The Right to Be Forgotten — The Internet Never Forgets

Everyone has a past they want to erase. Old debt collection articles, photos from immature days, or criminal records for sentences already fully served are examples of this. In the paper era, records like these would have been slowly forgotten somewhere in library archives. The internet is different. With a single action of typing my name into a search box, that past follows as vividly as the very first moment because a hiring manager, a first date, and a business partner all make searching the very first thing they do (DOI: 10.1017/s1867299x00003949).

Two rights collide here. On one side is the right of an individual to be forgotten, and on the other are the right to know and freedom of expression. The right to demand the deletion of one's information left on the internet is called the right to be forgotten. This article follows that collision. First, we look at the right to be forgotten established by Europe. Next, we look at why that right is weak in the United States and why actual deletion is technically difficult. Finally, we examine how incomplete this right still is.

First, let us clarify the scope. The laws this article examines and debates are primarily EU laws. One is the GDPR (General Data Protection Regulation), the EU's personal data protection regulation. The other is the ruling of the Court of Justice of the European Union (CJEU), which interprets EU law. The United States appears as a comparison, and the United Kingdom, India, Indonesia, Brazil, and Australia appear briefly as cases. South Korea's Personal Information Protection Act is not covered as it is not among the grounds cited by this article.

The Internet Never Forgets

The starting point of the problem is simple. Information once released into the public domain is almost impossible to take back. When parents post stories about a child's health or medical battles on social media, that information can follow the child for the rest of their life. Deleting things from the internet is virtually impossible (DOI: 10.2139/ssrn.6226899). Digital infrastructure goes beyond merely storing the past, an essay analyzes. The infrastructure makes "preservation" the default. As a result, the "threshold of disappearance," where events stop functioning, vanishes (DOI: 10.2139/ssrn.6271698).

It is not just an issue for adults. While discussing the right to be forgotten for children, there has been criticism that the views of the minors themselves are left out. There is a study that responds to this criticism. It directly asked 652 adolescents aged 13 to 18 across all regions of Spain (DOI: 10.15581/003.35.4.19-36). Also, this right inherently conflicts with someone's memory. There is a fundamental tension between privacy protection and the "right to know" or right of access to records. That tension extends even to collective memory and records management (DOI: 10.1007/978-3-031-18667-7_5). The hand trying to erase and the hand trying to know are tugging at the same information.

Europe's "Right to be Forgotten" — Google Spain and GDPR Article 17

Europe brought this tension into its sharpest legal form. The turning point is the "Google Spain" ruling of May 13, 2014, delivered by the Court of Justice of the European Union (CJEU). Searching for the name of Spanish lawyer Mario Costeja González brought up a single link, which led to a 1998 newspaper notice about a tax debt. He demanded that the search result be removed (DOI: 10.1017/s1867299x00003949).

The CJEU did not see search engines as mere intermediaries. It viewed them as entities that decide how personal data is handled, namely data controllers, because search results create a structured profile of a person. It also ruled that the mere economic interests of the search engine operator do not justify the intrusion. Even if the information remains on the original newspaper, the corresponding link can be removed from the search result list (DOI: 10.7238/idp.v0i18.2371). This right could extend even to lawfully published information (DOI: 10.1017/s1867299x00003949).

The CJEU established principles and exceptions together. The principle is that the interests of the individual to whom the information belongs (the data subject) take precedence over the public interest in accessing information. The exception is figures who play a role in public life, who must endure their information being made more widely public. In the same case, the opinion of the Advocate General differed from that of the court; an Advocate General is an assistant judge who submits opinions to the court (DOI: 10.7238/idp.v0i18.2371).

Articles differ on whether this ruling created a new right. One paper explains that the CJEU did not intend to create a new right, but merely included search engines within the concept of a "controller," a concept that existed in the 1995 Data Protection Directive, the EU data protection directive before the GDPR. The same paper notes that discussions on a similar right date back to at least 2006, and broadly to the early 20th century, in academia and the courts (DOI: 10.29263/lar02.2019.02, DOI: 10.1007/978-3-031-18667-7_5). On the other hand, some writings state that this right was established by this ruling (DOI: 10.54648/erpl2022014).

