By
Stuart Kerr, Technology Correspondent, LiveAIWire

A man in Germany successfully petitioned Google in 2014 to delist
search results linking his name to a decades-old bankruptcy. The European
Court of Justice ruling that enabled that delisting established the right to
be forgotten as a legal principle in EU data protection law. It did not make
him disappear. The information remained on the original websites; it remained
in the memories of people who had read it; and it remained, somewhere, in the
training data of AI models that had ingested those web pages before the
delisting was processed. The right to be forgotten was real. The forgetting
was not.

AI has made the right to be forgotten simultaneously more
important and harder to enforce. The scale at which personal information is
ingested, processed, and reproduced by AI systems vastly exceeds anything
that earlier data protection frameworks anticipated. Understanding what the
right means in an AI context, and what genuine enforcement would require, is
one of the most practically significant questions in current data protection
law.

What the Right to Be Forgotten Actually Covers

Under GDPR Article 17, individuals have the right to request
erasure of their personal data from data controllers who hold it, subject to
conditions and exceptions. In practice, the right most commonly applies to
search engine delisting, the removal of personal information from websites,
and the deletion of records from databases. Data controllers who receive a
valid erasure request must delete the specified data and, where it has been
shared with processors, instruct those processors to delete it
too.

The AI complication arises at the training data stage. When a
personal data point is included in the training dataset for an AI model, it
influences the model’s parameters in a distributed way that is not easily
reversible. The data point is not stored as a discrete record that can be
deleted; its influence is encoded in billions of model parameters in ways
that cannot be cleanly disentangled. Deleting the original training record
does not remove the model’s learned associations, vocabulary, or the implicit
knowledge it acquired from processing the deleted data.

Research from the UK
Information Commissioner’s Office has acknowledged this challenge
directly, noting that the application of erasure rights to AI models requires
technical approaches that do not yet have established regulatory precedent.
The ICO has called for the development of machine unlearning techniques that
can remove specific data influences from trained models without requiring
complete retraining.

Machine Unlearning: The Technical State of Play

Machine unlearning — the process of modifying a trained model to
remove the influence of specific training data points — is an active area of
research that has produced promising results in controlled settings. The core
challenge is that neural networks do not store training data in retrievable
form; they transform it into distributed parameter adjustments during
training. Removing the influence of a specific data point requires either
identifying and reversing all the parameter adjustments attributable to that
point, or retraining the model from scratch on a dataset that excludes the
data in question.

Full retraining is computationally prohibitive at the scale of
frontier AI models, where a single training run costs tens of millions of
dollars. Approximate unlearning methods have been developed that can reduce
the model’s association with specific data without full retraining, but the verification
of whether those methods have actually removed the influence — rather than
merely obscuring it — remains technically difficult. A model that has been
told to forget a specific person may still reveal associations with that
person when appropriately prompted.

What this means for anyone who has submitted a right to erasure
request to an AI company: the legal obligation to process your request may be
met through documentation and process rather than through verified technical
removal of your data’s influence from AI systems. The gap between the right
as written and the right as enforced is significant and is not consistently
disclosed to individuals who invoke it.

Generative AI and Personal Data Reproduction

Large language models and image generation systems can reproduce
personal information in ways that create fresh privacy violations beyond the
training data question. A language model that has processed news articles,
court records, or social media content during training may generate text that
accurately describes private information about identifiable individuals —
not because it has retrieved a stored record, but because the training process
has encoded associations that the model can reconstruct from appropriate
prompts.

This reproductive capability creates a category of privacy harm
that existing frameworks do not cleanly address. The original data may have
been lawfully published; the training may have been conducted in compliance
with applicable law at the time; the generation may appear to be the model’s
own output rather than a reproduction of a specific record. But the result —
accurate private information about an identifiable individual generated on
demand — is a privacy harm that the subject has a legitimate interest in
preventing.

Several European data protection authorities have issued guidance
and enforcement decisions addressing AI data reproduction. The Italian Data
Protection Authority’s 2023 temporary ban on ChatGPT, later lifted after
OpenAI provided additional information about its data practices, represented
the first major regulatory action specifically targeting a large language
model for data protection non-compliance. The action established that AI
systems are subject to GDPR even when their data handling does not fit neatly
into categories the regulation was designed for.

The Right Across Borders

The right to be forgotten is a European legal concept that applies
to data controllers operating in or directing services at EU residents. Its
application to AI systems trained globally and accessed globally is
complicated by jurisdictional questions that have not been fully resolved. A
US-based AI company that processes EU residents’ data in training its models
is subject to GDPR; the enforcement of that obligation against a company whose
primary operations and assets are outside the EU is practically
challenging.

Outside the EU, the right to be forgotten has no direct equivalent
in most jurisdictions, though privacy law frameworks in California, Brazil,
and several other jurisdictions provide related but narrower rights. The
global patchwork of privacy law means that a person whose information appears
in AI training data may have strong legal rights in one jurisdiction and none
in another, with the enforceability of those rights depending on where the AI
company is incorporated and where its infrastructure is
located.

The broader
challenge of applying legal frameworks designed for an earlier technological
environment to AI systems applies acutely here. The right to be
forgotten was a meaningful innovation in 2014; its application to AI in 2025
requires technical and legal development that the decade between those dates
has only partially supplied. The question
of data rights and posthumous digital identity is a close cousin:
in both cases, the law provides a right whose technical enforcement is
significantly more complex than the right itself
acknowledges.

What Genuine Enforcement Would Require

Genuine enforcement of the right to be forgotten in AI contexts
would require, at minimum: technical standards for machine unlearning that
can be independently verified; disclosure requirements for the personal data
included in AI training datasets; audit mechanisms that allow data protection
authorities to assess whether erasure requests have been technically
fulfilled; and liability frameworks that assign responsibility when AI
systems reproduce information that subjects have successfully requested to be
erased.

None of these are currently in place at sufficient maturity or
scale. The right exists; the infrastructure to enforce it does not. That gap
will widen as AI systems become more powerful and more pervasive, unless the
technical and regulatory development required to close it is treated with the
urgency that the scale of the privacy interest at stake
demands.

The right to be forgotten in an AI context ultimately requires a
conversation about what erasure means when information does not exist as a
discrete record but as a distributed influence across a complex system. The
legal concept maps poorly onto the technical reality, and closing that gap
requires either technical innovation in machine unlearning or a
reconceptualisation of what data rights mean for AI systems. Neither is
simple, and neither is happening quickly enough relative to the pace at which
personal data is being incorporated into AI training. The individuals whose
data is at stake deserve more than a legal right whose technical enforcement
infrastructure does not yet exist. The
broader accountability gap in AI systems that make consequential
decisions using personal data is directly relevant: transparency and erasure
rights are two dimensions of the same underlying challenge of giving
individuals meaningful control over how their data is used in systems they
cannot observe. The external reference for this section is the European
Data Protection Board guidelines on the right to erasure, which
address the technical complexity of erasure in automated decision-making
systems.

About the Author

Stuart Kerr
is a technology correspondent at LiveAIWire, covering artificial
intelligence, emerging technologies, and their impact on society and
industry.