AI and Personal Data: Why Is Deleting Data So Difficult?

1. How AI Can Put Personal Data at Risk

AI systems can process personal information in several ways. Data may be collected from publicly accessible websites, provided directly by users, imported from company databases, or obtained through third-party data providers. Depending on the system, this information may be used to train a model, improve its performance, personalize its responses, or provide context through connected databases and external tools.

The fact that information is publicly accessible does not automatically mean that it can be collected and reused without restrictions. Personal data remains subject to applicable data protection rules, including requirements concerning lawful processing, transparency, purpose limitation, and data minimization.

One of the main risks is that individuals may have little visibility into how their information is used. A person may publish a professional biography, an email address, a photograph, or a personal statement on a website without expecting that information to be collected for AI training or reproduced in a generated response.

AI also introduces risks beyond straightforward data collection. Systems may infer sensitive characteristics, reproduce information from training material, or expose information supplied by users through connected applications. The actual risks depend on the model, its training process, its configuration, and the safeguards implemented by its provider.

Risks Worth Understanding:

• Data collection: Personal information may be gathered from public websites and other sources without individuals fully understanding how it will be reused.
• Unexpected disclosure: Certain models may reproduce information contained in their training data, while connected applications may expose information through insufficient access controls.
• Sensitive inferences: AI systems may infer characteristics about individuals from seemingly ordinary information.
• Loss of control: Information may be copied, transferred, or reused by multiple organizations, making it harder to identify every place where it is stored.
• Persistent exposure: Removing information from its original source does not necessarily remove every existing copy or every possible influence on a trained model.

2. Why Deleting Data From an AI Model Is Different From Deleting a Database Record

In a traditional database, information is generally stored in identifiable records. If a person requests the deletion of a record and the request is legally justified, a database administrator can locate the relevant entry and remove it, subject to applicable retention requirements and the handling of backups, replicas, and other copies.

A trained AI model works differently. During training, a model adjusts its internal parameters based on patterns learned from large amounts of data. Rather than storing every source document as a separate, directly accessible record, the model uses these parameters to generate predictions or responses. The information's influence may therefore be distributed across the model instead of being contained in a single identifiable location.

This does not mean that AI models can never memorize individual information. Some models can reproduce details from their training data, particularly under certain training conditions or when the information is repeated or distinctive. However, it is generally difficult to determine precisely whether a particular person's information has been memorized, where its influence lies, or how to remove it without affecting other capabilities.

Deleting the original database entry or webpage does not automatically modify the parameters of a model that has already been trained. The original information may no longer be available at its source while its influence remains in the model, depending on what the model learned and whether it can reproduce that information.

The distinction is fundamental: deleting a record removes information from a particular storage location, whereas removing its influence from a trained model may require a different technical process. Even when a model no longer reproduces a particular fact, that alone does not prove that every trace or influence of the data has been eliminated.

Three Different Levels of Data Deletion:

• Source deletion: Removing personal information from the original website, application, or database.
• Training data deletion: Removing the information from the datasets used to train or retrain a model, including relevant copies where applicable.
• Model-level removal: Using appropriate techniques to remove or reduce the influence of the information in a model that has already been trained, and evaluating whether the result is effective.

3. The Right to Erasure Under the GDPR

The General Data Protection Regulation (GDPR) gives individuals the right to request the erasure of personal data under certain conditions. Article 17 establishes the right to erasure, often referred to as the right to be forgotten. It can apply when, for example, the data is no longer necessary for its original purpose, consent is withdrawn and no other legal basis applies, or the data has been processed unlawfully.

This right is not absolute. Exceptions may apply, including where processing is necessary to comply with a legal obligation, exercise freedom of expression and information, carry out certain public-interest tasks, or establish, exercise, or defend legal claims. Each request must be assessed in its specific legal context.

The GDPR can apply to personal data used to develop or operate AI models. The European Data Protection Board (EDPB) addressed this issue in Opinion 28/2024, which examines, among other matters, when an AI model may be considered anonymous, the possible use of legitimate interests as a legal basis, and the consequences of unlawfully processing personal data during model development.

The fact that information has been incorporated into a model does not automatically make the GDPR irrelevant. Equally, the fact that a person requests deletion does not mean that every model must automatically be retrained or that the request must always be granted. The applicable legal grounds, risks, technical circumstances, and available measures must be considered.

