.

But given the difficulty, time and cost of gathering and widely distributing the findings of such searches, most personal data remained hidden, and people lived in what could be called practical obscurity.

The digital era has made vastly more information about people available more easily than ever before. A recent search for “how to search for a person’s history” turned up 132 million search results offering tools, business services or simply advice on finding criminal histories, financial information, family links and any mention in the news or public records worldwide.

Polls show U.S. public support to be forgotten — but the First Amendment does not provide for it

Polls over the past 10 years find strong public support in the U.S. for keeping certain information from being found online. In 2020, the Pew Research Center reported 74% of adults said it was more important to “keep things about themselves from being searchable online;” 23% said it is more important to be able to “discover potentially useful information about others.”

In that survey, 85% said all Americans should have the right to remove from public searches any embarrassing photos and videos; 67% said that right should extend to employment records and work history; and 56% would include “negative media coverage.”

But in several decisions, U.S. courts have said no such general “right” exists in the United States. Such laws would almost certainly violate the First Amendment because they operate as a prior restraint on speech. The U.S. Supreme Court said in 1989 in Florida Star v. B.J.F. that the First Amendment’s protection for a free press prevents any law that would ban the publication of truthful but embarrassing facts as long as the information was legally obtained.

In 2015, in Martin v. Hearst Corporation, a Connecticut woman who had faced drug charges asked news organizations to remove articles about her arrest because prosecutors later decided not to pursue the case. While Connecticut’s laws provided for the arrest to be erased from official records, the U.S. Court of Appeals for the Second Circuit said “historically accurate news accounts” were not required to be removed.

In general, U.S. news organizations may decide on their own to implement right to be forgotten policies, but laws to require them to do so would face a high bar due to press freedom.

Where is there a right to be forgotten?

The European Union’s version of the right to be forgotten concept sparked global attention through its General Data Protection Regulation.

The EU’s Court of Justice ruled in 2015 there was a legal right to digital privacy in holding that a Spanish lawyer could force Google Spain to block online reports about his old debts that had long been repaid.

Speaking broadly, the court said, people in the EU could demand search engines remove links to personal data deemed “inadequate, irrelevant or no longer relevant” to public interest. In 2019, courts held the ruling affected searches done within the European Union but did not apply elsewhere in the world.

The concept has support outside of Europe. In 2016, a court in Japan supported the right to be forgotten. In late 2023, a Canadian appeals court said that nation’s residents have a right to demand searches using their name be blocked.

How does the EU’s right to be forgotten work?

In the European Union’s 27 nations, any person can send a request directly to a search engine or social media operation. The multi-page Right to Erasure Request Form asks for the writer to confirm their identity, and “please supply us with the reason you wish your data to be erased.”

There are multiple reasons provided in Article 17 of the EU law to justify the request, including:

• Personal data is no longer necessary for the purpose an organization originally collected or processed it.
• The person is withdrawing permission to that original collecting company to keep or use the personal data.
• The information was obtained unlawfully, such as when a company’s records are hacked.

The EU allows about 45 days for a record holder to respond, and that record holder may be able to deny the erasure. Reasons include law enforcement or other governmental activities and safety or public health reasons.

As the concept of the right to be forgotten takes hold, it may morph into simply not collecting personal data in the first place. In Amsterdam, the local government has developed software that can blur the faces of people who appear in videos of public spaces gathered by local officials.

Erasing the past: What’s good (and perhaps not so good) about it

An estimated 50 news outlets in the U.S. have created voluntary programs to erase from public view an embarrassing moment, a long-ago minor crime, a past accusation later dropped or cleared, or a business circumstance such as bankruptcy later reversed.

“Whether we recognized it or not, we played a role in holding back those who tried to move on from their mistakes,” the Bangor (Maine) Daily News posted about its right to be forgotten policy. In addition to blocking its stories and photos, “wherever possible, we will remove the original social media posts promoting the stories. In other words, the average person doing a Google search will not find out you were arrested for marijuana possession at a gravel pit party in 2004,” the paper said.

The Cleveland Plain Dealer adopted its policy in 2018. The Atlanta Journal-Constitution has a program aimed mostly at people whose official records have been legally expunged. The Boston Globe “Fresh Start” policy includes updating past coverage and changing how accessible stories are in search engines. Among items that could be wiped from public view: minor crimes long in the past and stories and photos “that involve potentially embarrassing, non-criminal behavior.”

In creating those programs, some news operations concede that prejudice and bias – in newsrooms and in the criminal justice system – produced thousands of stories over the years unfairly focused on people of color and the poor.

If there are such good reasons for news outlets to consider “fresh start” programs, there are good reasons to be cautious, too.

There are the close calls: what to do with people who took plea deals – declaring their guilt in a court – given that plea offers may well have been tainted with underlying racial bias and social and economic pressures? Can non-judicial organizations properly determine what took place perhaps decades earlier in a plea deal?

Even when the information is embarrassing, if accurate, it provides people with a way to prove positive things, such as charges dropped, “not guilty” court verdicts or when future successes overcome past failure in business or other areas.

Opposition can be based on simple economic terms or even human rights. In fighting adoption of California’s Eraser law, companies warned that the U.S. system of a “free” internet will be threatened if companies could not recoup their operating and investment costs by collecting and selling readily available consumer data.

Critics of the right to be forgotten also worry that governments might use such laws to hide or erase records of failed policies or of human rights abuses — such as in Chile 50 years ago where tens of thousands of people were “disappeared” by the ruling regime.

Solving “how to forget” issues by “not remembering”

An ultimate solution is to avoid “forgetting” by not remembering, as in the City of Amsterdam’s decision to blur faces captured by the city’s closed-circuit TV network.

The web generally developed in Europe with a requirement that users from the start would have to “opt-in” by giving specific permission for personal data to be gathered, stored and commercialized. In the U.S., a consumer-driven web industry was based on collecting information about users’ buying preferences, personal data and such.

As resistance to such mass collection began, the U.S. moved to what today is called “opt-out.” Consumers can say they do not want their personal information to be collected or used commercially but must take specific action. Otherwise, as The New York Times reported in 2021, “The data collected by the vast majority of products people use every day isn’t regulated. … In most states, companies can use, share, or sell data they collect about you without notifying you that they’re doing so.” And, it said, “If a company shares your data, including sensitive information such as your health or location, with third parties (like data brokers), those third parties can further sell it or share it without notifying you.”

There are some limits. Medical information and communications between doctors and patients are private, as are credit reports and student education records.

In April 2024, U.S. House and Senate members introduced the American Privacy Rights Act. It would limit the types of information companies can collect, store and use. While it stops short of establishing a full right to be forgotten, the proposal would empower users to opt out of targeted advertising, and to view, correct, delete and download their personal data held by a company. It also would require that users could opt out of allowing such companies to resell their user data to other companies.

Similar proposals, though, have failed over many years, in some cases because of questions over whether states should be empowered to potentially approve even tougher rules, and whether companies that break the rules should face state criminal penalties or user lawsuits.

Perhaps the most effective tool today in the U.S. to gain a measure of the right to be forgotten is not to post too much personal information in the first place. In his 2020 article, “The dangers of sharing personal information on social media,” Joseph Turow, a professor at the Annenberg School for Communication at the University of Pennsylvania, said, “While it may seem like the information is being shared with only your friends and family, it can also be shared with hackers and scammers who troll the social media sites. Once your data is in the wild, it stays in the wild.”

Gene Policinski is a senior fellow for the First Amendment at Freedom Forum. He can be reached at [email protected].