Google may now remove search results that dox you

Google says it’s expanding the types of personal information that it’ll remove from search results to cover things like your physical address, phone number, and passwords. Before now, the feature mostly covered info that would let someone steal your identity or money — now, you can ask Google to stop showing certain URLs that point to info that could lead someone to your house or give them access to your accounts.

According to a blog post, Google’s giving people the new options because “the internet is always evolving” and its search engine giving out your phone number or home address can be both jarring and dangerous. Here’s a list of what kinds of info Google may remove, with the new additions in bold (h/t to the Wayback Machine for making the old list accessible):

• Confidential government identification (ID) numbers like U.S. Social Security Number, Argentine Single Tax Identification Number, etc.
• Bank account numbers
• Credit card numbers
• Images of handwritten signatures
• Images of ID docs
• Highly personal, restricted, and official records, like medical records (used to read “Confidential personal medical records”)
• Personal contact info (physical addresses, phone numbers, and email addresses)
• Confidential login credentials

According to a support page, Google will also remove things like “non-consensual explicit or intimate personal images,” pornographic deepfakes or Photoshops featuring your likeness, or links to sites with “exploitative removal practices.”

Making a request involves giving Google a list of URLs that link to the personal information, as well as the search pages that surface those links. After you submit a request, Google will evaluate it. Its FAQ says it tries to “preserve information access if the content is determined to be of public interest,” as in the case of content that’s “newsworthy,” “professionally-relevant,” or that came from a government. If Google does decide that the links should be removed, it says they’ll either not show up for any search query or that they won’t be surfaced for searches that include your name.

Google seems to be applying a relatively high bar for what counts as personally identifying information, which makes it a bit different from the systems it’s had to implement in places like the EU to comply with so-called right to be forgotten rules. Those laws let people request that links they deem unflattering or irrelevant be taken down, which isn’t the case here — the rules Google added today only cover links to very sensitive info.

It’s also unclear whether Google will remove sites that exist explicitly to sell people’s information. If you’ve ever searched for someone’s phone number, you may have ended up at one of these services, promising to give it to you if you subscribe. We asked Google about this and will let you know if we hear back.

Importantly, as Google notes on its support page and in its blog post, getting the information taken off of Google Search doesn’t wipe it from the internet. If, for example, you ask Google to delist a forum post with your address in it, anyone who goes to that forum will be able to see it; the post just shouldn’t pop up if someone searches “[your name] home address.”