Question 1

Does the GDPR right to be forgotten apply to ChatGPT and other LLMs?

Accepted Answer

Yes, but with a contested scope that European data protection authorities are still defining. Article 17 of the GDPR gives any EU data subject the right to demand erasure of personal data a controller holds, and the European Data Protection Board has confirmed in its December 2024 Opinion 28/2024 that LLM providers are controllers when they process personal data through training and inference. What is contested is whether memorized personal data inside model weights counts as personal data the controller still 'holds,' or whether it has been transformed into a statistical artifact outside the GDPR's reach. The Hamburg Commissioner for Data Protection took the second view in a July 2024 discussion paper. The Italian Garante, the French CNIL, and the EDPB itself have taken the first view. OpenAI, Anthropic, and Google all currently accept Article 17 requests through formal intake forms, regardless of the doctrinal debate.

Question 2

How do I submit a right-to-be-forgotten request to OpenAI, Anthropic, or Google for AI search?

Accepted Answer

Each provider operates a distinct intake. OpenAI uses a personal data removal request form linked from its EU privacy notice that asks for identity verification, a description of the personal data, and the exact prompts that elicit the data. The default response is a 'we will not use your data for training' commitment plus an output filter that blocks the model from returning the named individual; full weight modification is not offered. Anthropic accepts requests through privacy@anthropic.com with a similar identity-verification step and a documented commitment to filter Claude outputs about the requester, again without weight modification. Google handles AI Overviews and Gemini erasure requests through its existing 'Right to be forgotten' web form, then applies retrieval-time suppression. None of the three currently retrain models on demand, and EU regulators have so far accepted output suppression as a partial remedy.

Question 3

What did the Italian Garante actually fine OpenAI for in 2024?

Accepted Answer

Italy's Garante per la Protezione dei Dati Personali fined OpenAI EUR 15 million on December 20, 2024, after concluding that the company processed personal data to train ChatGPT without an adequate legal basis, failed to notify the authority of a March 2023 data breach affecting Italian users, and lacked an age-verification mechanism to keep users under 13 out of the product. The Garante also ordered OpenAI to run a six-month public information campaign across Italian media explaining how ChatGPT processes data and how users can exercise their GDPR rights. The fine was the second major intervention by the Garante against OpenAI, following the temporary March 2023 ban that briefly took ChatGPT offline in Italy. The 2024 ruling is the highest-profile GDPR enforcement against a generative AI provider to date and has become the template other DPAs are referencing.

Question 4

Can a data subject force OpenAI or Anthropic to retrain a model to remove their personal data?

Accepted Answer

Not in current practice, and probably not in current law. No EU data protection authority has yet ordered a full retraining as a remedy under Article 17, partly because the cost would be disproportionate (typically USD 50-150 million per frontier-model run) and partly because the EDPB has accepted output-layer suppression as a reasonable measure when weight-level deletion is technically infeasible. The closer question is whether a controller can be ordered to perform machine-unlearning techniques that target specific training examples; the field is real, but no production-scale technique reliably erases memorized data without degrading the model. The current de facto standard is a layered remedy: removal from future training corpora, retrieval-time filters that suppress live citations, output classifiers that refuse to generate the named individual, and a documented log of compliance steps. EU regulators have indicated they will revisit the standard once unlearning techniques mature.

Question 5

How does the right to be forgotten affect operators who want to be cited by AI search?

Accepted Answer

Operators sit on both sides of the Article 17 question. As data subjects, your founders, executives, and named employees can demand erasure of personal data from LLM training corpora and AI search outputs; as data controllers publishing content about customers, employees, and third parties, you can receive erasure requests yourself and become liable for re-publishing data after the original source has been delisted. The AEO consequence is that any content strategy that depends on persistent biographical detail (founder profiles, customer-story names, deal-announcement quotes) carries a latent compliance risk if the named individual later exercises Article 17. The operator response is to design citation-magnet content with replaceable name slots, written consent for AEO-targeted bios, and a documented takedown workflow that can suppress a page from AI crawlers within 30 days of a verified request.