How do you remove your data from AI?

The Erasure Gap: Why AI Can't Really Forget You

On paper, you have the right to make AI forget you. In practice, no one has figured out how to actually do it.

The law seems clear. GDPR Article 17 grants an erasure right that, per the European Data Protection Board's guidance, extends to AI models themselves — if a trained model stores your personal information or can reproduce it, that model falls under the deletion obligation. In the US, California's AB 1008, signed in September 2024, became the first state law letting consumers demand deletion from AI systems capable of outputting their personal information.

The technology, however, cannot deliver what the law promises. Once your data is absorbed into a model's parameters, it stops existing as a discrete record and becomes part of the statistical fabric of the system. GPT-4 contains an estimated 1.8 trillion parameters trained on a dataset exceeding a petabyte — there is no "delete" button for a single person's contribution to that.

Engineers acknowledge the only complete removal method is retraining the entire model from scratch, which is impractical at commercial scale. The Cloud Security Alliance is blunt about the gap: there are no proven, scalable solutions that guarantee erasure compliance for already-trained models, and no way to isolate the "impression" data left behind without full retraining.

This is why the problem is structural, not procedural:

• Deletion law assumes data is stored — AI transforms and regenerates it
• Training data is recycled continuously into pattern learning, not archived
• Emerging fixes like machine unlearning remain experimental and unverifiable
• Regulators and providers fall back on filtering outputs, not erasing inputs

As Tech Policy Press observes, the right to be forgotten was designed for an internet that stored data — not systems that digest it. The consequences are already visible: Meta has been criticized by data protection authorities because personal training data in its language models could no longer be fully deleted.

For businesses, the lesson is that prevention beats removal. The CSA recommends avoiding personal data in GenAI training sets and documenting every data source before training begins. The same logic applies at the agent level: control what your AI tools can access in the first place. SkillzBench, currently in pre-launch, is building exactly that — a free MCP connector with per-agent loadouts that let you decide which skills and tools each agent sees, plus security scanning of every skill it lists.

Until deletion becomes technically real, the honest answer to "how do you remove your data from AI?" is: mostly, you can't — you can only prevent it from being used and stop it from being shown.

What 'Removal' Really Means Today: Output Filtering and Provider Portals

You can't un-bake a cake — and right now, that's essentially the situation with AI models. Once your personal data is absorbed into a model's parameters, legal scholars note it may not be technically possible to remove the influence of that data at all, short of retraining the entire model from scratch.

Here's what providers actually do instead. Regulators have proposed — and AI companies appear to have adopted — filtering model outputs so personal data stops appearing in responses, even though the underlying data isn't truly deleted. With GPT-4 estimated at 1.8 trillion parameters trained on a dataset exceeding a petabyte, per Tech Policy Press reporting, true surgical deletion is simply not on the table.

OpenAI runs the most developed version of this process. Anyone — no ChatGPT account required — can submit a "Remove my personal data from ChatGPT responses" request through OpenAI's Privacy Portal. Requests are assessed case-by-case, balancing privacy against freedom of expression and public interest, using nine factors including your public role, the accuracy and sensitivity of the data, its impact, and whether the subject is a child.

OpenAI's official guidance spells out what makes a request succeed:

• Be specific — cite the exact URLs where your data appears in responses
• Identify the type of data involved (name, address, phone number, etc.)
• Explain why removal is necessary in your situation
• Prepare verification documents, such as government-issued ID

Vague, unsupported requests are far more likely to be denied under the balancing test, so thoroughness pays.

Two caveats matter here. First, removal from ChatGPT does not remove your data from external websites or search engines — the source pages remain live and can be re-learned or surfaced elsewhere, so contact those platforms separately. Second, if your request isn't adequately addressed, you retain the right to escalate to your local supervisory authority, such as a data protection regulator.

The bigger lesson is prevention. Since post-hoc removal is unreliable, businesses adopting AI should minimize exposure at the point of use — for instance, controlling exactly which skills and tools each agent can access. SkillzBench, currently in pre-launch development, is building a free MCP connector and per-agent loadouts so agents only see what you've explicitly chosen, alongside security scanning of skills — published research found roughly 26% of agent skills carry at least one vulnerability. Output suppression is today's remedy; controlling inputs is tomorrow's defense.

The Frontier: Machine Unlearning, Approximate Deletion, and Certified Methods

If deletion from a trained model were easy, this entire article would be shorter. It isn't — but researchers are racing to change that, and their early results are worth understanding even if none are ready for prime time.

Stanford researchers have proposed one of the most practical ideas so far: approximate deletion. Instead of retraining a massive model from scratch, the method uses synthetic data to remove most of a user's implicit data quickly, with full retraining deferred to a later, more convenient time. As Stanford's Zach Izzo put it, users are "forgotten" in a way that lets teams schedule the expensive cleanup for when it makes operational sense.

At UC Riverside, researchers took a different angle with "source-free certified unlearning" — a technique that erases data without even needing the original training set, using a surrogate dataset and calibrated noise to provably scrub information. The catch: it currently works only on simpler models, not frontier systems like ChatGPT. Still, the team's framing is ambitious. "People deserve to know their data can be erased from machine learning models — not just in theory, but in provable, practical ways," said Başak Güler.

Beyond these two approaches, the field is exploring several other paths:

• Differential privacy — a training-time technique already used by OpenAI, Google, and Apple that limits how much any single data point can influence a model.
• Retraining with a deletion list — periodically rebuilding the model while excluding flagged data.
• Federated learning — keeping raw data on devices so it never reaches the central model at all.

