Data protection frameworks give people the right to have their information deleted. Applying that right to a trained model runs into a technical problem with no clean solution.
Why deletion is straightforward elsewhere
In a conventional system, personal data sits in identifiable records, and deletion removes them along with their copies and backups.
The operation is verifiable. Afterwards you can search for the record and confirm it is gone.
That verifiability is what makes the right meaningful, since a promise to delete is worth little without a way to check.
What training actually does with a record
Training adjusts model parameters incrementally across the whole dataset, so a single example contributes small changes distributed across billions of values.
There is no location where that example is stored and no operation that reverses its contribution, because the same parameters encode everything else as well.
The information is present in the sense that the model may reproduce it, and absent in the sense that it cannot be located and removed.
Why retraining is not a general answer
Retraining without the record produces a model genuinely free of its influence, and it costs the full price of training.
Doing so for each deletion request is impossible at any realistic request volume, and batching requests means people wait months for compliance.
Retraining also produces a different model, which then requires re-evaluation and redeployment, so the cost extends well past the compute.
What is used instead
Output filtering blocks the model from producing specific information, which addresses the visible harm without touching the parameters.
Approximate unlearning methods aim to adjust parameters to suppress a specific example's influence, and they work partially while degrading nearby behaviour.
Both are mitigations rather than deletions, and describing either as compliance requires an interpretation of the right that regulators have not uniformly accepted.
Where the pressure is landing
Regulators have concentrated on the input side, since a record never included in training needs no deletion afterwards.
That pushes obligations towards lawful collection, documented provenance and the ability to exclude a source before a run begins, all of which are achievable in a way that retrospective removal is not.
The practical consequence is that the decision point for personal data has moved to the moment a dataset is assembled, and organisations that cannot say what went into a training run have no defensible position once a request arrives.