The CNIL, France's data protection authority, explains that individuals may, under certain conditions, exercise rights including erasure and objection in relation to both training datasets and AI models. It also highlights the technical and economic difficulties involved in implementing these rights at the model level.

Key Legal Resources:

• GDPR Article 17: The right to erasure and the conditions under which it applies. https://eur-lex.europa.eu/eli/reg/2016/679/oj
• CNIL: Exercising data subjects' rights in the context of AI. https://www.cnil.fr/fr/ia-respecter-lexercice-des-droits-des-personnes
• European Data Protection Board: Opinion 28/2024 on personal data processing in the context of AI models. https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspectsfr

4. Machine Unlearning: Can an AI Model Forget Personal Data?

Machine unlearning is a field of research focused on removing or reducing the influence of selected training examples from a machine learning model. It aims to address a problem that traditional database deletion does not solve: what happens when data has already influenced a model's parameters?

One possible approach is to retrain a model using a corrected dataset that excludes the relevant information. When the original training data and training process are available, retraining can provide a way to remove the contribution of specific data. However, retraining can be computationally expensive, time-consuming, and difficult to perform for large models.

Other approaches attempt to modify an existing model without repeating the entire training process. These techniques may be more efficient, but their effectiveness depends on the method, model architecture, training data, and type of information being removed. They require careful evaluation and do not necessarily provide the same guarantees as training a model from scratch without the relevant data.

Output filtering is another possible measure. A provider can attempt to prevent a model from returning certain personal information, even if that information remains within the model. Such filters can reduce some disclosure risks, but they do not necessarily remove the underlying information or guarantee that it cannot be recovered through other prompts or methods.

For this reason, a successful deletion process should not be assessed solely by whether a model stops producing a particular response. Where appropriate, providers should evaluate the effectiveness of their methods, document the measures taken, and assess residual risks. The objective is not simply to make information harder to retrieve, but to implement a proportionate and effective response to the applicable data protection requirements.

Technical Approaches and Their Limitations:

• Retraining: Rebuild the model using a dataset from which the relevant information has been removed. This can be effective but may require substantial resources.
• Machine unlearning: Modify an existing model to reduce or remove the influence of selected training examples. Effectiveness depends on the technique and model.
• Output filtering: Block or limit certain responses. This can reduce disclosure risks but does not necessarily remove information from the model itself.
• Privacy testing: Evaluate whether personal information can still be extracted or reproduced after the proposed measures have been applied.
• Training data management: Maintain records of data sources, dataset versions, and model versions to make deletion requests easier to investigate.

5. Removing a Webpage Does Not Mean an AI Has Forgotten It

Many people assume that deleting a webpage is sufficient to make the information disappear from the internet. In reality, the same information may exist in search engine indexes, web archives, cached pages, third-party databases, screenshots, backups, or copies collected by data brokers.

AI introduces another potential layer of persistence. If information has been collected for a training dataset and subsequently used to train a model, deleting the source page does not automatically remove the data from the training dataset or reverse its influence on an existing model.

However, it is important not to assume that every publicly accessible page has been used to train every AI model. Data sources and training practices vary between providers, and access to a webpage does not establish that a particular model has ingested its contents.

Deleting the original information remains worthwhile. It reduces the availability of that information at the source and may prevent future collection, depending on the provider's collection methods and update schedules. It can also help reduce exposure through websites and services that have not incorporated the information into a model.

Search engine removal, source deletion, dataset removal, and model-level unlearning are separate processes. They may involve different organizations, legal grounds, technical mechanisms, and timeframes. A comprehensive privacy strategy should identify which of these actions is relevant instead of treating them as interchangeable.

What to Check When Requesting Removal:

• The original website: Ask the organization responsible for the page or database to delete the information where the applicable legal conditions are met.
• Search engines: Where appropriate, request the removal of search results that expose personal information, while understanding that this does not necessarily delete the original page.
• Data brokers and aggregators: Identify other organizations that may have collected and republished the information.
• AI providers: Check the provider's privacy documentation and available procedures for submitting data protection requests relating to training data or model outputs.
• Backups and copies: Ask how the organization handles retained copies, backups, and other systems, recognizing that specific retention exceptions may apply.

6. AI Agents and the Growing Number of Places Where Data Can Be Stored

The privacy challenges associated with AI are not limited to large models trained on internet-scale datasets. AI agents and AI-powered applications can introduce additional risks because they may interact with websites, databases, email services, document repositories, and external APIs.

