Short answer: no, not on its own. Deleting a row removes it from the table you queried. It does nothing to the weights a model adjusted while training on that row, the copy cached inside a vector store, or the backup that has not cycled yet. A record can disappear from the one place you checked and still sit, recoverable, in two or three places you didn't look.
That gap between deleted from the database and gone from the system is the reason erasure audits exist at all. What follows is what actually happens to a record after someone hits delete, in the order it tends to survive: inside the model's weights, inside the retrieval layer sitting in front of the model, inside the backups behind both, and inside the enforcement record regulators are now building around all three.
Why doesn't deleting the source record erase what the model learned from it?
Training does not copy a row into a model the way a database copies a row into a table. It nudges millions of weights a small amount in the row's direction, and no single weight holds one person's record on its own. Delete the row and the weights stay exactly where training left them, because nothing in the model points back to the row that moved them.
This is not a text-only problem. In January 2023, researchers extracted over a hundred near-identical replicas of training images, including photographs of identifiable people and trademarked logos, directly from the weights of Stable Diffusion and Google's Imagen, with no access to the original training set. If an image model memorizes and reproduces specific training photos, a language model trained the same way should be assumed to do the same with specific training text.
Has anyone pulled deleted-style data back out of a model people already use?
Yes, and not against a research toy. Researchers have run the technique against systems already shipping to paying customers, and getting the data out costs very little money and no special access, just a carefully built prompt.
In July 2024, researchers at SPY Lab fine-tuned GPT-4 on a slice of text and then prompted it directly. The model reproduced at least 50 tokens verbatim from more than 60 percent of the New York Times articles named in the newspaper's lawsuit against OpenAI, for about three dollars in API calls. That number matters because fine-tuning on your own data is a routine step many companies run, not an exotic attack. Our companion explainer on what machine unlearning actually removes, at /blog/what-is-machine-unlearning, covers the production-scale extraction work this result builds on.
What about the chat logs and vector database sitting in front of the model?
The model is not the only place a deleted record hides. Chat history and retrieval indexes both keep their own copies on their own schedule, and that schedule usually outlives what the delete button implies.
Google's own help documentation states that Gemini conversations selected for human review are not deleted when a user deletes their activity. Those reviewed conversations are retained for up to three years regardless of what the user does on their end. Anthropic's policy is shorter by default: prompts and outputs submitted to its models are retained for 30 days to support safety review, even after a user deletes the conversation.
Vector databases show the same problem in a more mechanical form. A user of the open-source database Chroma filed a bug in February 2025 after deleting 26 of 31 documents and watching the database grow instead of shrink, from 0.73MB to 0.80MB. The deleted text and embeddings were still sitting in an internal queue table, waiting on a cleanup pass that had not run.
Do backups just quietly keep the copy anyway?
Almost always, on a timeline most users never see. A delete request clears the record from production, then waits on the backup rotation to catch up.
Google Cloud's own deletion documentation describes a staged process: data is marked for deletion within 24 hours, purged from active systems within roughly two months through routine garbage collection, and the backup cycle is designed to expire the same record from data center backups within 180 days of the original request. That is Google's own stated ceiling, not a worst case pulled from a leak.
Do regulators already treat the model itself as the thing that needs deleting?
Yes. The US Federal Trade Commission has built a five-year track record on exactly that idea, ordering companies not just to delete improperly collected data but to destroy any model or algorithm trained on it.
The pattern started with Cambridge Analytica in 2019, whose order required deletion of any algorithm that originated from the improperly obtained Facebook data. It continued with Everalbum in January 2021, ordered to destroy facial recognition models built without consent within 90 days, and with WW International's Kurbo app in March 2022, which paid a $1.5 million penalty and had to destroy any algorithm derived from children's data. Rite Aid followed in December 2023, ordered to delete or destroy any data, models, or algorithms or other products derived from years of misused facial recognition images, and to make any third party it worked with do the same.
European regulators have gone after the model itself too, with mixed staying power. Italy's data protection authority fined OpenAI 15 million euros in a decision dated November 2024 and announced that December, over how ChatGPT's training data was collected and disclosed. A Rome court annulled that fine in March 2026, but on jurisdictional grounds, because Ireland had already become OpenAI's lead EU regulator by the time Italy acted, not because the underlying facts were wrong. A separate fine against Replika's parent company held up: 5 million euros, decided in April 2025, for data protection failures the regulator tied directly to how the chatbot itself was built and run.
