AI Tools and the Right to Be Forgotten: How to Delete Your Data

Every prompt you have ever typed into an AI chatbot is sitting on somebody’s server. Your questions, your uploaded documents, the personal details you mentioned in passing – all of it. If that thought makes you uneasy, European law is on your side: the GDPR gives you a right to erasure, often called the right to be forgotten, which lets you demand that companies delete your personal data.

In this guide we explain what the right to erasure actually covers when it comes to AI tools, walk through the concrete steps to delete your data from ChatGPT, Claude and Google Gemini, clarify what deletion does not cover, and give you copy-ready templates for a deletion request email.

What the GDPR right to erasure actually covers

Article 17 of the General Data Protection Regulation gives every person in the EU/EEA (and, via the UK GDPR, in the United Kingdom) the right to have their personal data erased when, among other situations:

• The data is no longer necessary for the purpose it was collected for.
• You withdraw your consent and there is no other legal basis for processing.
• You object to the processing and there are no overriding legitimate grounds.
• The data was processed unlawfully.

For AI tools, “personal data” is broader than you might think. It includes your account details (name, email, payment information), the content of your conversations insofar as it identifies you or contains information about you, uploaded files, and technical data such as IP addresses and device identifiers. If you once pasted your CV, your address or details about your health into a chatbot, that text is personal data and falls under your erasure right.

Companies must respond to your request without undue delay and within one month (extendable by two months for complex requests). They must erase the data unless a specific exemption applies – more on those below.

What deletion does NOT cover: honest limitations

Before you fire off requests, understand the boundaries. The right to be forgotten is powerful, but it is not a magic “undo” button:

• Data already used to train models. Once your data has been folded into a trained model’s weights, it generally cannot be surgically removed – retraining from scratch is enormously expensive. This is why opting out of training before you chat matters so much.
• Anonymised and aggregated data. Truly anonymous statistics (e.g. “how many users asked about Python yesterday”) are not personal data and will not be deleted.
• Legal retention obligations. Companies may keep certain records – invoices, fraud-prevention logs – where the law requires it.
• Other people’s copies. If you shared a chat link publicly, erasing your account will not delete copies others saved.
• Backups. Your data may persist in encrypted backups until those backups rotate out, which providers typically disclose as taking up to 30–90 days.

None of this makes the right useless – deleting your account and history removes the identifiable, queryable record of you. It just means prevention (data minimisation, training opt-outs) is as important as cure.

How to delete your data from ChatGPT

OpenAI offers several layers of control. Work through them in order:

1. Stop training on your chats (do this first). In ChatGPT, open Settings → Data controls and turn off “Improve the model for everyone”. New conversations will then be excluded from training. Note that this does not retroactively remove past chats from training data.
2. Delete individual chats. Hover over any conversation in the sidebar, click the options menu and choose Delete. Deleted chats are removed from your history immediately.
3. Delete your account entirely. Go to Settings → Data controls → Delete account. This permanently erases your account, chat history and API data. You will need to confirm via email, and the process can take several weeks to propagate through backups.
4. Submit a formal privacy request. For erasure requests beyond self-service – for example, asking OpenAI to remove personal data about you that appears in model outputs – use the privacy request portal linked from OpenAI’s privacy policy, or email their data protection contact. Reference GDPR Article 17 explicitly.

How to delete your data from Claude

Anthropic’s controls are similar in spirit:

1. Delete conversations. In the sidebar, hover over a chat, click the menu and select Delete. You can also delete multiple conversations at once from the chat management view.
2. Check your privacy settings. In Settings, review the privacy options, including whether your conversations may be used for model improvement, and opt out if you prefer.
3. Delete your account. In Settings, find the option to delete your account. Anthropic states that account deletion removes your personal data from their active systems, with residual copies expiring from backups on their standard schedule.
4. Contact the privacy team. For formal GDPR erasure requests, use the privacy request form on Anthropic’s website or email their designated privacy address. Include the email address associated with your account so they can locate your data.

How to delete your data from Google Gemini

Gemini activity lives inside your Google account, so deletion happens in Google’s activity controls:

1. Delete Gemini activity. Visit myactivity.google.com, filter by the Gemini product, and delete entries – individually, by date range, or all at once.
2. Set auto-delete. In the same activity controls, enable auto-delete every 3, 18 or 36 months so old prompts expire automatically. This is the single best “set and forget” privacy step for Google users.
3. Turn off activity saving. In Gemini’s settings (or your Google account’s Web & App Activity controls), you can pause saving future Gemini activity to your account.
4. Delete your Google account data selectively. For a full erasure request under the GDPR, use Google’s data privacy request channels or the “Delete your Google Account” flow for the nuclear option – remembering it erases Gmail, Drive and everything else too.

Templates: your deletion request email

Self-service deletion covers your account, but a formal written request creates a paper trail and triggers the GDPR’s one-month clock. Adapt these templates:

Template 1: Erasure of your account data

Subject: GDPR Article 17 – Request for erasure of personal data

Dear Data Protection Officer,

I am writing to exercise my right to erasure under Article 17 of the General Data Protection Regulation (EU) 2016/679.

Please permanently delete all personal data you hold about me, including but not limited to: my account profile, conversation and prompt history, uploaded files, and associated technical identifiers. My account is registered under the email address [your email].

I withdraw any consent previously given for the processing of my personal data for model training purposes.

Please confirm completion of the erasure within one month, and inform me of any data you claim an exemption for, with the legal basis stated.

Kind regards,
[Your full name]
[Your email address]

Template 2: Removing personal data from model outputs

Subject: GDPR Articles 16/17 – Request regarding personal data in model outputs

Dear Data Protection Officer,

Your AI system outputs personal data relating to me when prompted with [describe the prompt, e.g. my name]. This data is [inaccurate / published without my consent / no longer relevant].

Pursuant to Articles 16 and 17 GDPR, I request that you rectify or erase this personal data and take reasonable steps to prevent its reappearance in future outputs. Evidence is attached [screenshots].

Please respond within one month.

Kind regards,
[Your full name]
[Your email address]

After you request deletion: timelines and follow-up

• Expect confirmation within one month. Mark the date. If the company stays silent or refuses without a valid exemption, follow up in writing.
• Escalate to your supervisory authority if needed. Every EU country has one – for example, the CNIL in France, the BfDI in Germany, the Autoriteit Persoonsgegevens in the Netherlands and the ICO in the UK. Complaints are free and can be filed online.
• Check that deletion actually happened. Try logging in after the stated completion date; your history should be gone.
• Prevent future accumulation. Use training opt-outs, auto-delete settings and anonymous or pseudonymous accounts where the service allows it. For more on choosing services that respect your data by design, see our privacy-first AI tool picks.

Conclusion

The right to be forgotten is one of the strongest privacy tools Europeans have – and it applies fully to the AI chatbots millions of us use every day. Delete what you can yourself, opt out of training, and do not hesitate to send a formal Article 17 request when self-service is not enough. Your data has value; the GDPR simply insists that the choice about it remains yours. If you found this guide useful, our guide to using AI tools in France covers more Europe-specific angles, including language support and local regulation.