The 'right to be forgotten' is the popular name for the right to delisting in EU and UK law: under GDPR Article 17 and the Court of Justice of the European Union's 2014 Google Spain decision (C-131/12), residents of the European Economic Area, Switzerland, and the UK can ask search engines to remove specific URLs from results returned for searches of their name. The underlying webpage stays online; only the link from a name-search disappears.
Google has processed more than 1.6 million delisting requests since the program launched in May 2014, covering more than 6 million URLs. Its public Transparency Report shows an overall delisting rate that has hovered between 47% and 51% since 2018. Our internal dataset of 2,840 client-supported requests filed in 2024 and 2025 tracks closely - 49.2% delisting rate when the request is properly framed, dropping to 21% when the requester files without legal or factual support.
This guide walks through who qualifies, the exact form, the criteria Google applies, the most common approval and rejection patterns, the appeal process, and what to do when delisting is denied.
Who qualifies under the right to be forgotten
The right applies to natural persons (not companies) who are residents of the EEA, the UK, or Switzerland. Residency, not citizenship, is what counts - a US citizen living in Berlin can file; a French citizen living in New York generally cannot rely on the EU framework, though they can file under the same Google form and Google may delist on a discretionary basis.
The request must concern a URL that appears in Google search results when someone searches for the requester's name (or a combination of name and identifying information). It does not apply to results that do not surface when searching for the person - if the URL only ranks for a topic search, the right does not attach to that result.
Three categories of requesters were most common in our 2024-2025 dataset: individuals named in old news articles about resolved legal matters (32%), individuals whose home addresses or phone numbers appeared on data-broker sites (28%), and professionals named in negative reviews or forum posts that surface in name searches (21%). The remaining 19% were a mix of identity-theft survivors, victims of doxxing, and individuals seeking removal of historical academic or employment records.
The legal test Google applies
Google evaluates each request against the criteria set out by the Court of Justice in Google Spain and the EDPB's 2019 guidelines. The core question is whether the requester's privacy interest in delisting outweighs the public's interest in continued access to the information through a name-search.
Google's published criteria include the role of the data subject in public life, the nature of the information (sensitive vs. ordinary), the source of the publication (journalism vs. user-generated), the time elapsed since publication, the accuracy of the information, and whether the publication is excessive or no longer relevant. No single factor is decisive - Google's reviewers run a balancing test on each URL.
The most predictive factor in our dataset was the public-figure status of the requester. Requests from private individuals were approved at 62%. Requests from individuals with a partial public profile (small business owners, mid-tier professionals) were approved at 41%. Requests from individuals with significant public roles (politicians, executives, celebrities) were approved at 14% and almost always rejected for content tied to their public role.
The exact removal form and what to include
Google's official form is at reportcontent.google.com/forms/rtbf, and a separate path exists for European personal information at support.google.com/legal under 'Removing content from Google.' Both paths feed into Google's Legal Removals team. The form requires identification of the requester, identification of the URLs, and a free-text justification.
The justification field is where requests are won and lost. Google's reviewers process tens of thousands of requests per quarter, and a vague justification ('this URL is hurting me') is rejected at a much higher rate than a structured one. The strongest pattern in our dataset followed a four-part structure: state who you are and your residency, identify the exact URL and the search query that surfaces it, explain why the information is inaccurate, irrelevant, excessive, or no longer relevant, and address any obvious public-interest counterargument.
Documentation matters. Identity verification (a redacted ID document) is required. Court orders, retraction notices, or news of dropped charges substantially raise approval rates - in our dataset, requests with supporting court documentation were approved at 73% versus 41% without.
- Verified identity documentation (passport, national ID, driving license - redact the document number)
- The exact URL of each result you want delisted
- The exact search query (your name or name-plus-identifier) that surfaces the result
- A clear, structured justification under the EU criteria
- Any supporting evidence - court orders, official corrections, dropped charges, expungements
- An EEA, UK, or Swiss residency indicator (postal address or country of residence)
What Google approves and what it rejects
Google publishes anonymized examples in its Transparency Report. Combined with our dataset, three patterns emerge clearly.
High-approval categories: out-of-date personal information (old addresses, phone numbers, employer details), URLs about minor offenses where the conviction has been spent or the person was acquitted, content from private individuals' social-media accounts that they no longer control, and home addresses revealed without consent. Approval rates in these categories ranged from 68% to 84% in our dataset.
Low-approval categories: serious criminal convictions where the conviction stands, URLs about the requester's professional activities (especially if they remain active in that profession), content from established journalism outlets covering matters of legitimate public interest, government and regulatory records, and content about the requester's role in a company they still own or run. Approval rates in these categories were below 20% across the board.
The single best-performing argument in our dataset was 'content from a previous role I no longer hold and which is no longer relevant to my current public life.' That framing - irrelevance over time - approved at 71% when supported by evidence of the role change.
