Does Deleting Your Data Actually Delete It?

If you asked a model to describe you, what would it say?

Not a search engine. Not a profile. A model. Something that has read enough of your writing, your reviews, your forum posts, your public commits, to have formed an internal representation of how you think.

You did not consent to that specific act. You consented to using a website. Those are different things, and the difference is the entire legal argument of the next decade.

What actually gets stored

Let me be precise, because the discourse is not.

There are three separate things people mean when they say "AI has your data."

One: training corpus. Scraped text, images, code. Mostly public web. It sits in a dataset, is deduplicated, is tokenized, and is used to adjust weights. Once training is done, the corpus usually persists as an artifact even though it is no longer needed for inference.

Two: memorized content. Some fraction of the corpus leaks into the weights. Not as retrievable rows, but as statistical pressure. The model can regurgitate passages it saw many times. This is the part that makes the phrase "we don't store your data" technically true and practically misleading.

Three: inference logs. Your prompts, your conversations, your uploads. This is the one that is genuinely about you personally, and it is the one most companies are vaguest about.

When you hit "delete my account," you are usually addressing the third. The first two are untouched, because there is no mechanism in current architectures for unlearning a specific person's contribution in a way that is both complete and verifiable.

The unlearning problem

Researchers have been working on machine unlearning for years. The results are consistent and uncomfortable: you can make a model stop producing a specific string with modest effort. You cannot reliably remove the influence of a document from a network of billions of parameters.

Consider what would be required. Gradient descent spread one sentence's effect across millions of weights during training. To remove it, you would need to identify every weight that was touched, in what direction, and by how much, then reverse that specific contribution without disturbing the others. The interdependencies make this ill-posed. It is not a thorny engineering problem. It is closer to asking which part of a cake came from which egg.

Some jurisdictions are legislating as though this were solved. That gap between what the law assumes and what the technology can do is where the next five years of litigation lives.

The audit trail problem

Most people have no idea what is retained because nothing requires a company to tell them in a form they could act on. A retention policy written in legal language and delivered in a settings menu is not a disclosure, it is a formality.

If you want to test this yourself, request your own data export from any service that trains on user content, then request deletion, then request another export. Compare the two. What shows up the second time is what their deletion process actually reaches.

Why the practical advice still matters

None of this means you should give up. It means you should aim at the part that is actually addressable.

Number your points, as I always do.

1. Distinguish the three categories when you read a privacy policy. Search for "training," "logs," and "retention." Most policies address training in one clause and logs in three. The training clause is the one that matters and the one that is shortest.

2. Turn off training on your own inputs wherever the option exists. This does not undo past training. It stops the accumulation. It is the only lever with immediate causal effect.

3. Assume public is permanent. Anything you posted publicly before roughly 2022 is in a corpus somewhere and will not be removed. Write accordingly. This feels fatalistic. It is just accurate.

4. Treat uploaded documents as disclosures. A contract, a medical record, a résumé uploaded to a chat interface is not the same act as typing a question. It is a disclosure of a document, and the retention rules for uploads are frequently different from those for prompts.

5. Ask for the deletion receipt. When you request deletion, ask what was deleted, from which systems, and whether any derivative artifact remains. A company that cannot answer has not done it.

The personal part

I spent ten years inside systems that were, in aggregate, more capable than any of this, and the lesson I took out was not that surveillance is evil. It was that surveillance is ordinary, and ordinary things do not get fixed by outrage. They get fixed by people who understand the mechanism.

So understand the mechanism. You cannot get your data out of a model that has already been trained on it. You can stop feeding the next one, and you can stop confusing a deletion button for a guarantee.

Your data is already gone. What you still control is what you hand over tomorrow.