← blog
2 August 2026 · 8 min read

The right to be forgotten and AI chatbots

Short answer: yes, the right to be forgotten reaches AI chatbots, and honoring it is harder than deleting a database row. GDPR Article 17 lets a person demand erasure of their personal data. A chatbot can still surface that data from its training, its retrieval layer, or retained logs, so the request is not met until the live surface stops returning it.

The gap sits between two different acts. Deleting a record is a database operation. Making a chatbot forget a person is a claim about behavior across the model, the retrieval index feeding it, and every log and backup behind both. This piece walks through what the right actually requires, where regulators have landed on whether it covers chatbot output at all, and why a deletion you filed can still leak long after you filed it.

What does the right to be forgotten actually require?

It requires a controller to erase a person's personal data without undue delay once there is no lawful reason to keep it. The right is not new to AI. It was established in 2014, when the EU's top court ordered a search engine to remove links to outdated personal information on request.

GDPR Article 17 sets out this right to erasure, also called the right to be forgotten, and lists the grounds that trigger it, including withdrawn consent and data that is no longer necessary. Its origin is the Court of Justice of the European Union's May 2014 ruling in Google Spain v. AEPD, case C-131/12, which held that a search engine operator is a data controller and must, on request, remove links to pages carrying a person's name when the results are inadequate, irrelevant, or no longer relevant. Article 17 also reaches outward: a controller that made the data public has to take reasonable steps to tell other controllers that the person wants copies and links erased.

Does the right to be forgotten apply to what a chatbot says about you?

European regulators say it can. The output a chatbot produces about a named person is personal data, and processing it engages data-protection law. There is a live disagreement over whether the model itself stores personal data, but even the narrower view accepts that erasure and rectification rights attach to a chatbot's inputs and outputs.

In December 2024 the European Data Protection Board adopted Opinion 28/2024, which concluded that AI models trained on personal data cannot, in every case, be treated as anonymous. For a model to count as anonymous, the board said, both the chance of extracting training data about a person and the chance of the model returning it in response to a query must be insignificant. Germany's Hamburg data protection authority took the opposite starting point in a July 2024 discussion paper, arguing that storing a large language model is not itself processing because no personal data sits inside the model. Even that paper concedes the practical point: claims for access, erasure, or rectification can attach to the input and output of the system built on the model. Both roads lead to the same place for a person filing a request. The chatbot's answers about them are in scope.

Can a chatbot correct or delete false information about a person on request?

Often it cannot, and the provider may admit as much. A chatbot can invent specific, damaging claims about a real person, and the vendor has no reliable way to reach into the model and edit that one output. A right-to-erasure request meets a system that was not built to erase a single fact.

In April 2024 the privacy group noyb filed a complaint against OpenAI with the Austrian data protection authority, centered on ChatGPT returning an incorrect date of birth for a public figure. noyb's core point was that OpenAI said it could not correct the wrong information, only filter the name out of some answers, which the group argued fails the accuracy requirement of Article 5. The stakes got sharper in March 2025, when noyb filed a second complaint in Norway for Arve Hjalmar Holmen, after ChatGPT described him as a convicted murderer who had killed two of his children. The output stitched a fabricated crime onto real details, his home town and the number and gender of his children, which is the pattern that makes a chatbot hallucination hard to simply delete.

If someone deletes their chats, is the data actually gone?

Not always. Vendor retention policies keep copies on their own timeline, and a court can freeze deletion outright. A user pressing delete clears the view they control. Behind it, reviewed conversations, safety logs, and litigation holds can keep the same content alive for months or years.

Google's Gemini help pages state that conversations selected for human review are not deleted when a user deletes their activity, and are retained for up to three years. Anthropic keeps prompts and outputs from its models for 30 days to support safety work, and longer if its systems flag the content. Retention can also be forced from outside the company: in May 2025 a federal magistrate judge in the New York Times lawsuit against OpenAI ordered the company to preserve output log data it would normally delete, including deleted chats, a hold that stayed in place until it was lifted in late September 2025. For the months it applied, a user's right to erasure ran straight into a court order to keep everything.

Why can't the underlying model just forget the data it was trained on?

Because deleting the source record does not move the weights it helped shape, and the data can be pulled back out. Researchers have made production chatbots emit memorized training text, and retrieval stores often keep a deleted document until a later cleanup runs. The data outlives the delete.

In late 2023, researchers published a divergence attack that pushed ChatGPT out of its normal chat style and made it emit memorized training data at around 150 times its usual rate. That is a chatbot returning text that no longer exists in any database you can query. The retrieval layer many chatbots depend on has its own version of the problem. When a user of the vector database Chroma deleted 26 of 31 stored documents in early 2025, the database file grew rather than shrank, from 0.73MB to 0.80MB, because the deleted text and embeddings were still parked in an internal queue. Our explainer on machine unlearning, at /blog/what-is-machine-unlearning, goes deeper on why suppressing an answer is not the same as removing the knowledge.

What are the penalties for a chatbot that keeps surfacing data someone asked you to erase?

They scale with revenue, and enforcement has already started. GDPR fines reach 20 million euros or 4 percent of global annual turnover. Turkey's KVKK requires deletion, destruction, or anonymization on request, and regulators on both sides have opened or closed AI cases that turn on exactly this question.

GDPR Article 83 sets the ceiling at 20 million euros or 4 percent of worldwide annual turnover, whichever is higher. Enforcement against chatbots is not hypothetical. Italy's data protection authority banned ChatGPT briefly in 2023 and later fined OpenAI 15 million euros in December 2024 over how it handled users' data, a fine a Rome court then annulled on jurisdictional grounds rather than on the facts. Our companion piece on what deletion does not reach, at /blog/does-deleting-data-remove-it-from-ai-models, tracks that enforcement history in full. Turkey's KVKK carries its own erasure duty under Article 7 of Law 6698, with 2026 administrative fines for data-security failures reaching roughly 17.1 million Turkish lira per violation, and in February 2026 it opened an investigation into the Grok assistant over unlawful content. In November 2025 it published dedicated guidance on generative AI and personal data, a sign the same erasure question is now on its agenda.

