GDPR Article 17: your right to be forgotten, explained

Article 17 of the GDPR gives every person in the EU/EEA the right to have their personal data erased by any organisation that holds it — including data brokers you have never heard of.

A controller must respond within one month. If your data was shared with others, Article 19 obliges them to pass your erasure request along the chain.

The practical hurdle is scale: your data sits with hundreds of brokers, each with a different opt-out route. That is the problem Withheld automates — one engine, one mandate, every broker.