The right to be forgotten doesn’t work on AI

You have a legal right to have your personal data erased. It works on databases. It largely doesn’t work on AI models — for a structural reason most people never hear.

A law built for rows

GDPR Article 17 — the “right to be forgotten” — assumes your data sits in records that can be found and deleted. A trained AI model isn’t a database. Your information is dissolved into billions of numerical weights. There’s no row marked “you,” so there’s nothing to delete in the way the law imagines.

Clearview shows the problem

Clearview AI trained facial recognition on millions of scraped photos. After a landmark settlement, victims received money and even an equity stake — but their faces stayed in the model, because they couldn’t be extracted. Money changed hands; the data didn’t leave.

Providers can stop showing certain data in responses, and stop training on you going forward. Neither reaches what a model has already learned.

What actually helps

• Use the tools that do exist: opt out of training, and file “remove from responses” requests with each provider.
• Shrink the live supply: clear the data brokers that web-connected models retrieve from.
• Shape the answer: publish and structure the authoritative record so the model’s best available source about you is the accurate one.
• Measure it: track your risk as a number so you know whether any of it is working.

The mindset shift

Stop thinking “delete me” and start thinking “manage the answer.” Erasure isn’t coming; control is achievable now.

Sources: GDPR Article 17; Clearview AI settlement; TechPolicy.Press — “The Right to Be Forgotten Is Dead.”