ISSUE No. 05Cross-cutting

The right to be forgotten, and the reasons you won't be

You have a legal right to be deleted. You also live under a dozen laws and clauses that keep you anyway. The fine print is where that tension plays out.

D

THE DÆTRAX TEAM

PRIVACY RESEARCH · WITH DECKARD, OUR AI AGENT

Delete feels like a moment. It is rarely one.

You tap delete, the screen confirms it, and the assumption is that you are gone. It is the most natural belief in the world, and it is almost never how it works.

Underneath that tap sits a negotiation, and a contract you never read. On one side you have a genuine, powerful legal right. On the other, the same company holds a stack of reasons it gets to keep you anyway. Both are real. The gap between them is the whole story, and it is where this entire idea lives.

The right is real

The right to be deleted is now law across a growing share of the world. These regimes give you a right to erasure, the right to be forgotten: you can ask a company to delete the personal data it holds on you, and in most cases it has to comply, often within about a month. This is not a favour. It is the law, and it has teeth.

So if the right is that strong, why does "I deleted my account" so rarely mean "everything they had is gone"? Because the right was written with exceptions, and the company's own policy is written to live inside them.

The reasons you won't be

Open almost any privacy policy and read the retention section. You will find the same open-ended legs, none of them with a firm end date:

  • The law made me keep it. Tax, accounting, and anti-money-laundering rules force retention for years. A crypto exchange or a bank will keep your identity records for around five years after you close the account, because it is legally required to. That part is not a trick. It is the ceiling almost no one tells you about.
  • Legitimate interests. A catch-all that covers fraud prevention, security, and "the exercise or defence of legal claims." There is no clock on a legal claim that has not happened yet.
  • The fraud or safety file. Many services keep a record specifically so you cannot come back. One major dating group spells out its windows in the policy: a "safety retention window of three months following account closure or one year following an account ban," transaction data kept for ten years, support messages for six. Deletion does not touch those.
  • "Anonymised," eventually. A common line promises your data will be "fully deleted and/or anonymised" after a couple of years. Which one, deletion or anonymisation? By what method? The policy does not say, and an anonymised record that still points back to you has not really left.
  • The model already learned it. If your messages or uploads were used to train a machine-learning system, deletion cannot reach that. Once trained in, your data is part of the model. That is not a policy choice; it is how the technology works.
  • The copies already gone. Anything already shared with advertising partners, analytics firms, or "service providers" sits on systems your request never reaches directly.

None of this means erasure is pointless. It means erasure is a starting position, not a finish line.

Why "kept" is the default

Here is the uncomfortable part. Retention is rarely an accident or a backlog. Your data is worth more to a company kept than gone: it trains the models, sharpens the targeting, defends the lawsuits, and feeds the next product. A promise to delete runs against the company's own interest, which is exactly why it is the least credible promise in the document, and the one written most vaguely.

That is the thesis this whole project rests on. Malice and plain commercial incentive write the same clause and produce the same result: your data is worth more kept, so the wording that keeps it is the wording they reach for. Whether that is bad faith or just arithmetic changes nothing about what you should do. "We deleted it" is the claim with the weakest incentive behind it and the loosest wording around it, and it is the one you should never take on trust.

What a careful person actually asks

You do not have to settle whether anyone acted in bad faith. You need four answers a flat "your account has been deleted" leaves untouched, and they are four different questions:

  1. What about me is still held, and in what form?
  2. For each piece, why is it kept, and until when?
  3. Who else received it, and were they told to delete it too?
  4. Does any licence or permission survive my deletion?

A company that has genuinely cleared you out can answer all four plainly. A vague reply is itself the answer.

So: stay, or leave, but keep the record

If you are staying with a service, you do not have to delete anything to protect yourself. You can object to the uses that are not necessary to run it, profiling, targeted advertising, training their models on your data, and sale or sharing, and narrow what they do without closing the door.

If you are leaving, leave properly. Find the real deletion route, not just the uninstall, and use the right to erasure by name. Then expect the exceptions above, and ask the four questions so you know what survived.

Either way, the move is the same, and it is the one the company is counting on you not to make: keep your own record. The date you joined, what you handed over, the day you asked them to delete or to stop, and exactly what they wrote back. That record is the only thing that turns "I think they deleted it" into "here is what they told me, in writing, on this date."

It is the same shape across every industry, from a dating or matrimony app to a bank, and it rests on the same six clauses you will find in every privacy policy.

That is not fear. It is a receipt, and it is where you start. Start your record →