Many of the apps you use collect data about you, often over years. The GDPR gives you the right to have it deleted. Here's how that works, and what you can do if a company doesn't respond.
You are the product
It's an open secret that many of the apps and services you use on your phone or in a browser store what you do there, often for years. So over the years you've used a service, you have built up a huge amount of personal data. Most large technology companies use this personal data to make money. This is usually done through advertising. Simply put, other companies pay to advertise on their platform, and because these companies have stored vast amounts of user data, they can target customers more precisely, which advertisers value highly. As a user of their service, you become the product of their platform or app.
The main problem with this is that big tech companies like Google, Meta or Amazon have a clear incentive to store as much data about you as possible, which wipes out your privacy and leaves you more exposed to third-party attacks on their service. Sometimes access to your data also comes through third parties using a platform, as in the Cambridge Analytica scandal that Meta faced a few years ago. Back then, an app used Facebook's interface to collect data not only from its own users but also from millions of their Facebook friends.
A leaked email gives attackers material, for example for phishing. Check for free whether your email shows up in a known data leak.
Even if you're inclined to ignore the dangers, your benefit from the service is negligible. When was the last time you saw an ad on Instagram or YouTube for a new product you didn't know about and decided to buy it? If you're anything like us, you're still waiting for that day to come. In the meantime, you're probably scrolling past hundreds of ads for miraculous fat-burning pills (most likely not approved in your country, even if you were willing to try them and take your chances).
The do-it-yourself protection under the GDPR
Luckily, this is where the General Data Protection Regulation (GDPR) can help. Under Article 17 of the GDPR, you have the right to be forgotten by these companies. This lets you demand that data concerning you be deleted without undue delay in certain circumstances. If you live in the UK, the UK GDPR gives you the same right. The non-profit behind datarequests.org (Datenanfragen.de in Germany) has summarised the conditions quite well. Here are the key points in short.
The conditions are met, for example, if
- the data is no longer necessary for the purposes it was collected for (Art. 17(1)(a) GDPR),
- you withdraw your consent to the processing (Art. 17(1)(b) GDPR),
- the data has been processed unlawfully (Art. 17(1)(d) GDPR).
However, there are also cases where the right is restricted and there is no right to erasure. Restrictions include:
- if the right to freedom of expression and information prevails (Art. 17(3)(a) GDPR),
- if there is a legal obligation to keep the data, such as keeping invoices for eight years in Germany (Art. 17(3)(b) GDPR),
- if the data is needed in the public interest for archiving, research or statistical purposes (Art. 17(3)(d) GDPR),
- if the company needs the data to establish, exercise or defend legal claims (Art. 17(3)(e) GDPR).
A lot of the information these companies collect about you isn't even needed for their service. If one of the grounds above applies, you can demand erasure. Under Art. 12(3) GDPR, the company also has to tell you within one month what it has done with your request. In complex cases it can extend this by two months, but it has to tell you within the first month. So where's the catch? Well, you as a user have to invoke this right yourself, and most companies won't make it easy for you, because it isn't in their interest. For an overview of all your rights, see our post on your data protection rights.
How it works
There are two main ways to exercise your right to erasure:
- Contact the company directly:
- You can tell the company that stores your data to delete it. This is probably the easiest way to get your data deleted. First, find out which email address you used to sign up for the service, then send the service an email. Only include the details the company needs to identify you, usually your name and email address, and your postal address or customer number if needed. The template below has the right fields.
- Use the company's own tools:
- Unfortunately, it isn't always that simple. Large technology companies like Google or Meta don't want to write to every user individually. With them, their own tools usually get you there faster than an email. This usually means logging in to the service's website and opening the Privacy tab in your account settings. There you'll find a button that lets you delete your data. Be careful not to delete your account in the process. On your phone, your advertising ID is part of this too: here's how to reset it.
Template for your GDPR erasure request
Here is the standard email template you can use to tell a company that you want your personal data deleted. Fill in your details in the right places. If you live in the UK, the article numbers are the same under the UK GDPR.