So how do you prove a chatbot has actually forgotten someone?

You test the surface a user touches, after the deletion, not the deletion routine itself. Plant known markers before erasure, then probe the chatbot, its retrieval layer, and its vector store with direct and adversarial prompts, and record what still comes back. The proof is evidence, not a promise.

This is the audit ZeroRecall runs. After you delete a person's data, we probe your AI surfaces with planted canaries and adversarial prompts, then produce a FORGET score and a hash-chained, ECDSA-signed evidence file that anyone can verify without trusting us. Every finding is scoped to the behavior observed on the listed surfaces at the stated date, because that is what the evidence supports, not a claim that the data is gone from every weight forever. You can verify a real evidence file at /verify, see how the audit works at /#how, or check the published price at /pricing.

Sources

Every number above maps to a live source. Check them yourself.

  • ·Right to erasure, without undue delay, and the duty to inform other controllers: GDPR Article 17. https://gdpr-info.eu/art-17-gdpr/
  • ·Origin of the right to be forgotten, search engine as controller: CJEU, Google Spain SL v. AEPD and Mario Costeja Gonzalez, Case C-131/12, 13 May 2014. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0131
  • ·AI models trained on personal data cannot in all cases be considered anonymous: European Data Protection Board, Opinion 28/2024, adopted 17 December 2024. https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf
  • ·Storing an LLM is not itself processing, but access/erasure/rectification attach to input and output: Hamburg Commissioner for Data Protection, Discussion Paper on Large Language Models and Personal Data, July 2024. https://datenschutz-hamburg.de/fileadmin/user_upload/HmbBfDI/Datenschutz/Informationen/240715_Discussion_Paper_Hamburg_DPA_KI_Models.pdf
  • ·OpenAI says it cannot correct false information ChatGPT produces about a person: noyb complaint against OpenAI, 29 April 2024. https://noyb.eu/en/chatgpt-provides-false-information-about-people-and-openai-cant-correct-it
  • ·ChatGPT falsely described a named man as a convicted child murderer: noyb complaint (Arve Hjalmar Holmen), Norway, March 2025. https://noyb.eu/en/ai-hallucinations-chatgpt-created-fake-child-murderer
  • ·Gemini human-reviewed conversations retained up to 3 years after activity deletion: Google, Gemini Apps privacy help. https://support.google.com/gemini/answer/13594961
  • ·Claude prompts and outputs retained 30 days for safety review: Anthropic, Data retention practices for Covered Models. https://support.claude.com/en/articles/15425996-data-retention-practices-for-covered-models
  • ·May 2025 order requiring OpenAI to preserve output logs it would otherwise delete, lifted late September 2025: NYT v. OpenAI preservation order, S.D.N.Y., 13 May 2025. https://cdn.arstechnica.net/wp-content/uploads/2025/06/NYT-v-OpenAI-Preservation-Order-5-13-25.pdf ; reporting: VentureBeat, 2025. https://venturebeat.com/ai/sam-altman-calls-for-ai-privilege-as-openai-clarifies-court-order-to-retain-temporary-and-deleted-chatgpt-sessions
  • ·ChatGPT made to emit memorized training data at ~150x its normal rate: Nasr et al., Scalable Extraction of Training Data from Production Language Models, 2023. https://arxiv.org/abs/2311.17035
  • ·Chroma deleted-document persistence bug (26/31 docs deleted, database grew 0.73MB to 0.80MB): chroma-core/chroma, GitHub issue #3793, 2025. https://github.com/chroma-core/chroma/issues/3793
  • ·Fines up to 20 million euros or 4% of worldwide annual turnover: GDPR Article 83. https://gdpr-info.eu/art-83-gdpr/
  • ·Garante fine of 15 million euros against OpenAI, December 2024: Garante per la Protezione dei Dati Personali press release. https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10085432 ; later annulled on jurisdictional grounds: ppc.land, 2026. https://ppc.land/italian-court-kills-openais-eur15m-fine-and-it-wasnt-even-close/
  • ·Deletion, destruction, or anonymization on request: KVKK Law 6698, Article 7. https://www.kvkk.gov.tr/Icerik/6649/Personal-Data-Protection-Law
  • ·2026 KVKK administrative fine amounts (data-security ceiling ~17.1 million TRY): KVKK, 6698 sayili Kanundaki idari para cezalari. https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/MTY5NTUyNTRkNDkxNGY.pdf
  • ·Investigation opened into the Grok AI assistant, February 2026: KVKK public announcement. https://www.kvkk.gov.tr/Icerik/8614/grok-yapay-zeka-asistani-hakkinda-kamuoyu-duyurusu
  • ·Guidance on generative AI and personal data, November 2025: KVKK, Uretken Yapay Zeka ve Kisisel Verilerin Korunmasi Rehberi. https://www.kvkk.gov.tr/Icerik/8547/uretken-yapay-zeka-ve-kisisel-verilerin-korunmasi-rehberi-15-soruda
Check something yourself

Someone probably sent you a claim about deletion. Put it on the Proof Ladder and see what rung it reaches. It is free, takes no email and stores nothing. The Proof Registry already places every published artifact we could find in this market on the same scale, ours included, and it names the one rung where a competitor is ahead of us.

If you would rather look at ours first, verify a real evidence file or read the published number.