Does the GDPR right to erasure apply to AI chatbots?

Yes, but it is conditional. A provider within the GDPR's territorial scope under Article 3 — an EU establishment, or offering services to or monitoring people in the EU — must erase your stored personal data — account details, chat history, uploaded files — where a ground in Article 17(1) applies and no exception in Article 17(3) permits keeping it, and must tell you what it did within one month. The unresolved part is the model itself: data absorbed into trained weights is not removed by any deployed technique today, only filtered out of responses.

Can OpenAI delete what ChatGPT "knows" about me?

OpenAI takes personal data removal requests through its privacy portal and can stop information about you from appearing in ChatGPT's responses, subject to a case-by-case balancing. It does not publish how that is implemented, and it does not claim the trained model is altered. The reason it is widely understood as output filtering is OpenAI's correspondence with a complainant, recorded in a 2024 noyb complaint, where it said it could block outputs about the person but not correct them.

If I delete my chats, is my data gone from the AI?

Your stored copies are deleted on the provider's schedule (typically within about 30 days, absent a legal hold). But if those chats were already used in a training run, deletion does not untrain the model. A training opt-out only protects future conversations.

Is an AI model itself "personal data" under the GDPR?

It can be. EDPB Opinion 28/2024 says a model trained on personal data is not automatically anonymous — anonymity must be shown case by case, considering whether personal data can be extracted from the model or elicited through queries. If a model fails that test, GDPR obligations apply to it in principle. The Opinion does not decide what Article 17 then requires of the model.

Did Italy's €15 million fine against OpenAI survive?

No. On 18 March 2026 the Court of Rome annulled the Garante's decision in full — but purely on jurisdiction, because OpenAI's Irish establishment had made Ireland's DPC the lead authority under the one-stop-shop mechanism before the Garante ruled. The findings on legal basis, transparency, age verification and breach notification were never reviewed on their merits.

Does Secret Chat hold chat data I would need to ask it to erase?

No conversations. Your chats and files are stored only in your own browser, not on Secret Chat's servers, and your queries reach the model providers anonymously — never linked to your email or identity. We do hold ordinary account data covered by the same rights: your email, payment records, support correspondence, and server logs kept at most 30 days. And the content of your messages still reaches the providers verbatim, so redacting sensitive details before sending remains your responsibility.

GDPR and AI Chatbots: The Right to Erasure

Published July 23, 2026 · Updated August 18, 2026

This article is general information, not legal advice. Data protection law differs by country and is evolving quickly around AI. For your own situation, consult a qualified lawyer. Your use of Secret Chat is governed by our Terms of Service and Disclaimers.

The GDPR's right to erasure (Article 17) reaches the data an AI provider stores about you — your account, your chat logs, your uploaded files. Where one of the grounds in Article 17(1) applies and no exception in Article 17(3) saves it, that data has to go, and the provider has to tell you what it did within a month. But the right collides head-on with how large language models are built: once personal data has been absorbed into a model's weights during training, no provider today removes it surgically. What gets deployed instead is output filtering — the model is stopped from repeating certain facts about you — while the trained parameters stay exactly as they were. European regulators have refused to declare trained models automatically "anonymous" (EDPB Opinion 28/2024), two complaints by the privacy group noyb turn on OpenAI's reported inability to correct rather than merely block what the model "knows", and Europe's one headline AI privacy fine — Italy's €15 million against OpenAI — was annulled in March 2026 without a court ever reviewing whether the data protection findings were right. This article explains what the law says, what actually happens to an erasure request, and what it means for what you type into a chatbot.

What Article 17 Actually Says

The right to erasure — popularly the "right to be forgotten", a phrase popularised by the Court of Justice's Google Spain ruling (C-131/12, 13 May 2014), decided under the old Data Protection Directive and concerned with de-listing search results rather than with Article 17 itself — is set out in Article 17 GDPR. A person can require a controller to erase their personal data "without undue delay" when one of the listed grounds applies, including:

the data is no longer necessary for the purpose it was collected for;
the person withdraws consent and there is no other legal basis;
the person objects to processing based on legitimate interests and no overriding grounds exist;
the data was processed unlawfully in the first place;
erasure is required by EU or member-state law;
the data was collected from a child in connection with an information-society service.

