Google is now making it possible for people to ask them to remove sites from search results that list more types of personal information than they previously did, including details like your phone number or physical address. This is big as, until now, Google would only delist links with information that could actively be used to steal your identity or money, like your Social Security number or credit card details.
In a blog post yesterday, Google explained that it believes that “it’s important to have control over how your sensitive, personally identifiable information can be found.” While it doesn’t necessarily host a lot of personal data, Google Search is often the tool that surfaces it on other sites. This puts it in a fairly unique position since, as it explains, “the internet is always evolving — with information popping up in unexpected places and being used in new ways — so our policies and protections need to evolve, too.”
According to Google, under the new policy the company will now consider removing links to sites that include “personal contact information like a phone number, email address, or physical address.” And The Verge notes that this type of information could also now include “images of ID docs” or “confidential login credentials.”
This is in addition to information that it already had a policy of removing, including confidential government ID numbers, bank account numbers, credit card numbers, images of handwritten signatures, and highly personal, restricted, and official records, such as medical records.
As The Verge points out, Google will also remove “non-consensual explicit or intimate personal images,” “involuntary fake pornography” like deepfakes, and links to “sites with exploitative removal practices.” There is also a separate process for requesting the removal of (non-exploitative) photographs of minors, which we covered in detail before.
Getting Google to remove identifying information, while now possible, isn’t necessarily easy or guaranteed. To remove personally identifying information, or “doxxing” content, for example, the tech giant requires that your contact information be listed, as well as the presence of “explicit or implicit threats, or explicit or implicit calls to action for others to harm or harass.” This means that if your phone number is just listed on a Craigslist ad or your address is included in a local news article, Google is unlikely to remove the link from search, if there’s not also that corresponding threat. Similarly, getting your information removed from data brokers, like Spokeo, Intellius, or MyLife requires a different approach.
To make a removal request, you have to fill in a fairly detailed form that lists the URL of the content you want removed, the Google Search URL that surfaces it, and “representative screenshots” showing the personal or otherwise identifying content. Depending on what you’re asking to get removed, Google may contact you and ask for yet more information—presumably proof that you are who you say you are.
When it receives your removal request, Google’s moderators “evaluate all content on the web page to ensure that we’re not limiting the availability of other information that is broadly useful.” They will “also evaluate if the content appears as part of the public record on the sites of government or official sources,” and in these cases, won’t make removals. Likewise, if Google considers the link to contain content that is “on or from government and other official sources,” “newsworthy,” or “professionally-relevant,” you’re out of luck.
If your request is successful, Google either removes the URL from all search queries, or only from those that include your name or other identifying information. This means that if something like a forum post explicitly doxxes you, it will likely be removed from all searches, while a long article of contact information for hundreds of people would only be delisted when someone specifically searches for your name.
Google also makes it clear that removing links from its search results doesn’t actually delete anything from the internet. If you want things totally gone, it suggests contacting the hosting site directly, “if you’re comfortable doing so.”
While this new policy is certainly a move in the right direction, getting Google to remove links from search results is certainly an uphill battle, at least in the US. In Europe, where the “right to be forgotten” is part of the broad General Data Protection Regulation (GDPR) legislation enacted in 2018, users can request information that is “inaccurate, inadequate, irrelevant or excessive” be removed. Until wider federal privacy protections are brought in, however, Google is likely to interfere with its algorithmic search results as little as possible.