How to use GDPR Article 17 to remove personal data from Google, YouTube, and other platforms. When it applies, how to submit a request, and what to do if refused.
GDPR Article 17 — the “right to erasure,” commonly called the “right to be forgotten” — is one of the most powerful privacy rights in the world. Any EU, EEA, UK, or Swiss resident can demand that a company delete their personal data, and the company is legally required to respond within 30 calendar days. Get the request right and platforms as large as Google, YouTube, Meta, and TikTok will remove content without you ever needing to step into a courtroom.
Get it wrong — wrong legal ground, wrong data controller, wrong jurisdictional claim — and it gets rejected on a technicality. This guide explains exactly when Article 17 applies, the six legal grounds for erasure, how to submit a request that survives review, and what to do when a platform refuses. (See also our DMCA takedown guide for content where you own the copyright instead.)
What Article 17 actually says
Article 17 of the General Data Protection Regulation gives data subjects the right to obtain from a data controller the erasure of personal data concerning them “without undue delay.” The controller must comply when at least one of six grounds applies — and the burden is on the controller to justify a refusal, not on you to justify the request.
“Personal data” is defined broadly: any information relating to an identified or identifiable natural person. A name, a photo, an IP address, a video showing your face, a forum post containing your home town and employer — all of it qualifies. “Controller” is the entity that decides how the data is processed: Google for Search results, Meta for Facebook and Instagram posts, the website operator for forum threads, and so on.
The six legal grounds for erasure
You must cite at least one of these in your request. Citing the right ground is the single biggest predictor of success.
- No longer necessary. The data is no longer needed for the purpose it was collected. (Old account, expired contract, finished project.)
- Withdrawn consent. Processing was based on consent and you have withdrawn it. Common for newsletter signups and old social media accounts.
- Objection under Article 21. You object to processing based on “legitimate interest” or direct marketing. This is the workhorse ground for search-engine delisting.
- Unlawful processing. The data was processed in violation of the GDPR — e.g., scraped without a lawful basis, kept beyond the retention period, or shared with third parties without consent.
- Legal obligation to erase. EU or member-state law independently requires deletion.
- Child’s data. The data was collected when the data subject was a child, in connection with an information-society service.
When the platform can lawfully refuse
Article 17(3) lists the exceptions. The most commonly cited ones in refusals are: freedom of expression and information, compliance with a legal obligation, public-interest archiving, and the establishment, exercise, or defence of legal claims. The “freedom of expression” exception is the one that matters most in practice — courts have to balance it against the data subject’s privacy rights, and the balance shifts based on whether you’re a private individual or a public figure, whether the information is in the public interest, and how old it is.
The landmark Google Spain SL v. AEPD and Mario Costeja González ruling (CJEU, 2014) established that for ordinary private individuals, the right to privacy generally overrides the public interest in indexing old information. For public figures and matters of ongoing public interest, the calculus tips the other way.
How to submit a request that doesn’t get rejected
The standard form most platforms expect contains the following elements. Missing any one of them is a common reason for outright rejection.
- Identity verification. Government-issued ID matching the name in the data you’re asking to remove. Most platforms accept a redacted scan with everything except your name, photo, and country.
- Jurisdictional basis. A clear statement of your residency in the EU, EEA, UK, or Switzerland. Without this, the platform can argue GDPR doesn’t apply to you.
- Exact URLs and identifiers. Every specific URL containing your personal data. “All search results about me” is too vague. “This URL, this URL, this URL” is enforceable.
- The data being objected to. Quote the exact text, describe the exact image, or specify the exact field that constitutes your personal data on each URL.
- The legal ground. One of the six grounds above, named explicitly: “I invoke Article 17(1)(c) — objection under Article 21 to processing based on legitimate interest.”
- Why the exceptions don’t apply. Pre-empt the refusal. If you’re a private individual, say so. If the information is more than a few years old and no longer accurate, say so. If it’s not in the public interest, say so.
Timeline and what happens after you submit
The platform has 30 calendar days to respond, extendable by 60 more days for complex cases (they must notify you of the extension within the first 30 days). Three outcomes are possible:
- Granted. Data is erased or, for search engines, delisted from results returned for queries containing your name. The platform notifies third parties to whom the data was disclosed.
- Partially granted. Some URLs are removed, others kept. You can appeal the kept URLs individually.
- Refused. The platform must give a written reason. You have two escalation routes: complaint to your national Data Protection Authority (free) or a court action (slow, expensive, but enforceable).
What to do if refused
The fastest escalation is to your national Data Protection Authority. In Italy it’s the Garante per la Protezione dei Dati Personali; in France the CNIL; in Germany the BfDI; in Ireland (which regulates Google, Meta, TikTok, X, LinkedIn for the entire EU) the Data Protection Commission. The DPA can compel the platform to comply, and decisions are binding and free.
For Google specifically, refused delisting requests can be re-submitted with additional context, and the second-stage human reviewer often reverses the first decision when the legal grounds are spelled out more clearly. For platforms outside the EU (US-based sites that argue GDPR doesn’t reach them), enforcement requires either a regulator-to-regulator action or a direct court order — this is where professional help becomes worth its cost.
Common reasons Article 17 requests fail
- No legal ground cited, or the wrong one (citing Article 17 when Article 21 is the actual mechanism).
- No proof of EU residency.
- Vague URL lists (“everything about me on your platform”).
- Requesting erasure of information that’s genuinely in the public interest about a public figure.
- Requesting erasure of court records, journalism, or other content where Article 17(3) clearly applies.
- Submitting through the wrong channel — Google has a dedicated delisting form that bypasses the generic legal removal queue.
Article 17 vs. DMCA vs. platform abuse reports
These three legal mechanisms are not interchangeable. DMCA is for copyright — you own the work and someone published it without permission. Platform abuse reports invoke the platform’s own community guidelines and are not legally binding. Article 17 is about personal data and is binding on any controller processing data of an EU resident.
For most reputation issues — old news articles, leaked personal information, defamatory forum threads, scraper sites — Article 17 is the strongest single tool. Combine it with a parallel DMCA request when you also own copyright in any of the content (your own photos, your own writing republished without permission), and the success rate climbs dramatically.
FAQ
Who can use the GDPR right to be forgotten?
Any EU, EEA, UK, or Swiss resident can demand that a company delete their personal data, and the company is legally required to respond within 30 calendar days. The controller must comply when at least one of the six legal grounds for erasure applies.
When can a platform lawfully refuse an Article 17 request?
Article 17(3) lists the exceptions; the most commonly cited are freedom of expression and information, compliance with a legal obligation, public-interest archiving, and legal claims. The balance shifts with whether you're a private individual or a public figure, whether the information is in the public interest, and how old it is.
What must an Article 17 request include?
Identity verification, a clear statement of your EU, EEA, UK, or Swiss residency, every exact URL, the specific personal data on each URL, the legal ground named explicitly, and an explanation of why the exceptions don't apply.
How long does a platform have to respond?
30 calendar days, extendable by 60 more days for complex cases. The platform must notify you of the extension within the first 30 days.
What can I do if my request is refused?
Complain to your national Data Protection Authority, which is free and can compel the platform to comply, or bring a court action. For Google, refused delisting requests can be re-submitted with additional context, and the second-stage reviewer often reverses the first decision.