An AI agent may receive personal information through a user prompt, retrieve it from a connected database, store it in conversation history, or transmit it to another service to complete a task. Depending on its architecture, the application may also create logs, cached results, intermediate files, or persistent memory.

These storage locations are not equivalent. Information stored in an application database may be removable through a conventional deletion process, while information sent to an external model may be subject to a separate provider's retention policies and technical limitations.

The integration of AI does not automatically mean that all information is used for model training. Some services process inputs without using them to train their general models, subject to their terms and configuration. Nevertheless, developers must examine what is collected, where it is sent, how long it is retained, and whether it is used for additional purposes.

For developers, the most effective starting point is to map the complete data flow. Identify the databases, APIs, models, logs, caches, and third-party services involved, then establish deletion procedures for each component. Where possible, avoid transmitting personal information that is not required to perform the task.

Privacy Measures for AI-Powered Applications:

• Data minimization: Send only the personal information strictly necessary for the requested operation.
• Access control: Ensure that AI agents and connected tools can access only the data required for their assigned tasks.
• Retention limits: Define appropriate retention periods for prompts, conversation histories, logs, and intermediate results.
• Provider assessment: Review the provider's terms, privacy documentation, data retention settings, and use of inputs for model improvement.
• Deletion workflows: Document how information is removed from application databases, connected services, and other storage locations.
• Human oversight: Require additional checks for sensitive operations and requests involving high-risk personal information.

7. What Regulations May Need to Address in the Future

Existing European data protection rules already cover important aspects of AI-related processing. The GDPR establishes rights and obligations concerning personal data, while the EU AI Act introduces additional requirements for certain AI systems and use cases. These frameworks are relevant, but the technical implementation of deletion rights remains a difficult area.

One possible direction for future regulation would be to require AI providers to document how they handle requests involving personal information in training datasets and trained models. Such documentation could help distinguish between source deletion, dataset deletion, model-level interventions, and restrictions on the disclosure of information.

Another area for development is independent verification. Depending on the risks involved, providers could be expected to demonstrate that their deletion procedures are effective, explain the limitations of the methods used, and evaluate whether personal information can still be reproduced after an intervention.

Regulation could also encourage better dataset provenance and model version management. If an organization cannot identify which datasets contributed to a model, responding to a specific deletion request becomes much more difficult. Better records could make investigations and corrective measures more practical.

At the same time, regulation needs to account for technical feasibility, proportionality, freedom of expression, research, and other legally protected interests. A universal requirement to retrain every model after every request could impose disproportionate costs in some situations. A more practical framework would define risk-based expectations and require appropriate measures based on the data involved, the model's capabilities, and the likelihood and severity of harm.

These are potential regulatory directions rather than a description of universally applicable legal obligations already in force. Any future requirements would need to be assessed against the applicable legislation and the technical evidence available at the time.

Potential Priorities for Future Regulation:

• Clearer deletion procedures: Explain how individuals can request the removal of information from training datasets and AI systems.
• Greater transparency: Improve information about training data sources, retention, and the use of personal information, subject to legitimate confidentiality and security constraints.
• Verifiable safeguards: Encourage testing and documentation of the effectiveness of model-level deletion measures.
• Clearer responsibilities: Clarify the roles of AI providers, application developers, website operators, and other organizations involved in processing personal data.
• Proportionate requirements: Adapt technical obligations to the sensitivity of the data, the capabilities of the model, and the risks to individuals.
• Accessible remedies: Make it easier for individuals to identify the responsible organization, exercise their rights, and challenge inadequate responses.

8. What Individuals Can Do to Reduce Their Exposure to AI

Although individuals cannot directly control every AI training process, they can take practical steps to reduce the amount of personal information available to organizations and third-party services.

Start by identifying the websites and organizations that publish or retain your information. Old profiles, professional directories, public documents, personal blogs, and data broker listings can all contribute to your digital footprint.

Where appropriate, submit deletion requests to the organizations responsible for this information. Under the GDPR, you may be able to request erasure or object to certain processing activities, depending on the circumstances. Organizations may have legal grounds to retain or continue processing some information, so a request does not guarantee deletion in every case.

Review the privacy settings of AI services you use. Check whether your conversations or uploaded documents may be retained, used for model improvement, or accessible through shared workspaces. Avoid entering sensitive information into services unless you understand the relevant safeguards and have a legitimate reason to provide it.