Turkey's KVKK has not yet issued an equivalent decision naming a specific AI model, but it published dedicated guidance on generative AI and personal data processing in November 2025, the clearest sign yet that the same question is now on its own agenda.
So does deleting data ever actually make an AI system forget?
Sometimes, but only when someone tests the live surface afterward. Assuming the deletion routine worked is not the same thing as checking it. A model, a retrieval index, and a set of backups are three separate systems with three separate memories, and clearing one does not clear the other two.
This is the audit ZeroRecall runs. After a company deletes someone's data, we plant canaries and adversarial prompts against the chatbot, the retrieval layer, and the vector store, then report exactly what still comes out. Every result is scoped to the behavior observed on the listed surfaces at the stated date, because that is what the evidence supports, not a promise that the data is gone from every weight forever. Check the published price at /pricing, see how the audit runs at /#how, or verify a real evidence file yourself at /verify.
Sources
Every number above maps to a live source. Check them yourself.
- ·100+ near-identical training images extracted from Stable Diffusion and Imagen weights (the paper's 1,000+ figure covers all models studied, not these two): Carlini et al., Extracting Training Data from Diffusion Models, 2023. https://arxiv.org/abs/2301.13188
- ·Fine-tuned GPT-4 reproduced 50+ tokens from over 60% of named NYT articles for about $3: Rando and Tramer, SPY Lab, Extracting (Even More) Training Data From Production Language Models, 2024. https://spylab.ai/blog/training-data-extraction/
- ·Gemini reviewed conversations retained up to 3 years after activity deletion: Google, Gemini Apps privacy help. https://support.google.com/gemini/answer/13594961
- ·Claude prompts/outputs retained 30 days for safety review: Anthropic, Data retention practices for Covered Models. https://support.claude.com/en/articles/15425996-data-retention-practices-for-covered-models
- ·Chroma deleted-document persistence bug (26/31 docs deleted, database grew 0.73MB to 0.80MB): chroma-core/chroma, GitHub issue #3793, 2025. https://github.com/chroma-core/chroma/issues/3793
- ·Google Cloud backup deletion ceiling of 180 days: Google Cloud, Data deletion documentation. https://docs.cloud.google.com/docs/security/deletion
- ·FTC v. Everalbum, order to destroy facial recognition models built without consent: FTC press release, January 2021. https://www.ftc.gov/news-events/news/press-releases/2021/01/california-company-settles-ftc-allegations-it-deceived-consumers-about-use-facial-recognition-photo
- ·FTC v. WW International and Kurbo, $1.5 million penalty and algorithm destruction: FTC press release, March 2022. https://www.ftc.gov/news-events/news/press-releases/2022/03/ftc-takes-action-against-company-formerly-known-weight-watchers-illegally-collecting-kids-sensitive
- ·FTC v. Rite Aid, order to delete data, models, or algorithms derived from facial recognition images: FTC press release, December 2023. https://www.ftc.gov/news-events/news/press-releases/2023/12/rite-aid-banned-using-ai-facial-recognition-after-ftc-says-retailer-deployed-technology-without
- ·Garante decision against OpenAI (15 million euros) and its 2026 annulment on jurisdictional grounds: Garante per la Protezione dei Dati Personali, decision. https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10085432 ; annulment reporting: ppc.land, Italian court kills OpenAI's EUR15M fine, 2026. https://ppc.land/italian-court-kills-openais-eur15m-fine-and-it-wasnt-even-close/
- ·Garante decision against Replika/Luka Inc. (5 million euros), April 2025: EDPB national news. https://www.edpb.europa.eu/news/national-news/2025/ai-italian-supervisory-authority-fines-company-behind-chatbot-replika_en
- ·KVKK guidance on generative AI and personal data, November 2025: KVKK, Uretken Yapay Zeka ve Kisisel Verilerin Korunmasi Rehberi. https://www.kvkk.gov.tr/Icerik/8547/uretken-yapay-zeka-ve-kisisel-verilerin-korunmasi-rehberi-15-soruda