Here's the sobering part. Analysis from Tech Policy Press characterizes machine unlearning as experimental and unreliable, with no universally accepted verification method. The Leiden Law Blog reaches a similar conclusion, noting that unlearning may be too novel to satisfy the legal standard of complete erasure. And the Cloud Security Alliance states plainly that there are "no proven, scalable solutions to guarantee compliance with the right to erasure" for already-trained models.

So treat these methods as promising paths forward, not dependable remedies. GPT-4 reportedly uses 1.8 trillion parameters trained on a dataset exceeding a petabyte — scrubbing one person's influence from that scale of system remains beyond current techniques.

The practical takeaway for businesses is prevention at the point of use. Since post-hoc removal is unreliable, controlling what data your AI agents can access in the first place matters more. That's the philosophy behind what SkillzBench is building: a free directory of agent skills with per-agent loadouts, so you decide exactly which skills and tools each agent sees — minimizing exposure before deletion ever becomes necessary. You can join the waitlist to follow its progress.

Until certified unlearning matures, the strongest data-removal strategy is the one that never requires it.

Prevention Beats Removal: Controlling What AI Sees in the First Place

Once data is absorbed into a trained model's parameters, true deletion generally requires retraining from scratch — a costly and often impractical proposition for systems like GPT-4, which uses 1.8 trillion parameters and a dataset exceeding a petabyte. That reality makes prevention the only reliable strategy for businesses adopting AI today.

The Cloud Security Alliance recommends a straightforward framework: avoid including personal data in generative AI training sets whenever possible, document training data sources thoroughly, and perform risk assessments before training on sensitive data. Companies without logs of live customer data used in training, or without model versioning, face the most common compliance failures when regulators come calling.

• Data minimization in training sets — exclude personal data unless absolutely necessary
• Documented records of training data sources and acquisition dates
• Model versioning tied to commit identifiers, enabling audit trails
• Pre-training risk assessments for sensitive data categories

Legal leverage exists to back these practices. Under GDPR, if training relied solely on consent, erasure requests typically must be honored. Even under "legitimate interest" — the alternative basis the Italian Garante considers plausible for AI trained on publicly scraped data — erasure rights remain intact unless the interest is demonstrably overriding. In the United States, California's AB 1008 (September 2024) became the first state law enabling consumers to exercise deletion rights against AI systems, though its enforcement effectiveness remains untested.

Since post-hoc removal from AI is unreliable, the practical defense is minimizing exposure at the point of use. For organizations deploying AI agents, that means controlling which skills and tools each agent can access rather than trusting that sensitive data can be scrubbed later. Published research has found roughly 26% of agent skills carry at least one vulnerability, making selective access control a privacy concern as much as a security one. SkillzBench is building a free MCP connector and per-agent loadouts designed to let users toggle skills and tools so each agent only sees what was chosen — worth watching for teams that want to operationalize this prevention-first approach once the platform launches.

The core takeaway is simple: once personal data enters a model's training corpus, your options narrow dramatically. Keeping it out from the start preserves flexibility, reduces compliance risk, and avoids the expensive retraining scenarios that make true deletion impractical at scale.

Your Action Plan: A Step-by-Step Removal Workflow

Knowing where your data lives is the first step toward controlling it. The path to removal is rarely a single click, but a structured workflow that balances legal rights with technical realities. Start by submitting formal requests through official provider portals. OpenAI, for example, allows users to request data removal without an active account, using a documented process that balances privacy against public interest.

To maximize your chances of success, follow specific best practices. Identify the exact data type, provide direct links to where the information appears, and explain why removal is necessary. Prepare verification documents, such as a government-issued ID, to prove your identity. Provider documentation highlights that specificity is key; vague requests often result in denial or delay.

However, you must manage your expectations regarding what "removal" actually means. In the current technical landscape, erasure typically equates to output suppression rather than true deletion. Once data is baked into a model’s parameters, it is often impossible to surgically remove it without retraining the entire system from scratch. Research on AI data persistence confirms that while providers can stop specific outputs, the underlying data remains embedded in the model’s structure.

Because AI models draw from vast external sources, removing data from one platform does not scrub it from the internet. You must contact search engines and other websites separately to request deletion of the original source material. If a provider fails to address your request adequately, you retain the right to escalate the issue to your local supervisory authority, particularly under GDPR regulations.

For businesses, the most effective strategy is prevention. Instead of relying on post-hoc removal, build reversibility into your AI adoption strategy from the start. This involves conducting risk assessments before training with sensitive data, maintaining rigorous documentation of training sources, and enforcing strict training-data hygiene. As noted by industry experts, companies that fail to document their data pipelines face significant compliance risks and potential fines.

• Submit removal requests via official privacy portals with specific evidence.
• Contact search engines and third-party websites to remove source data.
• Escalate to supervisory authorities if providers ignore valid legal requests.
• Implement internal controls to minimize personal data in AI training sets.

To take control further, consider limiting what your AI agents can access in the first place. SkillzBench is currently developing a free directory and MCP connector that allows you to toggle which skills and tools each agent can see. This approach reduces exposure by ensuring agents only interact with verified, secure capabilities. Published research indicates that roughly 26% of skills carry at least one vulnerability, making proactive filtering essential for data privacy.

By combining formal removal requests with proactive access control, you create a robust defense for your data. This dual approach addresses both the legal necessity of erasure and the technical reality of model architecture. It ensures that your personal information remains protected not just in response outputs, but across the entire AI ecosystem.