Clients hear "right to be forgotten" and imagine a single button that permanently erases them from the internet everywhere. That version does not exist anywhere in the world. What actually exists is a narrow, jurisdiction-specific legal right, built on a balancing test rather than an automatic entitlement, that in its strongest form de-lists a search result in one region without touching the underlying page at all.
What GDPR Article 17 Actually Grants
The right to be forgotten is, legally, the right to erasure under Article 17 of the EU's General Data Protection Regulation. It became a search-delisting right through the 2014 Google Spain ruling, which held that a search engine has to consider requests to remove links to pages containing a person's name under certain conditions. Article 17 itself is broader than search; it covers the erasure of personal data held by any data controller, not just search results, including review platforms.
A 2023 decision by the Danish Data Protection Agency against Trustpilot A/S shows exactly how that plays out. A business owner asked Trustpilot to remove two reviews he considered false and defamatory, including one that called his business "run by a fraudster," a claim that was also surfacing in Google search results. Trustpilot did not properly respond to the erasure request. The complainant escalated the matter to the Irish Data Protection Commission, and because Trustpilot is headquartered in Denmark, the case was transferred to the Danish DPA as the lead supervisory authority under the GDPR's one-stop-shop mechanism. The Danish DPA found Trustpilot's handling of the request violated Article 12(3) and Article 17, and issued a formal reprimand.
The reprimand was for how the request was handled, not a ruling that the reviews themselves had to come down; that distinction matters for setting accurate expectations. But the case directly confirms the broader point: a review platform is a data controller like any other under the GDPR, and an erasure request sent to Trustpilot, Yelp, or a comparable platform is a legitimate Article 17 request, not something that only applies to Google. No comparably documented enforcement action exists yet against Yelp specifically, but the same legal exposure applies to any platform processing EU or UK residents' personal data. For the standard, non-GDPR removal paths available on these same platforms, ToS violations, fake review flags, and the mechanics of what actually gets a review down, see Review Removal: What Actually Works, What Does Not, and What Gets You Banned.
The right is not automatic. Article 17 lists six grounds a person can invoke: data no longer necessary for its original purpose, withdrawn consent, unlawful processing among them, and five exceptions that let an organization refuse, freedom of expression and information chief among them. Google and every other controller runs this as a genuine balancing test: the requester's privacy interest against the public's interest in the information remaining findable. A public figure's connection to a matter of ongoing public concern routinely loses that balance regardless of how much the requester wants it to succeed.
THE VOLUME, BY THE NUMBERS
More than 1.7 million right-to-be-forgotten requests were submitted to Google and Bing across 34 European countries between 2015 and 2024, with roughly 177,000 in 2024 alone. France consistently generates the highest single-country volume. Google approves roughly half of the individual URLs submitted for delisting, and decision speed has improved dramatically, averaging 85 days in the program's first year and around 6 days by 2019.
Google's own published breakdown of what people actually request is instructive: professional information is the single most targeted category at 24% of requests, ahead of general personal information at 8%, criminal history at 9%, professional wrongdoing at 8%, and criticism of political or government activity at 4%. The popular image of this right as mainly a tool for burying old crimes is not what the data shows. Most requests are far more mundane, and most are specifically about professional reputation.
The Balancing Test in Practice
The UK's NT1 & NT2 v. Google LLC, decided by the High Court in 2018, is the clearest public illustration of how the balancing test actually plays out, precisely because the court reached opposite conclusions for two similar requesters in the same ruling. Both plaintiffs, referred to by the court itself only as NT1 and NT2 to protect the underlying issue during litigation, were businessmen with old criminal convictions seeking delisting of news coverage.
NT1's request was denied. The court found he had not accepted his guilt, had misled the public and the court itself during the case, showed no remorse, and remained active in business in a way that made the continued availability of his history relevant to people who might deal with him. NT2's request succeeded. The court found his conviction was genuinely historic, that he had accepted responsibility, showed real remorse, and had moved into an entirely different line of work where the old coverage no longer served a meaningful public interest.
Same legal test, same general fact pattern, opposite outcomes, decided entirely on the specifics of honesty, remorse, and current relevance. This is the balancing test in practice: it does not ask whether old information is embarrassing; it asks whether the public's interest in it has actually expired.
The Scope Problem: EU Delisting Is Not Global Erasure
Even a successful request accomplishes less than most clients assume. The Court of Justice of the European Union settled this directly in Google v. CNIL in 2019: delisting applies to European versions of the search engine, not globally. A result removed from google.fr or google.de can still appear on google.com, which matters enormously for an executive whose business, board, or reputation exposure is not confined to Europe.
And delisting is the ceiling, not a floor toward something bigger. A successful Article 17 request removes a link from name-based search results in the relevant region. It does not delete the underlying page, does not touch the original publisher, and does not prevent the same page from surfacing through a different search query, a direct link, or a search engine that never received the request.
The CCPA Comparison: Similar Name, Narrower Right
California's right to delete, under the CCPA as amended by the CPRA and codified at California Civil Code 1798.105, is often described as America's right to be forgotten. The comparison is useful only up to a point. CCPA's right applies exclusively to businesses meeting specific thresholds, gross annual revenue over $25 million, or buying, selling, or sharing the personal information of 100,000 or more California residents, and it carries its own extensive list of exemptions, research use, security purposes, internal recordkeeping, and, unlike GDPR, no explicit exception preserving data needed for a party's own legal claims.
There is no general federal right to be forgotten in the United States, a direct consequence of First Amendment protection for published information. A US-based executive has no GDPR claim against a US publisher regardless of how the request gets framed, and CCPA's narrower business-threshold right is not a substitute for it. California residents do have one newer tool worth knowing: DROP, the state's Delete Request and Opt-out Platform, which, as of August 2026, lets a resident submit a single deletion request to every registered data broker rather than filing separately with each. It reaches data brokers specifically, not publishers or search engines, and does not extend the underlying right beyond what CCPA already covers.
Filing and Enforcement
Google runs a dedicated EU and UK removal form separate from its US-facing tools: exact URLs, the specific name query involved, proof of identity, and a stated reason for each link, with a response typically arriving within about a month. A refusal must cite a specific Article 17(3) exception rather than a generic denial, and it must explain how to escalate.
WHAT NON-COMPLIANCE ACTUALLY COSTS
An organization that unjustifiably refuses a valid erasure request, or fails to respond at all, faces administrative fines up to 20 million euros or 4% of global annual turnover, whichever is higher. Escalation runs through the requester's national data protection authority, the ICO in the UK, the CNIL in France, the DPC in Ireland, or through a direct judicial claim under Article 79 GDPR.
PRACTITIONER CHECKLIST
Is the client actually connected to the EU or UK, or is this request being pursued somewhere it has no legal basis? Has the balancing test been assessed honestly, including whether public interest in the content is likely to outweigh the privacy claim? Does the client understand a successful request delists in-region only, and does not reach google.com or delete the source? Is CCPA being correctly scoped to its actual business thresholds and exemptions, rather than treated as GDPR's US equivalent? For a California data-broker specific problem, has DROP been considered as an additional, separate tool?
The Bottom Line
The right to be forgotten is real, legally grounded, and considerably narrower than its name suggests. It is a regional search-delisting right gated by a genuine balancing test, not a global erasure tool, and its American cousin under CCPA is a different, narrower right entirely, not a domestic equivalent. Practitioners who scope this correctly for a client, jurisdiction by jurisdiction, avoid promising a global result that the law was never built to deliver, covered in more detail alongside Google's other removal mechanisms in Google's URL Removal Tool.