Two limits are built into the right, and both get lost in popular summaries. First, erasure is conditional, not automatic: a ground in Article 17(1) has to apply, and Article 17(3) carves out exceptions — freedom of expression and information; compliance with a legal obligation or performance of a public-interest or official-authority task; reasons of public interest in public health; public-interest archiving, scientific or historical research or statistics, where erasure would seriously impair the objectives; and the establishment, exercise or defence of legal claims. Second, the famous "one month" in Article 12(3) is a deadline to respond: the controller must tell you what it has done about your request without undue delay and in any event within a month, extendable by two further months for complex cases. It is when you are owed an answer — not a guarantee that every copy has already vanished.

Within those limits the enforcement stick is real: violations of data-subject rights sit in the top fine bracket, up to €20 million or 4% of global annual turnover.

None of this was written with neural networks in mind. The GDPR assumes data lives in records that can be located and deleted. An LLM breaks that assumption in a very specific way.

Where Your Personal Data Actually Lives When You Use an LLM

To see what erasure can and cannot reach, separate the three places personal data exists in an AI chatbot system:

1. Your account and chat data. Your email, payment details, conversation history, uploaded files, and usage logs, stored in ordinary databases. This is classic personal data. Erasure works here the way the GDPR intends: the provider locates the records and deletes them.
2. The training corpus. The datasets the model was trained on — web scrapes, licensed archives and, at several providers, users' own chats. Data can be deleted from a stored corpus, but that only affects future training runs. It does nothing to models already trained.
3. The model weights. Billions of numerical parameters encoding statistical patterns learned from the corpus. There is no row in a database that says your name — yet models demonstrably memorize and reproduce facts (true and false) about real people. This is where the right to erasure currently has no working mechanism.

Most "delete my data" conversations mix these three layers together. Providers answer for layer 1, regulators are arguing about layer 3, and layer 2 quietly determines what the next model will know about you.

The Easy Part: Erasing Your Account and Chats

For layer 1 the mechanics are established. Major providers let you delete individual conversations or your whole account. OpenAI states that deleted chats are scheduled for removal within about 30 days, subject to de-identification and security or legal exceptions. Do not generalise that figure across the industry, though — Google says Gemini conversations already sampled for human review are kept up to three years and are not removed when you delete your activity, and other providers word their commitments differently. Two caveats keep this from being as clean as it sounds:

Deletion is a schedule, not an instant. "Temporary" and deleted chats generally persist in backend systems for a retention window first — we walked through the fine print of those windows in "Temporary Chat" Isn't What You Think.
A legal hold overrides your delete button. When litigation intervenes, a court can order chats preserved in spite of deletion. Two different orders in the New York Times case are routinely mixed up: a May 2025 order required OpenAI to preserve output logs that would otherwise have been deleted — an obligation lifted for data generated after 26 September 2025, though everything captured while it ran stays preserved — and a separate, later order concerns handing the plaintiffs a de-identified sample of roughly 20 million conversations. Notably, logs belonging to users in the EEA, Switzerland and the UK were carved out of the preserved set. We walk through the mechanics in Your AI Chats Can Be Subpoenaed.

One more structural nuance: this all describes consumer products, where the provider is the data controller. On business and API tiers, the provider usually acts as a processor for the customer — so if your employer wires a chatbot into its tools, your erasure request goes to the employer, not the AI company.

The Hard Part: A Model Cannot "Forget" on Request

Model weights are not a database. Training distributes what the model learns across billions of parameters; no engineer can point at the ones that "contain" you. That leaves three theoretical routes to erasure, none of which works today at frontier scale:

Retraining from scratch without your data would genuinely erase it — and costs months of computation on some of the most expensive infrastructure on earth. No provider will do this per request.
Machine unlearning — techniques to make a trained model behave as if specific data had never been in the corpus — is an active research field, but current methods either degrade the model, don't scale to LLMs, or can't prove the data is actually gone.
Output filtering is what providers actually deploy: guardrails instruct the model not to output information about a listed person. The data remains in the weights; the model is merely told not to say it.

Whether filtering satisfies Article 17 is one of the sharpest open questions in European data protection. Suppressing an answer is not the same as erasing the data — and that gap is exactly what the current complaints are about.

