The right to be forgotten meets a model that cannot forget

European law gives you the right to have your personal data deleted. A trained language model has no mechanism for forgetting anything.

Those two facts have been on a collision course since 2022, and 2026 is the year the collision is being scheduled rather than avoided.

Why the right to be forgotten is hard for AI

Most GDPR obligations map onto AI systems awkwardly but workably. You can document a legal basis, publish a privacy notice, and honour access requests against your logs.

Erasure is different because the data isn’t stored anywhere you can point at. It’s distributed across billions of weights as statistical influence, and there’s no row to delete.

A database can forget. A model can only be retrained, and retraining a frontier model to remove one person’s data is not a remedy anyone will grant.

The question of whether that makes large models incompatible with the regulation is being asked openly now, including in a March 2026 discussion with the Future of Privacy Forum’s chief executive on scraping and the erasure right.

Models do retain personal data

A convenient defence would be that models learn patterns rather than records, so nothing personal survives training. The research says otherwise.

Carlini and colleagues demonstrated in Extracting Training Data from Large Language Models that an adversary can recover verbatim sequences from training data, including “personally identifiable information (names, phone numbers, and email addresses)”.

Later work established that it scales. Quantifying Memorization Across Neural Language Models found memorisation grows with model capacity, with data duplication, and with the amount of context used to prompt it.

All three of those trends point the wrong way. Models are getting larger, corpora contain more duplicates, and context windows keep growing, so the extraction surface expands as capability improves.

A survey of privacy issues in large language models collects the broader picture, and the practical conclusion for anyone building is to treat training data as potentially identifiable unless you can show it isn’t.

Enforcement has already started

This stopped being theoretical when a regulator issued a fine rather than an opinion.

Italy’s data protection authority fined OpenAI €15 million in November 2024 over GDPR violations, and required a six-month public information campaign telling users what was collected and how to object, erase or rectify it.

The remedy is as instructive as the penalty. Ordering a company to explain rights it had obscured suggests the regulator saw a transparency failure at least as serious as the underlying processing.

Regulators are now examining training data lawfulness and legitimate-interest assessments directly, with processing without adequate legal basis identified as the primary emerging risk in 2026 compliance guidance.

Two regimes now apply at once

	GDPR	EU AI Act
Protects	Individuals’ personal data	Safety, rights, transparency
Triggered by	Processing personal data	Placing an AI system on the market
Key duty here	Legal basis, erasure, accuracy	Data governance, documentation, marking output
In force	Since 2018	Most obligations from 2 August 2026

From 2 August 2026 the AI Act became fully applicable for most obligations, including data governance, risk management, technical documentation and transparency for systems that interact with people or generate content, per an overview aimed at model providers.

The transparency half of that produced visible change within days, with Anthropic watermarking Claude output worldwide, and our explainer covers the Act’s full scope.

The data governance half is quieter and harder. It asks providers to account for what went into training, which is exactly the question the copyright cases are also asking from a different direction.

What the right to be forgotten means if you deploy a model

Most organisations reading this aren’t training frontier models, and the obligations still reach them.

Anything a user types into your chatbot is processing you’re responsible for. That needs a legal basis, a retention period, and a deletion process that actually works, with 30 days a commonly cited target in chatbot compliance guidance.

Check whether your provider trains on your inputs, because default settings vary and the enterprise tier often differs from the consumer one. That single setting decides whether customer data can end up in someone else’s model.

Accuracy is the obligation people forget. GDPR requires personal data to be accurate, and a model that states something false about a named individual is processing inaccurate personal data, with a corresponding right to rectification.

That one is genuinely awkward, because there’s no reliable way to correct a fact encoded in weights. It’s the erasure problem again in a form that arrives more often, since models invent details about people routinely.

Retrieval architectures help here in a way that’s easy to miss. Keeping facts in an index rather than in weights means deletion is a database operation again, which our guide to vector stores covers on the technical side.

The argument that the rules do not fit

There’s a serious position holding that GDPR was written for databases and applying it literally to models produces absurd results.

On a strict reading, a person’s name appearing in a training corpus creates an erasure right that can only be honoured by retraining, which costs millions and helps that person very little.

The proposed fix is usually output-level: filter the model so it won’t produce that person’s data, rather than removing the influence from the weights. Regulators have not endorsed this, and it’s the compromise most of the industry is quietly building toward.

The counter-argument is straightforward. A right that only applies when compliance is convenient is not a right, and the difficulty was created by a deliberate choice to train on scraped personal data.

What to watch

The decision that matters is the first one ruling on whether output filtering satisfies erasure. That single question determines whether the current industry approach is compliance or theatre.

Watch machine unlearning research too, since a technique that reliably removes specific data from trained weights would dissolve the conflict entirely. Nothing available today does that at frontier scale, and practical guidance currently assumes it won’t for a while.

Training data is under scrutiny from a second direction at the same time, and our piece on what the copyright rulings turn on covers how courts are asking a version of the same provenance question.

And watch enforcement volume rather than headline fines. One €15 million penalty is a warning; a regular cadence of them changes how models get built, and none of the above is legal advice.