Whether the GDPR’s erasure right reaches trained model weights is the unsettled question underneath every deletion demand aimed at a model, but the remediation menu is already shorter than the tooling marketing suggests: if the obligation does reach the weights, removing the data and retraining from scratch is the only option with a defensible evidence chain, behavior-level unlearning passes deletion probes without proving anything was forgotten, and doing nothing is priced against fines that reach into the tens of millions of euros, per gdpr.eu’s overview. A same-day arXiv preprint, “Learning to Unlearn” (2608.16700), reframes unlearning as learning the behavior of having forgotten rather than erasing what was learned. The preprint is new, unreplicated, and demonstrated only in its own test environments. That reframing sharpens the compliance question instead of answering it.
When does GDPR’s erasure right actually trigger?
The right to erasure is conditional, not automatic: under EUR-Lex’s official summary of the GDPR, data is deleted when an individual no longer wants it processed and there is no legitimate reason to keep it. Both conditions must hold. A deletion demand that fails either prong never reaches the question of what to do with model weights.
This matters more than most coverage of “the right to be forgotten” admits. The second condition, the absence of a legitimate reason to keep the data, is where the actual legal fights over training data will happen. A model provider that can argue a lawful basis for retaining the underlying data, or that the data subject’s information was never in the training corpus to begin with, has a defense that terminates the dispute before any engineer touches a checkpoint. The erasure right is not a delete button pointed at a weight matrix; it is a conjunctive test, and failing the conjunction is a complete answer.
That cuts both ways, though. Teams sometimes treat the conjunctive structure as a reason to slow-roll every request, which is a bet that the “no legitimate reason” prong will always resolve in their favor. It will not. Where the data was scraped without a defensible basis, or where the individual’s objection is well-formed and the retention argument is thin, the trigger fires. At that point the question becomes purely technical: what does “deleted” mean when the data was gradient-descended into a transformer three generations of checkpoints ago.
Who actually has to answer a deletion demand?
Any organization processing the personal data of people located in the EU is in scope, regardless of where the organization is based: the GDPR applies extraterritorially, pulling non-EU model providers into its reach when their training pipelines or products touch EU individuals’ data. A US lab serving EU users does not get to ignore Article 17 by pointing at its incorporation documents.
The regulation has been effective since 25 May 2018, after adoption by the European Parliament and Council on 14 April 2016, per Wikipedia’s GDPR entry. Eight years of enforcement practice means the procedural questions are settled even where the model-specific ones are not. One of those settled questions is which regulator you will be arguing with. Under the one-stop-shop mechanism, a business with multiple EU establishments answers to a single lead supervisory authority, determined by where its main establishment and main processing activities sit. For a provider that chose its EU main establishment strategically, this is a feature: one regulator, one interpretation, one deletion dispute at a time rather than twenty-seven.
The practical consequence for a platform team fielding an erasure demand is that the interface is known. You are not facing an ambiguous multi-jurisdiction mess. You are facing one authority with a defined penalty schedule, plus, separately, the data subject themselves: the GDPR pairs its penalties with a chapter of remedies and liability provisions, per Wikipedia’s GDPR entry, which is where a wronged data subject’s lawyer starts. That channel is the part of the exposure that survives even a friendly supervisory authority.
What does ignoring a valid deletion request cost?
The exposure is set by the GDPR’s penalty structure: gdpr.eu’s overview warns of “penalties reaching into the tens of millions of euros” for violating its privacy and security standards. That order of magnitude is what any do-nothing strategy is priced against.
Two calibrations are worth stating plainly. First, a headline ceiling is a maximum, not the expected cost of one ignored request. Regulators scale fines to the infringement, and a single mishandled erasure demand is unlikely to draw the harshest penalty on its own. Second, the fine is not the whole bill. The GDPR pairs its penalties with remedies and liability provisions, so a provider that ignores erasure requests as a matter of policy is generating a portfolio of potential claimants, not a single line item. Litigation risk and supervisory risk compound; they do not substitute for each other.
So the honest framing of the do-nothing option is not “the fine is a rounding error.” It is: the downside distribution reaches into the tens of millions of euros, the expected value depends on enforcement appetite and how defensible your retention argument is, and the tail is severe enough that this decision belongs to counsel and the board rather than to the team that owns the training pipeline. Engineering does not get to make this call unilaterally, even though engineering is where the remediation cost lands.
Why can’t you just delete the row?