Dear Sir or Madam, I am hereby requesting the erasure of personal data concerning me without undue delay, in accordance with Article 17(1) GDPR. Please erase all personal data concerning me as defined in Article 4(1) GDPR. If I have given consent to the processing of my personal data, I hereby withdraw that consent for the entire processing. I am of the opinion that the requirements of Article 17(1) GDPR are met. Nor can you rely on an exception under Article 17(3) GDPR, particularly as I am not a public figure. If you have made the data concerned public, you are obliged under Article 17(2) GDPR to take all reasonable steps to inform other controllers, such as search engine operators, who process the personal data listed above that I have requested the erasure of all links to, copies or replications of it. This applies not only to exact copies of the data concerned, but also to copies from which information contained in that data can be derived. If you have disclosed the personal data concerned to one or more recipients within the meaning of Article 4(9) GDPR, you must also communicate my request for erasure of that personal data, and of any references to it, to each of those recipients in accordance with Article 19 GDPR. Please also tell me who these recipients are. If you refuse the erasure, you must give me your reasons. My request explicitly includes all other services and companies for which you are the controller within the meaning of Article 4(7) GDPR. Under Article 12(3) GDPR, you must inform me of the erasure carried out without undue delay and in any event within one month of receiving this request. To identify myself, I am providing the following details: Name: [Your name] Email address: [Your email address] Address: [Your address] Customer number or date of birth: [only if needed] If you do not comply with my request within the stated period, I reserve the right to take legal action against you and to lodge a complaint with the competent data protection supervisory authority. Thank you in advance for your help. Yours faithfully, [Your name]
Where the company's own tools are quicker
These services have their own deletion tools. You'll usually get there faster through your account settings, often under "Privacy", than by email:
- Amazon
- Meta (including Instagram and Facebook)
- Netflix
- PayPal (email is possible but not recommended)
- Snapchat
- TikTok
Are they not responding?
That's annoying. One option is to try again or send your email to a different address. Send it to the privacy address in the company's privacy policy and to customer support as well. The GDPR doesn't prescribe a particular channel, and the company has to make it easier for you to exercise your rights (Art. 12(2) GDPR). Also keep in mind that the company usually has one month. In exceptional cases it can extend the deadline by two months, but it has to tell you within the first month and explain why. Some companies only get back to you shortly before the deadline.
Datapods: Deletion made easy
Admittedly, this sounds like a lot of work if you want to delete your personal data from every company you've ever dealt with. You can simply use the email template and send it to every company that offers an email option, but finding the right address, replying to their responses and repeating the whole process regularly can be quite a hassle. At the same time, it's tedious to go to the account page of every major service you use and hunt for the delete button on each one.
This is where Datapods comes in and lets you do this easily with the app. In the app, you connect accounts such as Google, Amazon, Apple, TikTok and Meta and bring the data these services store about you into your Datapod. For data brokers, Datapods Shield takes care of the deletion requests for you. For more, we have a whole article on the things Mark Zuckerberg and Meta/Facebook know about you (hint: it's a lot).
For companies you've never been a customer of, such as data brokers, have a look at Datapods Shield.
Common questions
How long does a company have to delete my data?
It has to act without undue delay and tell you what it has done within one month of receiving your request at the latest. For complex cases or a large number of requests it can extend this by two months, but it has to tell you within the first month and explain why.
Does a GDPR erasure request cost anything?
No. The request and the deletion are free for you. A company may only charge a fee or refuse if a request is manifestly unfounded or excessive, for example if you keep sending the same request over and over.
Can a company refuse to delete my data?
Yes, in some cases, for example if the law requires it to keep the data. Invoices are a typical case: in Germany a company has to keep them for eight years. If it refuses, it has to give you its reasons within one month and tell you that you can complain.
What can I do if a company doesn't reply?
Remind the company of the deadline once, in writing. If it still stays silent, you can complain to a data protection authority, usually the one in the country where you live. The complaint is free. The European Data Protection Board lists the authorities in every EU country, and in the UK it's the ICO.
How do I delete my data from data brokers?
Data brokers are companies you've usually never been a customer of. You can demand erasure from them under Article 17 GDPR too, but first you have to find them. Datapods Shield sends deletion requests to around 50 data brokers for you.
Can I stop Meta from using my data for AI?
Yes, you can object. Meta has an online form for Facebook and one for Instagram. You have to be logged in and give an email address, but you don't need to give a reason. The objection only works for the future: Meta has been using public content from users in the EU to train its AI since 27 May 2025.
