AI & Human Authenticity
Right to Be Forgotten Disadvantages: Risks and Criticisms
HAR Editorial Team
The right to be forgotten sounds simple: you ask, and the internet lets go. In practice, it creates real friction. If you are weighing it as a privacy tool, or trying to understand why critics push ba...
Right to Be Forgotten Disadvantages: Risks and Criticisms
The right to be forgotten sounds simple: you ask, and the internet lets go. In practice, it creates real friction. If you are weighing it as a privacy tool, or trying to understand why critics push back, you need the drawbacks laid out plainly. The right to be forgotten disadvantages go well beyond inconvenience.
The short answer is that it collides with free speech and the public record, it puts heavy compliance costs on businesses, and it can be abused to bury accurate information. Under GDPR, deleting data from search results is not the same as erasing it from servers, backups, and third-party copies. Platforms must make judgment calls that courts usually make, and those calls vary by country.
This article defines the right, then walks through each criticism: speech conflicts, technical and legal hurdles, business burdens, and misuse. At the Human Authenticity Registry, we advocate consent-first control over your digital identity, so we also note why deletion alone may not be enough to protect you.
Why the right to be forgotten draws criticism
Where the criticism starts
The modern debate began in 2014. In Google Spain v. AEPD, the Court of Justice of the European Union ruled that people can ask search engines to delist results about them. GDPR Article 17 later formalized a broader right to erasure. On paper, it looks tidy.
Critics focus on the wording. The Google Spain ruling allows delisting of results that are "inadequate, irrelevant or no longer relevant, or excessive." None of those terms has a fixed threshold, so every request becomes a judgment call about someone's past. A private company, not a court, usually makes that call first.
The four main objections
Four complaints come up again and again in legal commentary and in public debate:
Speech and public records: Delisting can hide lawful, accurate information that the public has a legitimate interest in finding.
Business cost: Companies must build intake, review, and deletion systems, often across scattered databases and vendors.
Inconsistent outcomes: Similar requests get different answers depending on the platform, the reviewer, and the country.
Abuse: People with something to hide can use the same process as people with something to protect.
Each of these gets its own section below. They share a root cause: a broad legal right applied through vague standards by organizations that were never built to weigh competing rights.
Why a weak standard hurts everyone
Consider two requests. One comes from a person convicted of a minor offense 15 years ago who has stayed out of trouble. The other comes from a surgeon who wants malpractice reports removed. Both fall under the same legal test, yet the public interest in each is very different. A reviewer who handles thousands of requests will not always tell them apart.
A privacy right with no clear boundary forces private companies to decide what the public gets to know.
Geography adds another gap. In Google v. CNIL (2019), the EU court held that Google does not have to apply EU delisting rules worldwide. A result removed for a user in Paris may still appear for a user in Texas. The United States has no equivalent right, largely because of the First Amendment. So one of the less obvious right to be forgotten disadvantages is that it promises more than it can deliver. You can win a removal and still find the information a few clicks away.
How the right to be forgotten conflicts with free speech
Privacy rights versus the public's right to know
The most serious objection is free expression. A delisting request asks a search engine to make lawful, often accurate reporting harder to find. Journalists and historians argue that this quietly edits the public record, even though the original article stays online. It is one of the core right to be forgotten disadvantages.
GDPR does try to protect speech. Article 17(3)(a) exempts processing needed for freedom of expression and information, and Article 85 tells member states to reconcile the two rights. But these are broad instructions, not tests, and courts disagree on close cases. In M.L. and W.W. v. Germany (2018), the European Court of Human Rights found that refusing to make media archives anonymize a murder conviction did not violate the convicted men's privacy rights. Belgium's highest court went the other way in 2016 and upheld an order to anonymize a newspaper archive.
Who decides what stays visible
Search engines make the first call, not judges. Reviewers typically weigh factors like these:
The requester's role in public life
The seriousness and age of the offense or event
Whether professional journalists published the information
Whether the requester was a minor when it happened
This process lacks the transparency and appeal rights of a court. Publishers often never learn that their work was delisted, and the public cannot see the reasoning.
The incentives also skew toward removal. Violating a data subject's rights can bring fines of up to 4% of global annual turnover under Article 83. Wrongly deleting something lawful carries no comparable penalty, so doubt favors deletion.
When wrongly refusing a request is punished and wrongly granting one is not, platforms will lean toward erasing.
Compliance burdens and technical challenges for businesses
Why deletion is harder than it sounds
A deletion request looks like one click. For a business, it is a hunt. Customer data sits in a CRM, an email platform, analytics tools, support tickets, server logs, and backups. Under Article 12(3), you have one month to respond, extendable by two more months for complex cases. Most companies cannot say where every record lives without a full data map.