Training data is not stored in an LLM as retrievable records; it is baked into fixed weights. Large language models are built on the transformer architecture, introduced by Google researchers at NeurIPS 2017 in “Attention Is All You Need,” and training adjusts billions of parameters by gradient descent. There is no row, no index, no cell to null out. The data subject’s information, if it influenced training at all, influenced it diffusely, distributed across the same parameters as everything else the model learned.
This is the architectural fact that turns a legal question into a research problem. A database team answers an erasure request with a DELETE and a cascade. A model team cannot, because the artifact under dispute is a function, not a store. The same property that makes LLMs useful, generalization from training data into reusable behavior, is what makes the erasure obligation awkward: the law was written against records, and weights are not records, but neither are they obviously exempt.
That gap is why the remediation conversation collapses to three options. Retrain without the data. Modify the trained model so it behaves as though the data were absent. Or dispute the trigger and change nothing. Everything else on the market is a variation on option two with better branding.
Does retraining from scratch satisfy an erasure demand?
Yes, and it is the only option with a defensible evidence chain: remove the disputed data from the corpus, retrain from initialization, and the resulting model provably never saw it. There is no extraction attack against information that was never in the gradient, and no deletion probe ambiguity, because the claim being made is about the training run, not about model behavior.
The cost side has no public numbers attached. No public source quantifies what a full retrain costs for a frontier-scale model, and the honest answer is that it depends on model size, pipeline amortization, and how often demands arrive. For a large foundation model, retraining per request is generally understood to be economically absurd, which is why providers batch removals into scheduled runs or treat retraining as the remedy of last resort for high-severity incidents rather than routine Article 17 traffic.
Where retraining does fit is the catastrophic case: a documented privacy incident, a copyright settlement with removal terms, a dataset discovered to contain data that should never have been collected. In those cases the demand is not one individual’s request but a structural defect in the corpus, and behavior-level patches do not address the defect; they address its symptoms in the model’s outputs. If the corpus is tainted, the weights are tainted, and the only clean artifact is a new training run.
Does behavior-level unlearning count as deletion?
Not on the evidence available, and the gap between “the model no longer outputs the data” and “the model no longer contains the data” is the entire problem. A fine-tune that suppresses recall of a specific passage can pass a deletion probe while the underlying information remains recoverable, because the probe tests behavior at the output layer, not state in the weights.
The “Learning to Unlearn” preprint (arXiv:2608.16700) reframes this directly. It is a same-day preprint, unreplicated, and demonstrated only in its own test environments, which is exactly the weight its claims should carry. Its framing is that unlearning is better understood as learning the unlearning behavior than as memorizing what to erase: the model acquires a policy of not-saying rather than losing the capability of saying. If that framing holds, it is a candid description of what most unlearning methods have been doing all along, and it squares with what attack research has reported independently: relearning and extraction attacks can reverse shallow unlearning.
The operational consequence is the same either way. A deletion attestation that rests on “we ran an unlearning fine-tune and the probe passes” is attesting to an output filter, not to erasure. An adversary with fine-tuning access, or even patient prompting, may be able to elicit what the probe could not. That does not make behavior-level unlearning useless; it is cheap, fast, and may well satisfy a regulator who has not yet demanded adversarial evaluation. It makes it unattested, which is a different thing. Nobody should be signing a legal document that says “forgotten” on the basis of a probe.
How do the three options compare on the axes that matter?
The decision decomposes into legal exposure, adversarial robustness, cost, and what you can honestly attest. Cost cells are labeled estimated because no public measurements exist; inventing a number here is how compliance decks become exhibits.
| Axis | Retrain from scratch | Behavior-level unlearning | Do nothing |
|---|---|---|---|
| Satisfies erasure if trigger fires | Yes, by construction | Unproven; no public evidence it does | No |
| Survives relearning/extraction attack | Yes; data never in gradients | Attack literature reports no; unverified | N/A |
| Cost per demand | High (estimated) | Low (estimated) | Zero until it isn’t |
| Legal exposure if trigger fires | Resolved | Contingent on regulator accepting probe evidence | Fines into the tens of millions of euros, plus private liability |
| Attestation strength | Strong | Weak without red-team gate | None |
| Best fit | Tainted corpus, settlements, incidents | Volume requests pending better methods | Demands that fail the conjunctive trigger |
The row that should concern a platform team is not any single cell; it is the second row. If shallow unlearning does not survive an adversary, then the option’s real function is buying time and reducing volume, and it should be budgeted and described internally as exactly that.
Is quietly doing nothing ever the right answer?