It is worth being precise about which way that argument cuts. "We cannot do it" is not, in itself, a GDPR defence: the Regulation contains no technical-impossibility exception, and the "available technology and the cost of implementation" wording in Article 17(2) is about the effort a controller must make to notify other controllers, not about whether it must erase at all. In principle a supervisory authority could order a model retrained or pulled. Equally, no authority has done so, and neither the EDPB nor any court has said what a legally sufficient erasure inside a model would even look like. That is the honest state of play: the right exists, and the remedy is undefined.

What Regulators Have Said So Far

The regulatory picture has moved a great deal since mid-2024 — though not always in the direction of more certainty:

Hamburg's DPA lit the fuse (July 2024). In a discussion paper, the Hamburg Commissioner argued that LLM weights as such do not store personal data — tokens and embeddings are not "information relating to an identifiable person" — which would conveniently place the weights outside the GDPR. The position was influential and immediately contested.
The EDPB declined to agree (Opinion 28/2024, adopted 17 December 2024). Asked by the Irish supervisory authority, the European Data Protection Board held that an AI model trained on personal data cannot automatically be considered anonymous. Anonymity must be assessed case by case, and requires both that the likelihood of extracting personal data from the model (via attacks like membership inference or model inversion) is insignificant, and that queries cannot elicit identifiable personal data. If a model fails that test, the GDPR — including data-subject rights — applies to it in principle. The opinion also warned that unlawful processing during training can taint the model's later deployment.
Italy showed the price tag — and then Europe showed the enforcement gap (2024–2026). On 2 November 2024 the Garante adopted decision no. 755, announced on 20 December, fining OpenAI €15 million: no appropriate legal basis for the personal data processed to train ChatGPT, transparency failures, insufficient age verification, and a failure to notify a March 2023 breach. OpenAI was also ordered to run a six-month public information campaign explaining, among other things, how users and non-users can exercise their rights to object, rectify and erase. OpenAI called the fine disproportionate and appealed — and won. On 18 March 2026 the Court of Rome (judgment no. 4153/2026, full reasoning published 28 May 2026) annulled the decision in its entirety, on jurisdiction alone: OpenAI's Irish entity had been recognised as its main establishment on 15 February 2024, so by the time the Garante ruled, the GDPR's one-stop-shop mechanism had already made Ireland's DPC the lead authority. The court never reached the substance. The findings on legal basis, transparency, age verification and breach notification were neither upheld nor overturned — they were simply never reviewed, and the Garante has since pulled the decision from its website. The lesson is not that training ChatGPT on European personal data was found lawful. It is that Europe's headline AI privacy fine evaporated on a procedural question about which regulator was allowed to ask.
The EDPB went back to first principles (7 July 2026). The Board adopted two further draft guidelines, open for consultation until 30 October 2026. Guidelines 02/2026 on anonymisation are drafts rather than adopted guidance — if finalised in this form they would supersede the 2014 Article 29 Working Party opinion — and they treat anonymity as relative: the same data can be anonymous for one party and personal for another, tested by whether anyone with realistic means could isolate a record, link it to another dataset, or infer something about an identifiable person — an approach that follows the Court of Justice's September 2025 EDPS v SRB ruling. Guidelines 03/2026 address web scraping for generative AI, the practice that builds layer 2. Neither settles what Article 17 requires of a trained model. Both make it harder to argue that a model, or the corpus behind it, simply sits outside the GDPR.

The Test Cases: When ChatGPT Gets You Wrong

The right to erasure travels together with Article 16's right to rectification — and the pending complaints show why the pair is so hard for LLMs.

The birth-date complaint (Austria, April 2024). The privacy NGO noyb filed a complaint after ChatGPT repeatedly stated an incorrect date of birth for a public figure. OpenAI's answer, as recorded in the complaint, is the crux of this whole topic: it could not correct the specific fact — it could only filter, blocking responses about the person entirely. noyb argues that neither hallucinating false data nor all-or-nothing suppression is compatible with the GDPR's accuracy principle or with Articles 16 and 17.
The fake child-murderer (Norway, March 2025). Asked "Who is Arve Hjalmar Holmen?", ChatGPT invented a detailed story that this entirely ordinary Norwegian man had killed two of his sons and been sentenced to 21 years — wrapping the fabrication around real details like his home town and children. noyb's complaint asks the Norwegian DPA to order the false output eliminated and to fine OpenAI. OpenAI responded that newer, search-grounded versions no longer repeat the claim — which mitigates the symptom without answering the legal question of what remains in the model.