This right was subsequently codified into Article 17, the "right to erasure," of the GDPR. Article 17(1) sets out six conditions under which erasure can be requested: the expiration of the purpose of processing, the withdrawal of consent, and the exercise of the right to object to processing, alongside unlawful processing and legal obligations, with the sixth being the withdrawal of consent given by a minor in an online environment. Article 2 stipulates that if a data subject requests erasure, the controller who made the data public can be required to inform others currently processing the same data of that erasure request. Article 3 provides five exceptions: freedom of expression and information, legal obligations or public interest tasks and official authority, and public interest in the field of public health, alongside public interest archiving, scientific/historical research, and statistics, as well as legal claims (DOI: 10.1093/oso/9780198847977.003.0004). Therefore, this right was designed from the beginning as a right with conditions and exceptions (DOI: 10.1093/oso/9780198847977.003.0004, DOI: 10.1093/oso/9780198826491.003.0049).

It is not yet settled whether erasure and anonymization are the same thing under the GDPR. Anonymization refers to making it impossible to recognize whose information it is. Views are divided in academia on whether anonymization can substitute for the obligation of erasure or not. As of a 2022 paper, there was no case law directly judging this. What is clear is that the obligation of erasure is established when personal data exists, and erasure cannot be requested for data that has already been anonymized (DOI: 10.25143/socr.22.2022.1.114-126). There is a reason this distinction matters: if anonymization is recognized as erasure, large-scale controllers can continue to use data they should have deleted for big data and AI analysis.

The content of this right is determined on a case-by-case basis through balancing, which is weighing conflicting interests. One case is NT1 and NT2 v. Google in the High Court of England and Wales, where spent convictions were the issue. The court weighed three criteria—the nature of the crime, the public interest, and the possibility of rehabilitation—to reach different conclusions for the two claimants. A paper commenting on this case reads how the three criteria operated: if a crime did not involve dishonesty or was old and "minor," the court was more likely to find that there was no need to keep the information public. If the claimant was active in public life in a way related to that crime, the public interest in maintaining publication appeared greater, and the presence or absence of remorse for past convictions appeared to be valued highly by the court (DOI: 10.54648/erpl2022014).

The way the same right is applied varies within Europe. Comparing the case law of the European Court of Human Rights (ECtHR) and the CJEU, the two courts influence each other and use similar balancing criteria. However, the CJEU adheres more to rule-based categorical judgment, while the ECtHR adheres to more flexible case-by-case balancing. This comparative study considers neither approach inherently superior, yet suggests that categorical and rule-based methods are particularly well-suited to some of the dilemmas arising from the harmonization of enforcement and freedom of expression. Higher legal certainty can reduce the chilling effect, which is the phenomenon where editors shrink from making decisions themselves due to uncertainty about how to respond to requests for erasure and de-indexing (removal from search lists) (DOI: 10.1163/26663236-bja10155).

So Where Exactly Does It Get Deleted — To Search Bars in Which Countries?

Once a right is declared, the information does not vanish from the face of the Earth. The next dispute was jurisdiction, or how far the laws of which country reach. The CJEU ruled on the Google v. CNIL (French data protection authority) case. The right to be forgotten does not force search engines to delete results from non-European versions (such as google.com) as well (DOI: 10.1093/ijlit/eaaa022). This means global de-referencing is not required in principle.

However, a paper points out that it is premature to read this ruling as the "neutralization of the right to be forgotten." The ruling requires deletion across all EU member state versions (DOI: 10.54648/gplr2020008). Furthermore, it demands action from search engines. It mandates that users within the EU searching by the data subject's name be blocked from accessing those results, or at least strongly discouraged (DOI: 10.1093/ijlit/eaaa022). GDPR also does not block member state authorities from ordering deletion on all versions if they deem it necessary at the end of balancing fundamental rights (DOI: 10.54648/gplr2020008). Still, the fact that "how far it gets deleted" varies from border to border remains.

Why It Is Weak in the United States — The Wall of Free Speech

The picture in the United States is quite different. According to a 2025 paper, the United States lacks a comprehensive federal-level privacy law (DOI: 10.37419/lr.v12.i2.10). There is also no statutory right to erasure equivalent to Article 17 of the GDPR in federal law. What fills that space is not the right to be forgotten itself. It is a workaround that borrows systems with other purposes, such as copyright, defamation, and trademarks (DOI: 10.29263/lar02.2019.02).