Where data lives | Why erasure is hard |
|---|---|
Production databases | Records link to orders, invoices, and audit trails you may need to keep |
Backups | Archives are not built for editing single records |
Third-party vendors | Article 19 requires you to notify recipients and chase confirmation |
Machine learning models | Removing one person's influence from a trained model is still an open research problem |
Conflicting duties make it worse. Tax, accounting, and anti-fraud rules may require you to keep records that a person wants gone. Article 17(3) allows exceptions for legal obligations, but someone still has to decide which data qualifies and document why.
Verification, cost, and uneven impact
Proving who is asking creates its own trap. Delete data on a forged request and you have harmed a real customer. Demand a passport scan to prevent that, and you collect more personal data just to honor a privacy request. Neither option is clean.
Cost also falls unevenly. A large platform can staff a privacy team and build automated intake. A ten-person company often runs on a spreadsheet and a lawyer on call. That is one of the quieter right to be forgotten disadvantages: the rule is most expensive to follow for the smallest organizations, while fines of up to 4% of global turnover apply to everyone.
A right that takes one click to claim can take weeks of engineering and legal work to honor.
The practical lesson for businesses is to plan before requests arrive. Map your data, set retention limits, and write down who approves each deletion.
How the right to be forgotten can be abused
Hiding information the public needs
The process cannot check motives. A person asking to delist a result does not have to prove good faith, so the same form serves the vulnerable and the evasive. Among the right to be forgotten disadvantages, this is the one consumer advocates worry about most. Requests that raise concern include:
A doctor or contractor seeking removal of accurate reports of malpractice or fraud
A politician or executive trying to erase past conduct before an election or a deal
A person with a history of financial crime trying to reset how new clients or employers see them
Google's transparency report shows it has reviewed millions of URLs and delisted roughly half. Reviewers do reject many requests. But the approved ones disappear from search with little public scrutiny, and the publisher often never finds out.
A form that never asks why will serve the evasive as easily as the vulnerable.
Using erasure against other people
Abuse also runs the other way. Bad actors impersonate a victim or a business owner to get legitimate content removed. Competitors can file bogus requests aimed at critical reviews or unflattering coverage. Some reputation management firms sell removal services, and some have been caught submitting fabricated legal claims to make it work.
Weak identity checks make this worse. If a company deletes data on an unverified email, a stranger can erase your account history or the records that prove a dispute happened. Strict verification solves that, but as covered above, it means collecting more personal data to honor a privacy request. Every platform has to choose between the two risks, and most choose whichever costs them less.
How to weigh the drawbacks against the benefits
What the right does well
The drawbacks do not erase the benefits. The right gives real relief to people harmed by outdated or unfair information, such as someone whose charges were dropped, a victim of leaked images, or an adult stuck with posts from childhood. The useful question is not whether the right is good or bad. It is which cases it fits, and which it does not.
Situation | Usually leans toward |
|---|---|
Dropped charges against a private person | Removal |
Intimate images, or content posted as a minor | Removal |
Old, minor conviction of a private person | Often removal |
Malpractice or fraud by a working professional | Keeping |
Conduct of an official or candidate | Keeping |
Questions to ask before you decide
Run any request through the same checklist, whether you are the person asking or the company reviewing it. It keeps the right to be forgotten disadvantages from deciding the outcome by default, and it keeps the benefits from doing so.
Is the information accurate, or is it false or misleading?
Does the person hold a public role, or did they in the past?
How old is it, and has its relevance faded?
Does the public have an ongoing need to know, such as safety or consumer protection?
Is the harm concrete, like lost jobs or harassment, or only embarrassment?
Accurate information about a current public risk should almost always stay findable. Inaccurate, intimate, or long-irrelevant material about a private person usually should not.
Look for narrower tools first
Blanket deletion is a blunt instrument, so ask whether a smaller fix works. A correction, a delisting limited to name searches, or an update to a stale story often solves the problem without wiping the record. Prevention helps more than removal, because information you never over-share is information you never have to chase.
The best privacy outcome is rarely deleting everything. It is controlling what gets shared in the first place.
This is where consent-first tools come in. A remote worker applying for jobs, for example, can disclose only what a role requires instead of handing over a full personal history. That supports fairer hiring and shrinks the pile of data that might need erasing later.
Weighing the trade-offs
The right to be forgotten protects real people, but the right to be forgotten disadvantages are just as real. It strains free expression, hands private companies judgment calls that belong in court, and costs small businesses the most. It can also be abused to bury accurate information, and a successful removal rarely wipes anything from the internet entirely.
Still, the answer is not to dismiss it. Judge each request on its facts: accuracy, public role, age, and ongoing public interest. Reach for narrower fixes before blanket deletion, and limit what you share so there is less to chase later.
That last point is where you have the most control. If you want a consent-first way to prove you are human and disclose only what matters, see how the Human Authenticity Registry handles your privacy and help shape how authentic identity is recognized.