Both complaints were still pending as of July 2026 — more than two years after the first was filed. They are complaints, not rulings: noyb is an advocacy organisation, and nothing in them has been established by a regulator. But whichever way they land, they will effectively define whether "we filtered it" counts as "we erased it" in Europe.

What an Erasure Request Actually Gets You Today

If you exercise your rights against a major AI provider now, the realistic outcomes are:

Account and chat deletion — real erasure. Your stored conversations, files and account records are deleted on the provider's stated schedule.
An output-suppression request — a promise about answers, not about the model. OpenAI, for example, takes a personal data removal request through its privacy portal, open to account holders and non-users alike, to stop certain information about you from appearing in ChatGPT's responses. Expect identity verification, and a case-by-case balancing against free expression and public interest — OpenAI can and does decline. Read the promise carefully: information stops appearing in responses. OpenAI does not publish how that is implemented, and nothing in its guidance claims the model itself is altered. The reason this is widely read as output filtering is OpenAI's own correspondence with a complainant, as recorded in noyb's 2024 complaint, where it said it could block outputs about the person but could not correct them.
A training opt-out — protection for the future only. Turning off "improve the model for everyone" (or its equivalent) keeps your future chats out of training runs. It does not unwind any training that already used your past chats. Step-by-step instructions for every major platform are in our 2026 opt-out master guide.

The Direction Nobody Thinks About: What You Type In

Public debate focuses on data about you that models learned from the web. When you prompt an LLM, the data flows the other way too — and the same erasure problem applies:

Your prompts are personal data. A chat in which you describe your health, finances, relationships or workplace is a dossier in your own words, stored under your account and, on several consumer platforms, used for training by default.
Once a chat has been trained on, deleting it doesn't untrain the model. Erasure removes the stored copy; the completed training run keeps whatever it absorbed. The time to control this is before you send, not after.
Other people's data raises your own GDPR exposure. Pasting a client's, patient's or colleague's details into a consumer chatbot is itself processing. Outside the purely personal or household activity that Article 2(2)(c) exempts, it can make you (or your firm) a controller who has just disclosed someone's personal data to a third party without a legal basis, an information notice or a record. This does not put everyone else in the clear: the tool you used and the model provider are processing that data too, in whatever role their contracts and actual purposes give them, and no terms of service can shift a controller's duties onto its users. It does mean the exposure that lands on you is real — and it is the one you can actually control, by not sending the data. We cover the professional angle in our guide for lawyers and for business owners.

A Practical Playbook

What actually works, in order of leverage:

Minimize before you send. The only data guaranteed never to need erasure is data that never left your device. Strip names, identifiers and unique details from prompts — with any provider, this part is always your own responsibility.
Opt out of training everywhere you chat. It closes the layer-2 door for the future.
Use the formal channels. Start with an Article 15 access request (what do you hold about me?), then erasure for stored data and the provider's removal form for outputs. The one-month clock applies.
Delete chats routinely anyway. Ordinary deletion still shrinks what a breach, subpoena or future training run could reach — see our 13-provider retention audit for who keeps what, for how long.
Escalate if ignored. A refused or ignored request can go to your national data protection authority — that route is free, and it is exactly how the noyb cases got moving.
Prefer tools that don't build the archive in the first place. Erasure is a remedy for stored data; the stronger position is that there is nothing stored to remedy.

How Secret Chat AI Fits — and Its Honest Limits

That last point is the design principle behind Secret Chat AI, so here is the honest version of what it does and does not change about this article.

What it does. Secret Chat keeps no server-side archive of your conversations — chats and files live only in your own browser's local storage (IndexedDB and OPFS), so on our side there is no conversation history to erase, subpoena or breach; deleting it is a local action you perform yourself, instantly, no one-month clock. And Secret Chat is an anonymizer: it builds no profile of you, no chat is ever associated with you, and your queries reach the top LLMs anonymously — your email is used only for account access and payment, never linked to your prompts, and queries are never used for training. So even where a model provider briefly retains API data under its own terms, that log is not tied to your name, account or IP — you use the model as a stranger.

What it does not do. Secret Chat AI removes you from your queries — it does not remove the data from your messages. Whatever you type still reaches the model provider verbatim (anonymously, but verbatim), and that provider processes it under its own terms. Three limits follow, and they are worth stating plainly.