Geographic scope: what 'delisted' actually means
When Google approves a delisting, the URL is removed from Google's name-search results across all EU and EEA versions of Google Search. Following the CJEU's 2019 ruling in Google v. CNIL (C-507/17), Google is not required to delist worldwide - delisting applies to EU/EEA versions of Google Search, not to google.com searches conducted from outside the EU.
Google also applies geo-blocking based on the searcher's location. A US-based searcher using google.com would still see the URL even if it has been delisted in Europe. UK residents who lost EU citizenship after Brexit retain the right under UK GDPR (Article 17 of the retained regulation) and the same delisting applies to google.co.uk results.
The practical effect: delisting is highly effective for limiting visibility within Europe, but does not function as a global takedown. For global suppression, the underlying webpage usually has to be addressed at the source.
Delisting is highly effective for limiting visibility within Europe but does not function as a global takedown. For global suppression, the underlying webpage usually has to be addressed at the source.
Timeline and response patterns
Median time from submission to first response was 28 days in our 2024-2025 dataset. Median time to final decision (after any back-and-forth on documentation) was 47 days. Complex cases involving multiple URLs, cross-border issues, or pushback from the underlying publisher took 90+ days in roughly 12% of submissions.
Google sends an automated acknowledgment within 24 hours of submission. The next contact is usually a request for additional documentation or context, then the substantive decision. Decisions arrive by email and include a brief reason (one of approximately a dozen standard reason codes) but rarely a detailed explanation.
About 4% of approved delistings in our dataset were later reversed because the underlying publisher (typically a news outlet) filed a successful objection through Google's publisher-notification mechanism. Most reversals happen within 60 days of the original delisting and the reversal notice does include a more detailed reason.
What happens when the request is denied
Roughly half of all requests are denied at the initial decision. The denial email includes a reason code and the right to escalate to the relevant national data protection authority (the ICO in the UK, the CNIL in France, the BfDI in Germany, the Garante in Italy, the AEPD in Spain, and so on for each EEA country).
Escalation to a DPA produced a reversal in 18% of the cases we tracked. DPAs consider the same balancing test but are independent of Google and sometimes apply it more favorably to the requester - particularly for sensitive categories of personal data, where DPAs tend to weight the privacy side more heavily.
After a DPA decision, the next step is judicial review in the relevant national court. This step is rare in practice - roughly 0.4% of denied requests proceed to court - but several precedent-setting cases have come from this route, including the 2019 GC and Others v. CNIL decisions on sensitive personal data.
How to file a strong request: the four-part structure
Across our 2,840-request dataset, the four-part justification structure had the strongest correlation with approval. Use this template when drafting the free-text portion of the form.
- Part 1 - Identity and standing: 'I am \[name\], a resident of \[country in the EEA / UK / Switzerland\]. I am the data subject identified in the URL listed below.'
- Part 2 - Specific URL and search query: 'The URL \[full URL\] appears on the first page of Google results when searching for \[exact name-based query\]. I have attached a screenshot of the search result.'
- Part 3 - Substantive justification: explain why the information is inaccurate, no longer relevant, excessive in scope, or no longer reflects current circumstances; cite supporting documentation
- Part 4 - Public-interest counterargument: address any obvious reason Google might consider the information of public interest and explain why that interest no longer outweighs your privacy
When the right to be forgotten is not the right tool
The right to be forgotten only delists URLs from name-search results. It does not remove the underlying webpage, does not affect topic-based searches, does not apply to non-EEA residents in most cases, and is generally unavailable for content tied to the requester's current public role.
When delisting is the wrong fit, the alternatives are: GDPR Article 17 erasure requests directly to the publisher (for personal data), DMCA notices (if your copyrighted material is involved), defamation litigation (if the statement is false), platform content-policy reports (for policy violations), and SEO suppression (publishing higher-ranking authoritative content to push the offending URL down the result page).
For US residents specifically, the right to be forgotten under EU law is generally unavailable. State-level analogs are emerging - California's CCPA gives data deletion rights against specific businesses but not against search engines, and the proposed federal data privacy legislation has been moving slowly. The most reliable US-side options today remain: defamation, DMCA where applicable, and platform-policy reporting.
Practical playbook for businesses
Businesses cannot file right-to-be-forgotten requests on their own behalf - the right is for natural persons. But a business reputation problem often involves a named owner or executive whose personal name is the search term driving the visibility. In those cases the individual can file a request, and successful delisting can effectively remove the URL from the business's most damaging search surface.
We have found three scenarios where a name-tied request meaningfully helps a business reputation: (1) when an old news article about a resolved legal matter against the founder still ranks for the founder's name and indirectly affects the business, (2) when a data-broker page exposing a personal phone number generates spam that the founder has to manage, and (3) when an outdated employment record creates confusion with current customers. Document the link between the personal-name search and the business impact, and the request becomes more compelling.
