AI Data Deletion Request (Right-to-Delete / Right-to-Erasure)

What Is AI Data Deletion Request (Right-to-Delete / Right-to-Erasure)?

An AI data deletion request is a written demand that an artificial intelligence company erase the personal data it holds about you, including data already absorbed into its trained models. It is the AI-era version of two older privacy rights: the GDPR's right to erasure and the CCPA's right to delete. What makes it different is scope. A traditional deletion request clears your name from a customer relationship management system. An AI deletion request asks the company to go further and account for data that may now live inside a model's weights, training corpus, fine-tuning sets, prompt logs, and embeddings.

The request identifies you precisely enough that the company can locate your records, then states the legal basis that obligates the company to act. That basis is usually GDPR Article 17 if you are in the EU or the UK, the California Consumer Privacy Act if you are a California resident, or one of the dozen-plus other US state privacy laws that now mirror those rights. A well-drafted request names the statute, the response deadline, and the specific categories of data you want gone.

This is not a polite opt-out email. Opting out of future training (clicking a toggle in a privacy dashboard) only stops new collection. A deletion request reaches backward at data the company already has. The two are often confused, and companies sometimes answer a deletion demand by pointing you to an opt-out toggle. That is not compliance, and the distinction matters when you escalate to a regulator.

Why This Matters Now

The legal floor moved in 2025. California AB 1008 took effect January 1, 2025, and was the first US law to say in plain terms that 'personal information' under the CCPA includes data that exists inside an AI system, naming model weights and tokens. Before AB 1008, a company could plausibly argue that once your data was statistically blended into a model, it was no longer 'your' personal information. That argument is now much weaker in California, and the rest of the country tends to follow California on privacy.

Enforcement infrastructure that did not exist two years ago is now live. The California Privacy Protection Agency announced in November 2025 that its DROP platform opened to consumers, and the DELETE Act's data-broker obligations switch on August 1, 2026. The European Data Protection Board ran a coordinated enforcement action on the right to erasure across member states and adopted its Erasure Report on February 10, 2026. Regulators are actively measuring whether companies actually delete data when asked.

The OpenAI litigation showed how fragile your deletion rights can be in practice. On May 13, 2025, a federal magistrate judge ordered OpenAI to preserve ChatGPT user logs, including conversations users had deleted, because of the New York Times copyright case. That order stood until October 9, 2025, when the same judge lifted it and allowed deletion to resume. For roughly five months, 'delete' did not mean delete, and most users never knew. A formal written request creates a paper trail that matters if your data is later mishandled.

AI providers have quietly conceded the technical limit. OpenAI, Google, and others now acknowledge in their own help documentation that the only way to completely remove an individual's data from a trained model is to retrain it from scratch, which is prohibitively expensive and almost never done for one person. That concession is exactly why a written request, with a named statute and a deadline, gives you leverage you would not have from a support ticket.

The Legal Backbone

What an AI data deletion request should contain

Start with unambiguous identification. A company cannot delete what it cannot find, and it is entitled to verify that you are who you say you are before erasing records, since a deletion request from an impostor is itself a privacy attack. Give your full legal name, any aliases or maiden names the company might have on file, the email addresses and phone numbers you used with the service, account usernames, and approximate dates of use. If you signed up under a work email three years ago and a personal one last year, list both. The more precise your identifiers, the harder it is for the company to claim it could not locate your data.

State your jurisdiction and the legal basis in the same breath. The recipient's obligations differ depending on where you live. If you are a California resident, say so and cite Civil Code section 1798.105. If you are in the EU or the UK, invoke GDPR Article 17 and, where it fits, name the specific ground (for example, 'I withdraw my consent and you have no other lawful basis'). If you live in a state with its own privacy law, such as Colorado, Connecticut, Texas, Virginia, or Oregon, name that statute. A request that names the right law signals you know the rules and shortens the company's room to deflect.

Define the data you want erased, broadly but concretely. Ask for deletion of the personal data the company collected from you and, critically, ask it to address that data wherever it now lives: in production databases, backups, logs, analytics systems, and AI training datasets, fine-tuning sets, embeddings, and model weights. The AB 1008 language about data 'in the form of' an AI system is what makes the model-level ask legitimate in California. Even where you cannot force full retraining, putting the request in writing forces the company to document its position, which is what you want if you later complain to a regulator.

Demand a written response with specifics. Ask the company to confirm in writing what it deleted, what it retained, and the legal exception it relies on for anything retained. A bare 'your request has been processed' is not enough to evaluate compliance. Set the statutory deadline explicitly: 45 days for the CCPA, one month for GDPR. Ask the company to instruct its service providers, processors, and any downstream recipients of your data to delete it too, which both the CCPA and GDPR Article 17(2) contemplate.

Anticipate the lawful refusals. The company may keep data it needs to complete a transaction you asked for, to comply with a legal obligation, to detect and prevent fraud and security incidents, or to establish or defend a legal claim. Expect the response to invoke one or more of these grounds; the statutes draw all of them narrowly. A company cannot retain your entire profile because one field is subject to a legal hold. If a refusal looks broader than the exception it cites, that is your cue to push back or escalate. Keep your own copy of the request and every reply, with dates.

When You Need This

You stopped using an AI product (a chatbot, a voice assistant, a photo app) and want your account history, prompts, uploads, and any model-training contribution erased.

You discovered that a company scraped or licensed content containing your personal data, your face, your voice, or your writing, and used it to train a model without your permission.

You are a California resident and want to use the new DROP platform to clear yourself from hundreds of data brokers at once, or you want to send a parallel direct request to a specific AI provider.

You are in the EU or UK and want to exercise your GDPR Article 17 right to erasure against an AI company, including a demand that it address data embedded in its models.

