The Right to Be Forgotten Is Hard for AI: Why Deleting Your Data From a Model Isn’t a Delete Button

You ask a company to delete your data. In a normal system that is a database operation: find the rows that are yours, remove them, done. The mental model of “delete” that privacy law is built on — the GDPR’s right to erasure, most obviously — assumes exactly this: that your data sits somewhere as a discrete record you can locate and destroy. A trained AI model breaks that assumption. Answer first: your data isn’t stored in the model as a record at all. It is dissolved into the model’s parameters — billions of numbers, each nudged a little during training by every example it saw, yours included. There is no row labelled with your name to delete. Removing your influence means changing the numbers, and doing that cleanly is a genuine research problem, not a setting with a toggle. Where your data actually goes when a model “learns” it Training a large model is a process of adjustment. The model makes a prediction, it’s wrong, and an optimiser tweaks its parameters a fraction to make that particular kind of error slightly less likely next time. Repeat across trillions of tokens and those fractional tweaks accumulate into a system that has, in a distributed and lossy way, absorbed patterns from its training data. The key word is distributed . A single document doesn’t live in one identifiable place in the weights; its contribution is smeared across many parameters that also encode a great many other things. Two consequences follow, and they are the whole reason this is hard. First, you cannot point at the part of the model that is “you.” Second, deleting the original document from the training set does nothing to the model that already trained on it — the lesson has been learned and the textbook has been closed. The data is gone; the influence remains. Erasing your data from the training set is like removing a single lump of sugar from a cake that has already been baked. The lump is gone from the recipe. The sweetness is still in the cake. The clean fix that nobody can af