Yes, in one specific case: when the demand fails the conjunctive trigger. If there is a legitimate reason to keep the data, or the request is malformed, the correct response is a documented refusal, not a fine-tune. The erasure right’s own conditions, as EUR-Lex’s summary states them, define a class of requests that owe no remediation at all, and building a dispute-and-document workflow around that class is a legitimate first line of defense.
Doing nothing about a demand that does satisfy the trigger is not a strategy; it is a bet. The bet is that enforcement latency, regulator bandwidth, and the ambiguity of applying record-era law to weights will outlast the complainant. Losing that bet means a fine reaching into the tens of millions of euros, private remedies in play alongside it, and a discovery process that is an unpleasant place to explain a policy of ignoring erasure requests. The one-stop-shop structure means there is exactly one regulator to annoy, which also means there is exactly one regulator building a file.
What has to happen before anyone signs a deletion attestation?
A deletion attestation based on behavior-level unlearning should be gated behind adversarial evaluation, full stop: red-team the unlearned model with relearning and extraction attempts, document what survived and what resurfaced, and let the attestation describe what was actually demonstrated. “The model passes our deletion probe” and “the model no longer contains the data” are different sentences, and only one of them should ever appear in a signed document.
Concretely, the gate has three parts. First, the trigger determination, in writing, from counsel: did this demand satisfy both conditions of the erasure right. Second, the technical claim, scoped precisely: what method was applied, what evaluations were run, and whether any of those evaluations were adversarial rather than probe-based. Third, the residual-risk statement: given that no public evidence shows behavior-level unlearning satisfying an erasure obligation, the attestation either restricts its claim to observed behavior or escalates the remediation to retraining. An attestation that elides the difference between the two technical claims is a liability wearing a compliance costume.
Where does this leave the retrain-or-unlearn decision?
Ground the decision in the legal trigger first. If the demand satisfies the GDPR’s conjunctive erasure conditions and your processing touches EU individuals, doing nothing carries fines measured in the tens of millions of euros plus whatever private liability follows, so price that option honestly rather than defaulting to it. Of the technical responses, only remove-and-retrain carries a defensible evidence chain; no public source demonstrates that behavior-level unlearning satisfies an erasure obligation, so no deletion attestation should rest on a probe-passing fine-tune without independent adversarial evaluation first. If the “Learning to Unlearn” framing survives replication, it will not rescue shallow unlearning; it will explain precisely why shallow unlearning was never forgetting, and push the burden onto red-team evaluation before anyone signs anything.
The limitation worth naming is where the documented evidence runs out. The legal frame is sourced: the erasure right’s conditions, extraterritorial reach, the penalty regime, the one-stop-shop mechanism. So is the architectural fact about transformers. Nothing public documents whether behavior-level unlearning satisfies an erasure obligation, at what rate relearning attacks reverse it, what a frontier retrain costs, or whether the “Learning to Unlearn” framing replicates outside its own test environments. The technical half of this guide rests on the structure of the problem rather than on measurements. Before acting on it, pull the preprint, pull the attack papers it builds on, and check whether any 2026 data-protection authority has issued guidance treating trained models as personal data. The legal frame is documented. The application to weights is not, and anyone selling you a button that says “unlearn” is selling the probe, not the forgetting.
Frequently Asked Questions
Does the GDPR erasure right apply to LLMs trained on data from before May 2018?
Yes, the regulation applies to processing activities ongoing after its effective date of 25 May 2018, regardless of when the data was originally collected. Since model weights persist and continue to process personal data through inference, the erasure obligation extends to pre-2018 training data if the conjunctive trigger conditions are met today.
How does the one-stop-shop mechanism affect the cost of defending a deletion dispute?
It limits the number of supervisory authorities involved to a single lead regulator, reducing the need for parallel legal defenses across multiple EU jurisdictions. However, it does not reduce the statutory fine ceiling of €20 million or 4% of global revenue, which remains the maximum exposure for the lead authority’s decision.
What is the primary technical difference between a deletion probe and a relearning attack?
A deletion probe tests whether the model outputs specific data, while a relearning attack attempts to fine-tune the model to recover suppressed information. The former validates output behavior, whereas the latter tests the persistence of latent knowledge in the weights, which is the critical gap for attestation.
Why is retraining from scratch considered the only defensible remedy for a tainted corpus?
Retraining ensures the disputed data never enters the gradient descent process, creating a provable absence of the information in the weights. In contrast, unlearning methods modify existing weights, leaving a residual risk that the data remains recoverable through adversarial extraction, which fails to meet the strict standard of erasure.