A data breach exposed information you gave to an AI service, and you want everything the company holds about you deleted to limit further exposure.

You withdrew consent to processing and want to confirm the company actually removed your data rather than merely toggling off future collection.

You are a parent removing a child's data from an AI service, where children's-privacy rules and the CCPA's heightened protections give you a stronger hand.

You are documenting a paper trail before filing a complaint with a regulator (the California Privacy Protection Agency, a EU data protection authority, or the FTC) and need a formal, dated request on the record.

How to Fill Out AI Data Deletion Request (Right-to-Delete / Right-to-Erasure)

1. 1. Identify every place your data might live

   List the AI products and companies you have used or that you believe hold your data: chatbots, voice assistants, image generators, the data brokers that feed them, and any service that may have scraped your public content. Note your account identifiers for each. If you cannot tell whether a model was trained on your data, send the request anyway; the company then has to work out what it holds and answer you within the statutory window.

2. 2. Confirm which law applies to you

   Pin down your jurisdiction. California residents use Civil Code section 1798.105 and, for brokers, the DROP platform. EU and UK residents use GDPR Article 17. Residents of other US states with comprehensive privacy laws cite their own statute. If more than one applies, cite all of them; companies operating in multiple regions must honor the strongest right that reaches you.

3. 3. Gather your verification details

   Collect the identifiers the company will need to locate and verify your records: full legal name, prior names, all email addresses and phone numbers tied to the account, usernames, and rough dates of use. Expect a verification step. Companies are required to confirm your identity before deleting, and a sloppy request invites a 'we could not verify you' brush-off.

4. 4. Draft the request with statute, scope, and deadline

   Write the demand. Name the controlling statute, state that you are exercising your right to delete or erase, and define the data: account data, prompt and conversation logs, uploads, analytics, backups, and AI training datasets, fine-tuning sets, embeddings, and model weights. Set the deadline (45 days for CCPA, one month for GDPR) and ask for a written accounting of what was deleted and what was retained.

5. 5. Demand downstream and processor deletion

   Add an explicit instruction that the company direct its service providers, processors, contractors, and any third parties it shared your data with to delete it as well. The CCPA requires the business to pass the request along, and GDPR Article 17(2) requires controllers who made data public to take reasonable steps to inform other controllers. Spelling this out closes the gap where data simply migrates to a partner.

6. 6. Submit through the right channel and time-stamp it

   Send the request to the company's designated privacy contact, data protection officer, or privacy portal, not a general support inbox. California residents can also submit through DROP for registered brokers. Use a method that produces a dated record: a portal confirmation, a tracked email, or certified mail for high-stakes matters. Save the confirmation.

7. 7. Track the deadline and evaluate the response

   Calendar the deadline. When the company responds, read it against the exceptions. A 'we retained X to comply with our legal obligation' answer can stand, provided the retention is narrow and the company names the actual obligation. A vague confirmation, an opt-out toggle offered in place of deletion, or a blanket refusal is not. If the company misses the deadline or over-retains, send a follow-up citing the specific failure.

8. 8. Escalate if the company stalls or refuses

   If the response is inadequate, escalate to the right regulator: the California Privacy Protection Agency or the California Attorney General for CCPA matters, your national data protection authority (or the lead authority) for GDPR, and the FTC where the conduct looks unfair or deceptive. Attach your dated request and the company's reply. A clean paper trail is what turns a complaint into an investigation. This page is general information, not legal advice; confirm current deadlines and your specific rights before you escalate.

Key Terms Defined

Right to erasure (right to be forgotten)

The GDPR Article 17 right of a data subject to have their personal data deleted without undue delay when one of six legal grounds applies. Often called the 'right to be forgotten,' though the regulation's formal term is erasure.

Right to delete

The parallel right under the CCPA (California Civil Code section 1798.105) and most other US state privacy laws, letting a consumer ask a business to delete the personal information it collected from them, subject to statutory exceptions.

Algorithmic disgorgement

An FTC remedy under Section 5 of the FTC Act requiring a company to destroy not only data it collected unlawfully but the models, algorithms, and products built from that data. Imposed on Rite Aid in 2023 and on Amazon's Ring and Alexa among others.

Machine unlearning

A set of techniques meant to remove the influence of specific training data from a model without retraining it from scratch. As of 2025 and 2026, ICLR research shows approximate unlearning often fails to fully erase a record's traces, and no standardized method proves complete erasure, so regulators have not accepted it as equivalent to deletion.

Model weights

The numerical parameters a model learns during training. Once your personal data shapes these weights, it is statistically embedded rather than stored as a retrievable record, which is why true removal usually requires retraining. California AB 1008 expressly brought model weights within the CCPA definition of personal information.

Data broker

A business that collects and sells personal information about consumers it has no direct relationship with. Under California's DELETE Act, registered brokers must check the DROP platform every 45 days and honor matching deletion requests starting August 1, 2026.

Related Documents

Legal Authorities & Sources

This page is grounded in primary law. The statutes and official resources below are the authorities behind the guidance above. Verify the current text of any statute before relying on it.

• Art. 17 GDPR, Right to erasure ('right to be forgotten')
• California Consumer Privacy Act (CCPA), California Department of Justice
• About DROP and the DELETE Act, privacy.ca.gov
• California Privacy Protection Agency, DROP launch announcement (Nov. 2025)
• EDPB Opinion 28/2024 on AI models and data protection
• Securiti, California AB 1008 and AI personal data
• Rite Aid FTC settlement on facial recognition, InsidePrivacy
• ICLR 2025, Machine unlearning fails to remove data influence

Frequently Asked Questions