Your rights · UK & US
The right to be forgotten
You can legally require companies to delete your personal data. In the UK it's the right to erasure — Article 17 of the GDPR. In the US it's the CCPA right to delete and its state-law siblings. Here's how each works, a letter you can send today, and the honest part: why deletion often doesn't stay deleted.
United Kingdom — GDPR Article 17
You can demand erasure when the data is no longer necessary for its original purpose, when you withdraw consent, when it was processed unlawfully — or, most usefully against brokers and marketers, when you object to processing. For direct marketing the objection is absolute: they must stop, no balancing test.
The organisation has one calendar month, must pass the erasure on to anyone it disclosed your data to (Article 19), and can only refuse by naming a specific exemption — legal obligations, legal claims, journalism and a few others. “We need it for marketing” is not one of them.
United States — CCPA deletion & state laws
California residents can require businesses to delete personal information collected from them, with a 45-day response window. Virginia, Colorado, Connecticut, Texas and other state laws carry similar deletion rights. Exceptions exist for transactions, security and legal compliance — but as in the UK, data brokers can rarely claim them.
For data brokers specifically, California's Delete Act goes one step further: a single request through the state's DROP platform reaches every registered broker at once. How the Delete Act works.
The erasure letter
Fill in the brackets and email it to the company's privacy or DPO contact. It bundles the erasure right with the absolute marketing objection, and asks them to propagate the deletion downstream — the part most template letters miss.
Subject: Erasure request — [Your full name] Dear Data Protection Officer, I am exercising my right to erasure under Article 17 of the UK GDPR, and my right to object to processing for direct marketing purposes under Article 21(2). Please erase all personal data you hold about me, including but not limited to my name, contact details, address history, and any profile or derived data. Where you have disclosed my data to other organisations, Article 19 requires you to inform them of this erasure — please confirm you have done so. Information to help you locate my records: - Full name: [Your full name] - Email address(es): [Email addresses the company may hold] - Postal address: [Your address, if relevant] Please confirm completion in writing within one calendar month. If you believe an exemption applies to any of my data, identify the exemption and the data it covers. Yours faithfully, [Your full name] [Date]
Google and search results
The phrase “right to be forgotten” originally comes from a 2014 European court ruling about search engines. In the UK and EU you can ask Google to de-list results about you, weighed against public interest. But de-listing only hides the result — the page underneath stays live and keeps being sold. The full picture is in our Google removal guide.
Erasure is a right. Enforcement is a grind.
Brokers re-list deleted profiles within months, and every one needs its own letter, chase and check. BLACKEYES exercises your erasure rights across hundreds of brokers and keeps watching afterwards. See where your data is first — free.
Run my free exposure checkFAQ
Is the right to be forgotten absolute?
No. An organisation can retain data it genuinely needs for legal obligations, ongoing contracts, legal claims, or certain public-interest purposes — but it must say which exemption it relies on. For data brokers and marketing lists the exemptions rarely apply: the objection to direct marketing under Article 21(2) is absolute.
Does the right to be forgotten exist in the US?
Not as a single national right. California’s CCPA/CPRA provides a right to delete, and most other state privacy laws include one. The California Delete Act goes further for data brokers specifically — one request through the state’s DROP platform reaches every registered broker.
How long does erasure take?
Legally: one calendar month in the UK, 45 days under the CCPA. In practice brokers vary wildly — some comply in days, others need chasing, and republication months later is common, which is why one-off erasure often isn’t the end of it.
Can I make Google forget me?
You can ask Google to de-list search results about you in the UK/EU under the original “right to be forgotten” ruling, weighed against public interest. De-listing hides the result; the source page survives. Our Google removal guide covers both halves.
What if a company refuses or just ignores me?
Put your complaint to them in writing once, keep the dated copies, then escalate — to the ICO in the UK, or your state attorney general (and the CPPA in California) in the US. Regulators act on exactly this paper trail.