How to delete your personal data from the internet (what is possible and what is not)

Before starting, it is worth lowering the expectation: there is no button that erases you from the internet. What does exist is a set of concrete actions that, done in the right order, substantially reduce what a stranger can find out about you in a quick search.

And in the United Kingdom, the European Union and the rest of the EEA you have an advantage: data protection law obliges companies to deal with you.

Step 1. Find out what is out there

You cannot delete what you do not know exists.

Search your full name in quotation marks on a couple of different search engines. Repeat with variants: name and city, name and profession, your email address, your phone number. The results for your phone number are often revealing, because it turns up in old adverts and listings you no longer remember.

Note down what you find in two categories:

• What you control: profiles, accounts, your own posts.
• What a third party controls: company listings, records, news articles, data brokers.

The first category can be dealt with in an afternoon. The second takes longer and does not always end well.

Step 2. Close the accounts you no longer use

This is the action with the best ratio of effort to result, and almost nobody does it.

Every old account is two problems: public information about you, and a breach waiting to happen with the password you used back then inside.

To find them:

• Search your email for “welcome”, “confirm your registration” or “activate your account”. Services you had completely forgotten will surface.
• Look at the list of saved passwords in your manager or browser.
• Review which apps have access to your Google, Apple or Facebook account.

When deleting an account, look for the delete option rather than deactivate. Deactivating only hides. If the service offers no deletion, write asking for erasure: they are obliged to deal with you.

Step 3. Exercise your right to erasure

Any company holding your data must delete it if you ask, unless it has a legal obligation to keep it — an invoice, for example, is retained by law for years.

No special format is needed. An email to their data protection address with this content is enough:

I request the exercise of my right to erasure under Article 17 of Regulation (EU) 2016/679 in respect of all personal data you hold about me. I attach a copy of my identity document for verification. Please confirm the erasure in writing within one month.

Keep a copy of what you sent. They have one month to respond. If they do not, or refuse without justification, you can complain to your national supervisory authority, which is free.

Step 4. Remove search results

Here it is worth understanding the distinction, because this is where most people get frustrated: removing a result from Google does not delete the page. The information is still there; it simply stops appearing when someone searches your name.

It is still useful, because almost nobody reaches those pages by any other route.

Google has a removal form for right-to-be-forgotten requests. It weighs whether the information is inaccurate, has become obsolete or is excessive, against the public interest. A public figure will get less removed than a private individual, and that is intentional.

Google also allows requests to remove results containing personal contact details — your phone number, your address, your email — which tends to be accepted more readily.

If the original page is yours or belongs to someone reachable, the effective move is to ask for it to be deleted at source first and then request the index be refreshed.

Step 5. Data brokers

There are companies dedicated to collecting and reselling personal information: phone listings, addresses, professional data. This is the most tedious part.

Each has its own opt-out procedure, usually buried in the footer. It has to be done one by one, and some reinstate the data months later if they collect it from another source.

The paid services that promise to do this for you automate requests you could send free of charge. They save real time if your case is large; they achieve nothing you could not achieve yourself.

Step 6. Generate less from now on

Deleting is uphill. Not generating is free.

• Give less data. A shop does not need your date of birth or your phone number to sell you something. The mandatory fields are usually fewer than they appear.
• Use email aliases for minor sign-ups. Besides protecting your real address, they tell you who sold your data when spam starts arriving at one specific alias.
• Review your profiles’ privacy settings. Much of what appears when someone searches your name was published by you with the default settings.
• Think before posting photos with context. A doorway, a number plate, a school uniform: there is more information there than it appears.
• Be careful what you paste into third-party tools, AI assistants included, as explained in why you should never paste private data into an AI.

What you will not achieve

Being honest about this saves frustration:

• News articles are rarely removed. Freedom of information weighs heavily, and rightly so.
• Public registers and official gazettes are not deleted. You can ask for them not to be indexed, and sometimes that works.
• What other people publish about you depends on them, unless it is unlawful.
• What has already leaked has leaked. No request retrieves a list already in circulation. There, the job is containing the damage, as explained in how to check if your data has been leaked.

In short

• Start by searching for yourself and listing what appears.
• Deleting old accounts gives the most return per minute invested.
• The right to erasure obliges companies to respond within one month.
• Removing a Google result does not delete the page, but it makes it invisible in practice.
• What you do not generate does not have to be deleted later.