Your photo shared on a social network, an account hacked after an unfortunate click, a company refusing to delete your personal data: these situations affect millions of internet users every year. Protecting your rights online is not just about choosing a good password. It involves knowing the available remedies, the texts that protect you, and the reflexes to adopt when a problem arises.
Remedies after a personal data breach: what the CNIL does not do for you
You have received an email informing you that your data has been compromised in a breach. The most common reflex is to file a complaint with the CNIL. This is useful, but it is not always enough.
The CNIL can control and sanction an organization, but it does not award damages. If you have suffered personal harm (identity theft, fraudulent withdrawals, damage to reputation), compensation must go through another route. You need to establish a breach of the GDPR, prove actual harm, and demonstrate the link between the two.
In practice, this means gathering evidence: screenshots, bank statements, received emails. This process can be carried out in a civil court, independently of the CNIL procedure. You will also find useful information on Mindtrap to structure this type of approach and understand your options in the event of a data breach.
Do not confuse breach notification with actual severity. Some breaches only involve email addresses. Others expose bank details or identity documents. The level of risk depends on the nature of the exposed data, not just on the number of people affected.
Right to delete personal data: how to make a deletion request
The GDPR gives you the right to request the deletion of your personal data. This right is sometimes referred to as the “right to be forgotten.” It applies when the data is no longer necessary for the purpose for which it was collected, or when you withdraw your consent.
The process is simple in theory: you send a written request to the data controller (the company, website, online service). The organization has one month to respond. In case of refusal or silence, you can contact the CNIL.
Cases where deletion may be refused
Not all requests are accepted. An organization may invoke a legal obligation to retain data. For example, an online shopping site must keep your invoices for several years for tax reasons.
A search engine may also refuse to delist information if it is in the public interest. These refusals must be justified in writing. If the response seems unjustified, the CNIL can intervene to verify the compliance of the refusal with the GDPR.
- Precisely identify the data controller (often mentioned in the site’s privacy policy).
- Formulate your request in writing citing Article 17 of the GDPR and specifying the data concerned.
- Keep a dated copy of your submission to prove the response time in case of a dispute.
Content moderation and DSA: your rights against platforms
You published a video or a comment that was deleted without a clear explanation. Before the Digital Services Act (DSA), remedies were limited. The situation has changed.
Platforms must now explain their moderation decisions and provide a free internal complaint mechanism. If a post is removed or your account is restricted, you must receive a reasoned notification.
If you disagree with the platform’s response, the DSA provides for the possibility of resorting to an out-of-court dispute resolution. This mechanism is distinct from the complaint to the CNIL, which concerns personal data, and from Arcom, which plays a coordinating role.
What Arcom does not do
A common confusion: Arcom does not arbitrate moderation decisions regarding a video or account on a social network on a case-by-case basis. Arcom oversees the obligations of platforms but does not handle individual complaints. To contest the removal of specific content, the first point of contact remains the platform itself, through the mechanism provided by the DSA.
Protection of minors online: the new obligations of platforms
The European Commission published guidelines on the protection of minors online on July 14, 2025. These texts specify the obligations of platforms regarding default security settings and risk assessment related to content to which minors are exposed.
In practical terms, this means that digital services aimed at young audiences must adapt their privacy settings. The most protective settings must be activated by default for accounts identified as belonging to minors.
For parents, this changes the game. Instead of having to dig through complex menus to restrict access to certain content, basic protections are supposed to already be in place. But checking remains a good habit: settings vary from one platform to another.
- Check the privacy settings on each application used by your children.
- Enable two-factor authentication on their accounts to limit the risk of hacking.
- Review the terms of use to check the minimum age required by the service.
- Report inappropriate content through the platform’s internal tools, which is required to respond.
Protecting your rights online relies on a combination of technical vigilance and knowledge of available remedies. The CNIL complaint, the claim to a platform, and the referral to a court address different situations. Identifying the right lever according to your specific problem is the first step to enforcing your digital rights.