Identity separation is not anonymisation of content. Stripping your account and your IP out of a request is data minimisation. If the prompt itself gives you away — your name, your employer, a detail only you would ask about — no amount of routing makes it anonymous, and under the EDPB's July 2026 draft framework that is precisely the "inference" test. Redacting identifying details before sending remains your job with Secret Chat exactly as with any other tool. Equally, if you paste someone else's personal data into a prompt, anonymising your identity does not transfer the responsibility for that disclosure away from you.

"No chat archive" is not "nothing at all". Our Privacy Policy is the full list of what we do hold: an email-only account, payment and billing records, support correspondence, and server logs — including IP addresses — kept for at most 30 days for security monitoring and troubleshooting. That is ordinary personal data, and your Articles 15 and 17 rights apply to it in the ordinary way. The point is not that there is nothing to erase; it is that the request is small and simple, because the conversation history was never ours to hold in the first place.

And the GDPR still applies to everyone in the chain. Being an anonymiser is an architectural choice, not an exemption: we process your prompts in transit to route them, and the model provider processes them on arrival. What changes is your side of the erasure problem — there is no conversation archive on our servers waiting for an Article 17 request, and no profile of you being assembled from your prompts, not here and not at the provider, which never learns whose prompt it is.

Frequently Asked Questions

Does the GDPR right to erasure apply to AI chatbots?
Yes, but it is conditional. A provider within the GDPR's territorial scope under Article 3 — an EU establishment, or offering services to or monitoring people in the EU — must erase your stored personal data — account details, chat history, uploaded files — where a ground in Article 17(1) applies and no exception in Article 17(3) permits keeping it, and must tell you what it did within one month. The unresolved part is the model itself: data absorbed into trained weights is not removed by any deployed technique today, only filtered out of responses.
Can OpenAI delete what ChatGPT "knows" about me?
OpenAI takes personal data removal requests through its privacy portal and can stop information about you from appearing in ChatGPT's responses, subject to a case-by-case balancing. It does not publish how that is implemented, and it does not claim the trained model is altered. The reason it is widely understood as output filtering is OpenAI's correspondence with a complainant, recorded in a 2024 noyb complaint, where it said it could block outputs about the person but not correct them.
If I delete my chats, is my data gone from the AI?
Your stored copies are deleted on the provider's schedule (typically within about 30 days, absent a legal hold). But if those chats were already used in a training run, deletion does not untrain the model. A training opt-out only protects future conversations.
Is an AI model itself "personal data" under the GDPR?
It can be. EDPB Opinion 28/2024 says a model trained on personal data is not automatically anonymous — anonymity must be shown case by case, considering whether personal data can be extracted from the model or elicited through queries. If a model fails that test, GDPR obligations apply to it in principle. The Opinion does not decide what Article 17 then requires of the model.
Did Italy's €15 million fine against OpenAI survive?
No. On 18 March 2026 the Court of Rome annulled the Garante's decision in full — but purely on jurisdiction, because OpenAI's Irish establishment had made Ireland's DPC the lead authority under the one-stop-shop mechanism before the Garante ruled. The findings on legal basis, transparency, age verification and breach notification were never reviewed on their merits.
Does Secret Chat hold chat data I would need to ask it to erase?
No conversations. Your chats and files are stored only in your own browser, not on Secret Chat's servers, and your queries reach the model providers anonymously — never linked to your email or identity. We do hold ordinary account data covered by the same rights: your email, payment records, support correspondence, and server logs kept at most 30 days. And the content of your messages still reaches the providers verbatim, so redacting sensitive details before sending remains your responsibility.

Conclusion

The right to erasure was designed for a world where data sits in records; LLMs moved part of it into weights, where today it can be masked but not removed. The stored layer of your data — accounts, chats, files — remains fully within your GDPR rights, and you should use them. The model layer is still being fought over, in the EDPB's anonymity test, in its 2026 draft guidelines on anonymisation and AI web scraping, and in the noyb complaints sitting with the Austrian and Norwegian regulators. What the Italian episode added is a warning about the pace: the continent's biggest AI privacy fine was undone in March 2026 on a question of which regulator had the file, with the substance untouched after eighteen months. Until that fight resolves, the practical conclusion is unglamorous but solid: the strongest privacy right is the one you never have to invoke. Send less, opt out of training, delete what you can — and prefer tools that keep no archive of your words and no link between your words and your name.

GDPR and AI Chatbots
What "Right to Erasure" Means When You Prompt an LLM