There is movement at the state level. Following the California Consumer Privacy Act of 2018, several states have modeled "right to deletion" provisions after the GDPR. However, because detailed regulations and enforcement mechanisms are inadequate, critics evaluate them as closer to an empty promise of consumer control. A paper presenting this evaluation proposes prescriptions to fill the gap. These include broad deletion clauses, identity verification requirements, and a private right of action (the right for victims to sue directly). There are also obligations for data destruction and mapping, third-party deletion duties, and institutional reporting mechanisms (DOI: 10.37419/lr.v12.i2.10).

A comparative law study explains the difference between the two legal cultures this way. This study views the right to be forgotten as a quintessential continental European notion. That notion is "privacy-in-public." This means recognizing privacy even in information that has already been made public. The study analyzes that this directly collides with the Anglo-American tradition, which has structured freedom of speech (the First Amendment) and privacy differently (DOI: 10.1017/s0020589323000258). There are even stronger expressions. A monograph outright defines Europe's right to be forgotten as an "enemy of the First Amendment." It criticizes data deletion in search results for distorting the marketplace of ideas and history (DOI: 10.5771/9781498549615). If the European side views this right as a triumph for privacy, from this monograph's perspective, the same right looks closer to censorship.

There is also a view that looks at this conflict differently. A 2017 pre-peer-review preprint examines and refutes many of the arguments dominating the discussion—that this right threatens freedom of speech and access to information—viewing them as factoids, which are unsubstantiated claims that have hardened into apparent facts through repeated circulation. This preprint suggests that the narrative that extraterritorial application (extending domestic laws beyond national borders) will break the internet should also be read differently. It argues it should be read within the context of a data protectionism trend countering the de facto market dominance of U.S. internet companies. It also notes that global takedowns based on the nationality principle proposed by EU agencies such as the CNIL would alleviate these protectionist concerns (DOI: 10.31235/osf.io/f7cqj_v1).

True Deletion is Hard — Technical Challenges

Even if the law orders you to "delete it," carrying that out to the end is another matter entirely. In a traditional database, deleting a row is as simple as erasing a line. However, in an AI model trained on that data, the situation is far more complex. Because a model absorbs the influence of data during the learning process, deleting a record and erasing its influence are two different things. Therefore, attempts have emerged to create separate tools that excise the influence of specific training data from a model (DOI: 10.22214/ijraset.2025.67269). This is machine unlearning. Machine unlearning is presented as an attempt to bridge a gap. That gap lies between the right-to-be-forgotten demands of the GDPR and the reality that data remains inside AI systems (DOI: 10.36948/ijfmr.2025.v07i05.58292).

The problem is that it is difficult to prove whether that "excision" truly happened. One conference paper applied machine unlearning to a pretrained neural network and then tested it. The method used was a membership inference attack (MIA), which is an attack that tries to find out whether a model has learned specific data. By varying the size of the deletion set, they checked whether the model still retained information about the deleted data. The results reportedly showed that machine unlearning has limitations in being used as a complete deletion method (DOI: 10.32473/flairs.39.1.141797).

Verification is also a problem. One preprint starts from the premise that there is currently no cryptographic verification device to prove that unlearning actually occurred, and proposes a framework to fill this void. The framework rests on three pillars. It uses membership inference attacks as a reference test and leaves an "unlearning certificate" on the blockchain. Then, it verifies parameter changes using Zero-Knowledge Proofs: Proving the Truth Without Revealing the Data. Zero-Knowledge Proofs: Proving the Truth Without Revealing the Data is a method of proving that something is true without revealing its contents. This framework reports successfully identifying all 10 genuine unlearning models in a CIFAR-10 experiment. Fake compliance attempts were reportedly caught 9 out of 10 times (DOI: 10.20944/preprints202603.2325.v1, preprint not peer-reviewed). However, this is still at the proposal stage.

How unlearning affects fairness is also not straightforward. This study, which the authors state is the first of its kind, reported that the results vary depending on the deletion strategy. Two unlearning techniques (SISA and AmnesiacML) and retraining (ORTR) were applied to three fairness datasets. A SISA variant using non-uniform deletion actually had better fairness than retraining or AmnesiacML. Initial training and uniform deletion did not necessarily affect the fairness of all three methods (DOI: 10.1007/s43681-023-00398-y). This is a result showing that the impact on fairness can vary depending on the deletion method.

