The Right to Delete Your Data Is a Lie
The right to delete your data is Santa Claus for grown-ups: everyone swears it exists, but it’s a lie.
Lawmakers boast about “rights” in the digital age. In Europe, the UK, California, Brazil, Argentina, South Korea, South Africa, and elsewhere, people are promised the right to erasure. On paper, it sounds fine: ask a company to delete your personal data, and poof, it’s gone.
You may have the right, but, as comedian Ron White puts it, you don’t really have the ability.
Deletion is not what you think
When most people imagine data deletion, they picture a clean slate: their records are gone forever. That is almost never the case.
Instead, companies use soft deletion. Your records are flagged as “inactive” or the encryption key that makes it readable is thrown out. The underlying data is still there. Still recoverable.
Every serious company maintains backups to recover from catastrophic outages. Nobody combs through tapes or cloud snapshots to purge your record. If someone wanted to, they could revive your data. Erased? Yeah, right!
Some data must stay, such as financial transactions, invoices, and audit logs. Even the record of your erasure request itself must be kept. Legal and “public interest” loopholes make a mockery of the idea of deletion.
“Anonymization”
When deletion is not possible, companies fall back on what is referred to as anonymization. Anonymity is a legal fig leaf. It only takes a few data points to re-identify most people. Once anonymized, your data usually falls outside privacy laws. It still exists, of course. And that means it still is sold on.
Data lives forever
Even if a company plays fair, the chances are your data has already been sold, copied, or scraped. Data brokers trade in it. Social networks leak it through public posts, including metadata from images and videos. Partnerships quietly move it between corporations. Once it leaves the original infrastructure, your erasure request means nothing.
The brokers make it nearly impossible to push back. At least 35 of them were recently caught deliberately hiding their opt-out pages from search engines, so people could not even find the tools to delete their data, even though almost half of user attributes are inaccurate.
When the data is not inaccurate, it can become deadly. In June 2025, a man from Minnesota found the home addresses of state officials through several data brokers. He murdered two people and injured two more.
Data everywhere
Your data does not live in one database. It sits in replicas in staging and production environments, caches, event stores, data lakes, logs, off-site backups, archives, vendor systems nobody tracks or even remembers. Maybe even in a spreadsheet on someone’s laptop that should not exist but does anyway. Even insiders can rarely map every copy.
And then there is the problem of jurisdiction. The GDPR applies in the EU, but if your data has already crossed into the US or Singapore, or it has been sold to a broker abroad, your right ends at the border. Enforcement agencies cannot recall what is already offshore. Deletion is not just legally weak, it is operationally impossible at global scale.
Surveillance economy
The problem is incentives. Google, Meta, TikTok, and the data brokers make billions because data persists forever. Governments also rely on the same data for policing, intelligence, and border control. Erasure is against everyone’s interests except yours.
Every time an online ad is auctioned, brokers access vast behavioural and location data, even if no ad is shown. People are categorized by religion, race, sexual orientation, or health conditions. Their profiles are sold onwards. Facebook relies on 98 data points to show you ads, including whether you have an anniversary coming up in the next few days, whether you are in a long-distance relationship, whether you are a soccer mom, what sort of office you work in, whether you are an expat, your credit score, your usage of coupons, whether you might be an alcoholic, your allergy medication(s), or whether you are gullible enough to fall for online car insurance offers.
ShadowDragon, an ICE contractor, monitors more than 200 different sites, from Duolingo and Etsy to Tinder and OnlyFans. The languages you fail to learn, the handmade tchotchkes you gawp at, and any dating (and mating) preferences all seem to matter to the US government.
Privacy is the enemy of the surveillance economy. Anything you do online can and will eventually be used against you, either in a court of law or at the border.
As of March 2025, US immigration officials require all applicants for green cards, citizenship, and asylum to submit their social media handles. That’s 3.6 million people per year whose posts, likes, shares, friends, the people they follow, and so on can be mined for red flags. Visa applicants must also make their social media profiles public. Anyone critical of the government is automatically tracked.
The truth
The right to deletion is a legal fiction. Companies don’t want it, governments don’t want it, and the technical sprawl of modern systems makes it impossible. Believing in the right to delete your data is like believing in Santa Claus: you might find comfort in the story, but it was never real.