How to Remove Your Personal Data From the Internet

Most people start thinking about their online footprint after something specific: an old photo surfaces in a search for their name, or a stranger calls and already knows their address. The instinct is to look for a button that erases everything. That button does not exist. What does exist is a set of steps that remove the easy-to-find copies and cut off the sources republishing them.

[[answer]]You can delete accounts, opt out of data brokers, and ask search engines to remove certain results. You cannot erase what has already been copied, archived, or screenshotted. The realistic goal is reduction, not erasure.[[/answer]]

What removal actually means

Your information exists in three states, and each behaves differently when deleted.

Data you control — accounts you created, posts you published. You can delete these directly, and it usually works.
Data someone else holds — broker records, marketing lists, people-search profiles. You can request deletion, and in some regions require it.
Data already copied — screenshots, reposts, archives, scraped datasets. Outside anyone's control, including the original site's.

The first two are where real progress happens. The third is where every promise of total removal quietly fails — and [[post:how-personal-data-is-collected-online|how personal data gets collected]] explains why that pile keeps growing.

Start with an audit, because cleanup without one is guesswork. Search your name in quotes, your name plus your city, your phone number and each email address you have used, on two search engines and in image search. Then search your own inbox for "welcome to" and "confirm your account" to surface forgotten services. Sort by sensitivity: address, phone and date of birth first.

Deleting accounts and old content

This is the only method that removes the source rather than a copy. Do it first: search removals are pointless while the original page is live and re-indexed.

[[steps]] Export before you delete :: Download your data archive first. Once the account is gone, photos and messages are unrecoverable. Delete, do not deactivate :: Deactivation hides the profile and keeps the data. Look for permanent deletion, usually buried in privacy or security settings. Wait out the grace period :: Many services keep deleted accounts recoverable for 14 to 30 days, and logging back in during that window cancels the deletion. Clean the accounts you keep :: Remove your phone number, birthday and address from public fields, and set old posts to private if the platform allows bulk edits. [[/steps]]

Search engine removal requests

Search engines index pages, they do not host them. Removing a result hides the page from one engine's listings but leaves it online, reachable by direct link and other engines.

Google handles two different kinds of request, and confusing them costs people removals they would have won. The first is personal information: your home address, phone number or email, government ID numbers, bank or card numbers, images of your signature or ID, private records such as medical files, and confidential usernames and passwords. These are removable on request — you do not have to show that anyone threatened you or that any harm followed. The second is doxxing content, and that category is narrower: it requires your details published alongside explicit or implicit threats, or calls for others to harass you, or a large aggregation of your personal data with no legitimate purpose. Separately, Google removes results for pages that are already gone, and explicit imagery published without consent. The forms and current policy are in Google's removal troubleshooter. Bing runs a separate process — a Google removal does nothing there.

Requests about outdated content are usually approved quickly. Requests that amount to "this is embarrassing" are declined: discomfort is not a removal ground outside specific legal regimes.

Data brokers and legal requests

Brokers are why your address reappears after you thought everything was clean. They aggregate public records, marketing lists and app data into profiles you never created — the same machinery behind most attempts to [[post:locate-phone-by-number-what-works|find a person by phone number]].

Outside California, each broker has its own opt-out, filed one at a time, usually with an email confirmation and sometimes an ID check. Those opt-outs are not permanent: brokers re-scrape the same public sources, so a profile removed in spring can be back by autumn. How fast that happens depends on the broker, and few of them publish the interval — which is why the honest advice is to re-check rather than assume.

California's DROP changes the arithmetic

California's DELETE Act built a single front door. Since January 2026, residents can file one deletion request with the state's Delete Request and Opt-out Platform (DROP), run by the California Privacy Protection Agency, instead of chasing brokers individually. From 1 August 2026, every data broker registered with the state must check the platform at least every 45 days, decide and act on the requests within 90 days, and keep a suppression list so the same records are not re-collected and resold. That suppression duty is what separates DROP from an ordinary opt-out: it is designed to survive the next re-scrape instead of being undone by it. Two limits are worth stating plainly. It covers California residents only, and it reaches only brokers that actually registered with the state — a broker that never registered is outside the platform, even though failing to register is itself a violation. The consumer entry point is the state's own DROP page, which walks through residency verification and the three steps of a request.

Where you live changes what you can demand rather than ask. Under the GDPR, residents of the EU have a right to erasure; the UK runs a parallel regime of its own, the UK GDPR, amended by the Data (Use and Access) Act 2025, so the two are similar but no longer identical. In both, the company must answer within one month and may extend by two further months for complex or numerous requests. In California, the CCPA and CPRA give a right to deletion: a business must respond within 45 calendar days and may extend by another 45, to 90 in total, if it notifies you. Note what those deadlines actually govern — they are deadlines for a reply, not a guarantee that records are gone by that date, and the reply can be a refusal with a stated reason. The state Attorney General publishes guidance on those rights. Send requests in writing and keep the timestamps.

What cannot be removed

Anything already copied. Screenshots, reposts and scraped datasets have no delete button, because no one owns them.
Web archives. Snapshots predate your cleanup. Practice varies: the Internet Archive reviews exclusion requests case by case, while many smaller mirrors have no process for them at all.
Public records. Court filings, property deeds and business registrations are public by law. You can remove a broker's copy, not the original.
Breach dumps. Leaked credentials circulate indefinitely. The response is new passwords and two-factor authentication, not deletion.
Other people's content. A photo of you on a friend's account is theirs. You can ask, not compel.

Why full-removal services sell the impossible

Paid services do real work: they automate broker opt-outs, track reappearances and save dozens of hours of forms. The problem is the claim wrapped around it. No service can delete data it cannot reach — archives, private datasets, screenshots on a stranger's phone, brokers that ignore requests, public records. A vendor advertising complete erasure is promising something structurally impossible.

Before paying, check how many brokers are covered, whether coverage is rechecked on a schedule, and whether the company says plainly what it cannot do. If you live in California, ask specifically what the service adds on top of a free DROP request, since the state platform now covers every registered broker at once. The FTC's consumer privacy guidance is free — read it before deciding [[post:who-needs-paid-privacy|whether you need paid privacy tools]].

Keeping the footprint small

Cleanup is a project; staying clean is a habit. Use a separate email for shopping and signups, and decline optional fields — phone, birthday, address — whenever a form does not require them. Review app permissions every few months and revoke location and contacts access from apps that do not need it; the steps are documented for Android and for iPhone. Re-run the searches above twice a year.

[[faq]] Can I remove my data from the internet completely? :: No. Copies already sitting in archives, screenshots or scraped datasets are beyond anyone's reach. Deleting accounts and opting out of brokers cuts exposure, but the goal is reduction. Does deleting my account remove me from Google? :: Not immediately. The page has to disappear first, then the index has to update. If the page is gone but the result persists, use the outdated-content tool. Do I have to prove harm to get my address off Google Search? :: No. Contact details such as a home address, phone number or email are removable on request. Proof of threats is required only for the separate doxxing category. Is there a single form that covers every data broker? :: In California, close to it — one DROP request reaches every broker registered with the state, and from August 2026 they must process it. Elsewhere, opt-outs are still filed broker by broker. What should I remove first if I have limited time? :: Home address, phone number and date of birth — the fields most useful for impersonation and account-recovery attacks, and the most common on broker profiles. [[/faq]]