The essay "Thresholds of Erasure" seen earlier puts it this way. Even after deletion, the "ghosts of metadata and parameters" remain, continuing to influence inference and exposure. The same essay opposes both the illusion of complete preservation and the illusion of complete deletion, proposing instead that we design different lifespans and permissions for each piece of data to create fading, sealing, and opacity (DOI: 10.2139/ssrn.6271698). There is still a wide chasm between the declaration that "it has been deleted" and the fact that "it has truly been deleted."

Declared Yet Undecided — Scope, Enforcement, and Jurisdiction

Today, the right to be forgotten has been declared, but its scope, enforcement, and jurisdiction remain undecided. We examine three aspects.

First, expanding the right itself is a double-edged sword. The Australian Competition and Consumer Commission proposed introducing a right to erasure into the Privacy Act. In response, a comparative study reviewed the trajectory by which European courts have rapidly expanded the right to erasure. It then pointed out the harmful impacts such a right would have on Australian online media archives. This is a warning that more cautious reform is needed to safeguard information access (DOI: 10.1177/1037969x20959839). It is a case showing what obstacles arise when a right created in Europe is transplanted directly into another country.

Second, enforcement is not uniform. One analysis argues that the UK lost its fundamental rights status regarding data protection after Brexit. It notes that regulatory enforcement has also leaned toward a very limited and selective approach. The figures provided by this analysis are as follows. These are figures for overall data protection enforcement, not limited to erasure requests. In 2024, data protection fines imposed by the EU totaled 1,396 cases and about €1.25 billion. For the 2024/25 financial year, the UK Information Commissioner's Office (ICO) figures stand at just 2 cases and about £4 million. However, the same analysis considers the substantive revision of the Data Use and Access Bill in 2025 to be modest in scale. The enforcement obligations of the UK GDPR—the GDPR maintained separately by the UK after Brexit—remain largely intact. Therefore, whether this attempt at restriction will actually be pushed through remains uncertain (DOI: 10.2139/ssrn.6504981).

Third, this right inherently varies by jurisdiction. The right to be forgotten has deep roots in Europe. One analysis suggests that this right shares the same rationale as the right of withdrawal. However, it adds that the nature and purpose of the two rights differ. The right of withdrawal allows an author to recall their work for moral reasons (DOI: 10.2966/scrip.190122.120). Even so, its actual form differs from country to country.

Drawing inspiration from the GDPR, India included the right to be forgotten in its Digital Personal Data Protection Act (DPDP). The issues addressed by this law include privacy, the right to erasure, freedom of expression, and the right to know. One study argues that clear guidelines are needed to strike a balance among these rights (DOI: 10.52783/cana.v32.5114). Indonesia is experiencing legal uncertainty regarding the right to be forgotten in digital banking transactions. This is due to inconsistencies among data protection, electronic information and transactions, and banking laws. One study suggests looking to the GDPR's more flexible erasure procedures and the establishment of an independent supervisory authority (a personal data protection agency similar to the European Data Protection Board (EDPB)) for guidance (DOI: 10.58824/mediasas.v8i4.501). A Brazilian paper describes the right to be forgotten (direito ao esquecimento) as a form of protecting privacy and human dignity. The same paper highlights the problem of this right colliding with freedom of expression and the right to know (DOI: 10.51891/rease.v11i4.18999). According to a 2017 paper, legislative discussions on this right were spreading to Brazil, Japan, South Korea, Russia, and elsewhere (DOI: 10.31235/osf.io/f7cqj_v1).

Conclusion — The Unsettled Scale

The story of the right to be forgotten is tricky because if you lift one side, the other collapses. If individuals fully possess the right to be forgotten, the right to know and history are chipped away. If freedom of speech is defended to the end, someone remains tied for life to a past they want erased. Europe established this right by law with Google Spain and GDPR Article 17. Even that is full of case-by-case balancing and exceptions. The United States hesitates to accept this right in front of the wall of freedom of speech. Furthermore, technology does not yet guarantee "real deletion."

The conclusion remains open. In an era where the internet does not forget, what should be allowed to be forgotten is not yet settled. Even within Europe, the ECtHR uses case-by-case balancing, while the CJEU uses more rule-based judgments. One comparative study suggests that neither side is inherently superior, and that categorical methods are particularly well-suited for certain difficult problems. Most of what this cited article referenced are legal analyses dealing with this evolving domain. The conclusion varies greatly depending on the jurisdiction.

