Is the "Right to Be Forgotten" a Mess? (and What it Means for SEO)

under SEO.

  • 8

lawOh boy, this one's a doozy.

The EU has officially ruled that search engines like Google, if they have operations in the EU, will need to remove search results if people claim that they infringe on their right to privacy.

Except it's just...way more complicated than that.

The standard responses go something like this:

  • Yay! Personal privacy is good!
  • Booh! Censorship is bad!
  • That's not Google's job, it's the job of the publishers! (Except it's not under EU law, because media companies have protections that Google does not.)

And then, of course, there's the standard response from SEOs:

This is going to encourage negative SEO!

And will it? Is this good, bad? How do I feel about this?

I, for one, find myself surprisingly on the fence, especially after digging deeper than the headlines. The EU has considered more of the potential downsides of this than you might think, but how this is all going to work out from a technical and logistical standpoint's anybody's guess how that is going to playout.

What, if anything, should we do to prepare? Let's talk about it.

What's Not Happening

There are so many knee-jerk responses that myself and others have had to news like this that I feel like it's necessary to point out some things that aren't actually happening:

  • Google isn't being singled out. This ruling applies to all search engines that have operations in the EU.
  • This probably won't apply to most sites with a search feature. Media companies are protected and won't be compelled to take down information. Unless some future lawsuit changes things, it's probably safe to assume that merely having a search bar on your site won't legally qualify you as a "data controller" the way that Google and Bing are.
  • It's not a free for all. Google isn't obligated to remove a listing just because somebody asked for it. Until the courts outline some specific guidelines, Google will almost certainly forward all but the clear-cut cases (like the equivalent of social security numbers) to the courts. When the courts do outline specific guidelines, Google will still only be obligated to follow those guidelines to the letter. It's extremely unlikely that they will be making any "judgement calls" because it would be a waste of resources on their part. Edge-cases will almost certainly be resolved in the courts.
  • It won't affect search results outside the EU. At least, not unless that gets taken to court as well. In the meantime, Google isn't going to be removing these listings in all of the search results, just the ones in EU countries.
  • It won't allow public figures or criminals to easily hide their information. This is where things start to get a bit fuzzier. The ruling protects information that is in the public interests from censorship. So while a convicted pedophile, a business with bad reviews, and a politician have already tried to use the ruling to get listings removed, these almost certainly aren't getting taken down without a court ruling.



What to Expect

The most likely outcome here is that search engines like Google will start putting up takedown forms, and Google will probably end up putting it here.

Once the EU has a set of guidelines put in place, Google will probably put some semi-automatic process in place to get clear-cut listings taken down (if they're any different from the guidelines they already have in place).

Google will almost certainly respond to anything even a little bit fuzzy by forwarding it directly to the EU courts. There's simply no reason for them to expend any resources doing anything else, especially considering the PR nightmare it could potentially create for them.

So, while I'm a little conflicted about the political implications of this ruling, I'm going to go ahead and say that, from an SEO standpoint, I honestly don't think it's going to create much of a problem, if any.

There is one case where I could see this being abused for negative SEO.

An attacker could potentially post personally revealing content on your site, either in the user-generated content sections, or by hacking the site. They could then file a takedown request with Google.

If the privacy violation fell within the "clear-cut" end of the spectrum, your site (or more likely, just that page) could end up getting removed from the EU search results, possibly through some semi-automatic process.

While this is certainly a possibility, there are some reasons to expect it to be incredibly rare:

  • This probably falls well outside of legal territory and could be considered fraud. (Sorry for the weak language, it's just I'm not a lawyer.)
  • It is already possible for an attacker to do something similar to this.
  • The attacker would have to post personally identifying information.
  • A large number of these attacks would need to be successfully orchestrated for anybody to make any headway in the search results, which should send some red flags due to their obvious nature.
  • While Google isn't necessarily speedy with its penalty removal process, any pages taken down by this method would eventually be restored, once the personally identifying information was removed, which would make this a temporary victory at best for any attacker.

Remember, anything outside of the "clear-cut" end of the spectrum is almost certainly going to be forwarded to the courts, and that puts this outside the realm of negative SEO and well into lawyer fantasy land.

While I can't predict the future, I don't see this ending in a free-for-all where Google starts taking down pages anytime somebody asks. Even if things ended up getting that bad, the resulting s**tstorm would be so horrible that it probably wouldn't last very long before some rulings got reversed.

Oddly enough, you can call me an optimist on this one, at least from the SEO perspective.

Image credit: Mike Coghlan