Right to erasure
The right to erasure lets a person require an organization to delete their personal data without undue delay when, for example, the data is no longer needed, consent is withdrawn or the processing was unlawful.Article 17 of the GDPR lists six grounds: the data is no longer necessary for its purpose; the person withdraws the consent the processing relied on and there is no other legal ground; the person objects under Article 21 and there are no overriding legitimate grounds, or objects to direct marketing; the data was processed unlawfully; erasure is required by a legal obligation; or the data was collected from a child in relation to an online service. If the controller made the data public, Article 17(2) asks it to take reasonable steps to inform other controllers. Article 17(3) sets the limits: freedom of expression, legal obligations, public health, archiving and research, and legal claims. The phrase "right to be forgotten" comes from the Court of Justice's Google Spain judgment (C-131/12, 13 May 2014) on search engine results.
California's version, section 1798.105 of the Civil Code, covers personal information the business collected from the consumer, and requires the business to notify its service providers, contractors and the third parties to which it sold or shared the data.
For cookies, withdrawing consent is the common trigger: the site should stop the trackers and delete what it holds for that browser. Records kept to prove the earlier consent can usually be retained under the legal claims exception. Requests often arrive with a DSAR; see the CCPA and CPRA page for US deadlines.