Is It Legal to Remove Your Information From the Internet? GDPR and CCPA Explained

Yes. Under GDPR Article 17, anyone in the EU or UK can demand a company erase their personal data, and under the CCPA and CPRA, California residents can demand a business delete theirs. A growing number of other US states now give a similar right, and most data brokers offer their own opt-out on top of that. None of these rights are absolute, and each comes with real exceptions worth understanding before you send a request.

The short answer

Two major legal frameworks give individuals an enforceable right to have their personal data deleted: the EU's General Data Protection Regulation, specifically Article 17, and California's privacy law, the CCPA as expanded by the CPRA. Both apply well beyond their home regions in practice, because companies that serve EU or California residents at all generally have to honor the applicable request regardless of where the company itself is based. Beyond those two, most individual data brokers also publish their own opt-out process voluntarily or because a specific state law requires it, which is a separate, narrower right that exists even if neither GDPR nor CCPA applies to you.

GDPR Article 17: the right to erasure

GDPR's right to erasure, sometimes called the "right to be forgotten," covers anyone in the EU, the EEA, or the UK, and it reaches any company processing that person's data if the company is targeting or monitoring people in that market, regardless of where the company itself is headquartered.

You can request erasure on any of these grounds:

• The data is no longer necessary for the purpose it was originally collected for
• You withdraw consent and there is no other legal basis for the processing
• You object to the processing and the company has no overriding legitimate ground to continue
• The data was processed unlawfully in the first place
• Erasure is required to comply with a legal obligation
• The data concerns a child and was collected in connection with an online service offered to them

There are also real exceptions, and they matter: a company can refuse erasure to the extent processing is necessary for freedom of expression and information (this is the journalism carve-out), to comply with a legal obligation that requires keeping the data, for public-interest archiving or scientific and historical research, or to establish, exercise, or defend legal claims.

Response time is set by Article 12(3): one month from the request, extendable by two further months for complex or numerous requests, and the company has to tell you within the first month if it is extending, and why.

CCPA and CPRA: California's delete right

The California Consumer Privacy Act, as amended and expanded by the California Privacy Rights Act, gives California residents the right to request that a business delete personal information it has collected about them.

It only applies to for-profit businesses that meet at least one of these thresholds: annual gross revenue over 25 million dollars, buying, selling, or sharing the personal information of 100,000 or more consumers or households a year, or deriving at least half of annual revenue from selling or sharing personal information. A small local business with no data-selling revenue may simply be outside the law's scope, which is worth knowing before you assume every website has to comply.

To exercise the right, you submit a "verifiable consumer request." The business generally has to confirm receipt within 10 business days and substantively respond within 45 calendar days, with one possible 45-day extension when reasonably necessary. Exceptions exist here too: completing the transaction you asked for, security and fraud prevention, complying with a legal obligation, internal uses reasonably aligned with what you would expect, and free speech.

The other states catching up

California was first, but it is no longer alone. Virginia's Consumer Data Protection Act, Colorado's Privacy Act, Connecticut's Data Privacy Act, and Utah's Consumer Privacy Act all created their own delete rights modeled loosely on CCPA, and more than a dozen other states have since passed comprehensive privacy laws of their own, most including a similar right to request deletion. Coverage and thresholds differ state by state, so the exact answer to "does this law apply to me" still depends on where you live and who is holding your data.

California's Delete Act: one request instead of hundreds

Separately from CCPA, California passed a data-broker-specific law, Senate Bill 362, known as the Delete Act. It requires data brokers that meet the state's definition to register publicly, and it requires the California Privacy Protection Agency to build a single, centralized deletion mechanism, so that a resident can eventually submit one request that reaches every registered broker at once instead of opting out of each one individually. That is a meaningfully different model from the site-by-site opt-out process most people still have to use today, and it is worth watching if you live in California, since it is designed to replace exactly the kind of checklist we walk through in how to remove your information from the internet.

What none of these laws will force anyone to remove

Every one of these frameworks carries the same basic carve-out, and it is worth stating plainly rather than glossing over:

• Genuine news reporting and journalism, which both GDPR and CCPA explicitly protect
• Court records, dockets, and other official government and public records
• Content that serves a legitimate public interest, archival, or research purpose
• Someone else's own speech about you. A data-erasure law compels a business holding data in a database, not a private individual's post or opinion, which is a separate area of law entirely (closer to defamation or harassment law than privacy law)

Anyone promising to remove a news story, a court filing, or another person's social media post using a data-deletion request is either mistaken about how these laws work or not being straight with you. That is exactly the kind of honest scope this whole category should lead with.

GDPR versus CCPA and CPRA, side by side

Putting it to use

Knowing the law does not remove anything by itself, but it changes the request you send. A one-line "please take this down" is easy to ignore. A request that names GDPR Article 17 or CCPA section 1798.105, states the ground you are relying on, and asks for a response within the statutory window is much harder for a company to quietly sit on. For the practical, step-by-step side of exercising these rights, see our guides on removing personal information from Google search results and removing your information from the internet.