This article is for informational purposes and does not constitute legal advice. The right to be forgotten is a fast-evolving area that varies by jurisdiction, and many of the cited sources are legal academic analyses.

Source Papers

The Internet Never Forgets · The Clash of Rights

• Health Sharenting and Child Privacy (Cannot Be Erased Once Posted) (DOI: 10.2139/ssrn.6226899)
• The Theory of Digital Oblivion (Preservation as Default, Loss of the Threshold of Erasure) (DOI: 10.2139/ssrn.6271698)
• Spanish Adolescents' Perceptions of the Right to Be Forgotten (DOI: 10.15581/003.35.4.19-36)
• The Right to Be Forgotten vs. The Right to Know and Record Access (DOI: 10.1007/978-3-031-18667-7_5)

EU — Google Spain · GDPR Article 17 · Weight of Offense

• Analysis of the Google Spain Ruling (Search Engine = Processor, Result Removal) (DOI: 10.7238/idp.v0i18.2371)
• Google Spain: Delisting Even for Lawfully Public Information (DOI: 10.1017/s1867299x00003949)
• Requirements and Exceptions of Article 17 Right to Erasure (Freedom of Expression, Archiving, etc.) (DOI: 10.1093/oso/9780198847977.003.0004)
• Conditions and Exceptions of the Article 17 Right to Be Forgotten (DOI: 10.1093/oso/9780198826491.003.0049)
• Legal Distinction Between Erasure and Anonymization (DOI: 10.25143/socr.22.2022.1.114-126)
• Criminal Records After Sentence Completion and the Right to Be Forgotten (NT1 and NT2 v. Google) (DOI: 10.54648/erpl2022014)
• Weight of Offense and Categorization in ECtHR vs. ECJ (DOI: 10.1163/26663236-bja10155)

The Barrier of Jurisdiction — Google v. CNIL

• Google v. CNIL: Non-European Versions Cannot Be Forced to Be Removed (DOI: 10.1093/ijlit/eaaa022)
• Google v. CNIL: Global Deletion Unnecessary, Member State Discretion (DOI: 10.54648/gplr2020008)

United States — Clash with Freedom of Expression

• Data Protection Law and Two Western Privacy Cultures (The Privacy Clause of the U.S. First Amendment) (DOI: 10.1017/s0020589323000258)
• The European Right to Be Forgotten = Enemy of the First Amendment (DOI: 10.5771/9781498549615)
• U.S. Alternatives to the Right to Be Forgotten (Copyright, Defamation, Trademark) (DOI: 10.29263/lar02.2019.02)
• The Emptiness of U.S. State "Deletion Rights" (DOI: 10.37419/lr.v12.i2.10)

Technical Dilemma — Machine Unlearning

• Database Deletion vs. ML Models (DOI: 10.22214/ijraset.2025.67269)
• Machine Unlearning Bridges the Gap Between RTBF and Data Residue (DOI: 10.36948/ijfmr.2025.v07i05.58292)
• Limitations of Unlearning: MIA Detects Residual Information (DOI: 10.32473/flairs.39.1.141797)
• Absence of Cryptographic Verification in Unlearning (VeriForgot) (DOI: 10.20944/preprints202603.2325.v1)
• Trade-offs Between Unlearning and Fairness (DOI: 10.1007/s43681-023-00398-y)

The Honest Current Status — Enforcement, Jurisdiction, Expansion

• Expansion of the Right to Erasure and Threats to Archive Access (DOI: 10.1177/1037969x20959839)
• Weakened British Enforcement Post-Brexit (2 ICO Cases vs. 1,396 EU Cases) (DOI: 10.2139/ssrn.6504981)
• The European Spirit and Origins of the Right to Be Forgotten (DOI: 10.2966/scrip.190122.120)
• The Right to Be Forgotten and Weight of Offense in India's DPDP (DOI: 10.52783/cana.v32.5114)
• Indonesia's Inconsistencies and Reference to the GDPR (DOI: 10.58824/mediasas.v8i4.501)
• Brazil's Right to Be Forgotten and Balance (DOI: 10.51891/rease.v11i4.18999)
• Global Spread of Right to Be Forgotten Legislation (Brazil, Japan, South Korea, Russia) (DOI: 10.31235/osf.io/f7cqj_v1)