Finally, remember that removing a page from a search engine is not the same as deleting the information from its original source. Similarly, deleting a source page does not guarantee that a trained model no longer retains or reproduces the information. Each action addresses a different part of the problem.

Practical Steps to Protect Your Personal Information:

• Identify websites and organizations that publish or store your personal information.
• Request deletion from the original source where appropriate and legally justified.
• Review search engine removal options for exposed personal information.
• Contact relevant AI providers when you have a specific concern about the use or reproduction of your information.
• Limit the personal and sensitive information you submit to AI tools.
• Keep copies of your requests and responses so you can follow up or escalate a complaint if necessary.
• Remember that deletion from a website does not automatically guarantee removal from every copy, dataset, or trained model.

9. What Developers and Website Operators Should Do

Website operators and developers also have an important role to play. Reducing the unnecessary publication of personal information can limit its exposure and help prevent future collection by third parties, including organizations that develop or operate AI systems.

Begin with a data inventory. Identify the personal information your organization holds, the systems that process it, the purposes for which it is used, and the organizations with which it is shared. This inventory should include databases, backups, logs, analytics platforms, external APIs, and AI services where relevant.

Implement deletion procedures that account for the actual architecture of your application. Removing a database record may be sufficient for one storage location, but additional actions may be needed for replicas, backups, logs, search indexes, and third-party services. Define which systems can be updated automatically and which require a separate request or manual intervention.

If your application integrates an AI model, establish clear rules for prompts, conversation histories, retrieval systems, and persistent memory. Determine whether personal data is transmitted to an external provider and whether the provider uses it for training or other purposes. Do not assume that an API request is automatically excluded from retention or model improvement without checking the applicable terms.

Finally, document your procedures and test them regularly. A deletion policy is only useful if it reflects the behavior of the actual system. When a request is completed, distinguish between actions that have been confirmed, actions that depend on third parties, and limitations that cannot currently be resolved.

Recommended Practices for Developers:

• Maintain an inventory of personal data and the systems that process it.
• Minimize personal information in public pages, logs, prompts, and API requests.
• Define deletion and retention procedures for databases, backups, and third-party services.
• Review the contractual and technical privacy safeguards of AI providers.
• Track data sources and model versions where AI training is part of your operations.
• Test deletion workflows and document their limitations.
• Avoid promising complete erasure when some copies or model-level effects cannot be independently verified.

10. How Where's My Data Can Help

Where's My Data is designed to help individuals take practical steps toward regaining control over their personal information. By assisting users in generating and managing deletion requests, the tool can make it easier to contact websites and organizations that hold or publish their data.

This approach remains relevant in the age of AI because information often originates from conventional websites, directories, databases, and online services. Removing personal information at its source can reduce its continued public availability and may limit future collection by systems that have not yet acquired it.

However, it is important to understand the limits of this approach. Where's My Data cannot directly remove personal information that has already been incorporated into a trained AI model. It cannot independently modify a model's parameters, retrain an external model, or guarantee that an AI provider has erased all copies of a particular person's information.

A deletion request sent to a website may also have no direct effect on copies that already exist elsewhere. Search engine indexes, archives, third-party databases, training datasets, and model parameters may each require separate procedures. Where's My Data should therefore be understood as a tool for assisting with requests to relevant organizations, not as a universal mechanism for erasing information from every AI system.

The tool can nevertheless contribute to a broader privacy strategy. By helping individuals identify where their information is available and request its removal, it can reduce unnecessary exposure at the source. This is particularly useful for websites and organizations that have not integrated AI agents or other automated systems capable of reusing personal information.

As AI adoption grows, the ability to identify data holders, submit well-structured requests, and track responses will remain important. Tools such as Where's My Data can help make these processes more accessible, while more advanced technical solutions and clearer legal requirements will be needed to address data that has already influenced trained models.

What Where's My Data Can and Cannot Do:

• Help users prepare personal data deletion requests addressed to websites and organizations.
• Help reduce the public availability of personal information by facilitating requests to remove it at its source.
• Support a broader strategy for reducing the amount of personal information available for future collection.
• Cannot directly erase information already incorporated into the parameters of an external AI model.
• Cannot guarantee that a website will accept a request or that all copies of the information will be deleted.
• Cannot replace the technical and legal procedures required to address information already used in AI training.

Further Reading and Official Resources: