The right to be forgotten under Article 17 of the GDPR also applies to AI providers, each separately. Delisting at Google, Bing and Brave does not stop ChatGPT, Gemini, Copilot, Claude or Grok from repeating information found in their training data or their own search systems. As of November 2026, OpenAI offers a dedicated erasure route for ChatGPT, while Google offers none for AI Mode or Gemini.
Last updated: November 7, 2026
What are the key takeaways on AI and the right to be forgotten?
Four points matter most for anyone in Europe who has already delisted a damaging story and still sees it repeated by an AI assistant.
- Delisting at Google, Bing and Brave does not stop ChatGPT, Gemini, Copilot, Claude or Grok from repeating what they found in training or through their own search systems.
- The right to be forgotten under Article 17 of the GDPR also applies to AI providers, each separately.
- As of November 2026, OpenAI has a dedicated right-to-be-forgotten route for ChatGPT, and Google has none for AI Mode or Gemini.
- In MediaMaze's experience, AI providers often demand an account and miss the one-month deadline.
Why does an AI assistant still tell the old story?
An AI assistant can still repeat a delisted story because it draws on at least three sources, and delisting at the search engines addresses only one of them. Imagine you have done everything right. A damaging article about you was delisted by Google, Bing and Brave under Article 17 GDPR, and searches for your name from anywhere in Europe no longer show it. Then a client mentions that ChatGPT told them about it anyway.
The delisting succeeded, but the AI assistant, a large language model (LLM), got the information somewhere other than the search results you cleaned up. In my earlier piece I covered delisting at Google, Bing and Brave. This piece is about the separate right you have against the AI providers themselves, how a request to them works, and whether they are willing to comply. It is based on more than 600 right-to-be-forgotten requests we have handled at MediaMaze, the Dutch reputation firm I founded in 2012. Today those requests also go to the LLM providers.
- Live search, through an index such as Google's, Bing's or Brave's. Delisting addresses this layer.
- The provider's own search systems. Several AI providers run their own crawlers and indexes, which a delisting decision by Google does not reach.
- The model itself, trained on large amounts of web text that may include the article about you.
For the second and third layer, you need to go to the LLM provider itself.
Does the right to be forgotten apply to AI assistants?
The right to be forgotten does apply to AI assistants, because the GDPR applies to the companies behind them just as it applies to search engines. Each of those companies is a controller in its own right.
OpenAI (ChatGPT), Google (Gemini, AI Mode, AI Overviews), xAI (Grok), Microsoft (Copilot), Anthropic (Claude), Mistral (Le Chat) and Perplexity offer their services in the EU. When their systems collect, store or generate information about you, your rights apply.
How do you ask an AI provider to apply the right to be forgotten?
The route for a right-to-be-forgotten request differs a lot per AI provider, so a person has to check each provider whose assistant repeats inaccurate or outdated information about them. Where Google, Microsoft and Brave have dedicated routes for search, the playing field for LLMs looks different. A decision by one company does not carry over to another: Google's delisting decision does not oblige OpenAI to do anything, and it does not even change what Google's own Gemini model took from its training data.
Which providers offer a route as of November 2026?
As of November 2026, OpenAI has gone furthest, and the others are a long way behind.
| Provider and assistant | Route for a right-to-be-forgotten request, as of November 2026 |
|---|
| OpenAI (ChatGPT) | Its help centre explicitly speaks of an "erasure", "right to be forgotten" or "objection" request under laws including the GDPR. A ChatGPT account is not needed, and the criteria are almost the same as Google's for search: role in public life, accuracy, age of the information, sensitivity, public interest and impact on the person. |
| Google (Gemini, AI Mode, AI Overviews) | No dedicated form. Google's delisting form covers search results only, so a request ends up in general privacy forms built for other products. |
| Microsoft (Copilot) | No dedicated route, but Copilot builds on Bing, so a page delisted at Bing for your name no longer reaches Copilot. |
| Anthropic (Claude) | Speaks of a deletion right. |
| Mistral (Le Chat) | Uses the words "right to erasure (right to be forgotten)", but means deleting your own account, which is of no use to someone named in an answer. |
Google is the clearest example. The company that has handled right-to-be-forgotten requests for search since 2014 has, as of November 2026, no such form for its AI products.
What should the request ask for?
A request to an AI provider should ask for three things, and it should be argued as carefully as a request to a search engine. The request is an argument, and the same experience counts. Explain per statement why it is inaccurate, outdated or about your private life, with no public relevance.
- Blocking outputs about you.
- Excluding the data from future training.
- Stopping the provider's own search systems from returning certain pages for your name.
If the information was already delisted at the search engines, include those decisions and their case numbers. They show that the balancing has been done before, and in your favour. Someone who knows those earlier decisions also knows which arguments carry over to an AI provider, and which do not. Note the date: the GDPR gives the provider one month to respond, extendable by two months only if it says so within the first month.
Are AI providers willing to comply with the GDPR?
On paper, AI providers are willing to comply, because all major AI providers state that the GDPR applies and most have published some route for requests. In practice, MediaMaze's experience is a lot less positive.
Providers set requirements they are not allowed to set, such as requiring you to create an account, or to send the request from the email address of an existing account, before they will look at it. That is hard to defend when a provider's own help centre says an account is not needed. The GDPR obliges a controller to facilitate the exercise of these rights, and allows it to ask for additional information only when it has reasonable doubts about your identity. European data protection authorities have made clear that a request may not be made conditional on opening an account. The person asking for an answer about them to be blocked is often precisely someone who does not want to use the service.
Other providers do not take the request into consideration at all. They reply with a standard text saying that the information is public, or that the model cannot be changed, without assessing the case. Deadlines are missed regularly: one month becomes three or more, without the notice of extension the GDPR requires. The processes are also unclear. You often do not know who decides, on what basis, or what has actually been done after a message saying that your request has been processed. You may need to keep up the pressure, by mail and post, and contact their lawyers if necessary, to reach the desired result.
What do European regulators say about AI providers and the GDPR?
European regulators are paying attention to how AI providers handle personal data. In December 2024 the Italian data protection authority fined OpenAI 15 million euros. The privacy organisation noyb filed complaints against OpenAI in Austria (2024), after OpenAI said it could not correct an incorrect date of birth and could only block information, and in Norway (2025), on behalf of a man whom ChatGPT falsely described as having murdered his children.
The GDPR contains no exception for what is technically difficult. If a controller cannot make its processing accurate, it has to stop processing the inaccurate data in another way, such as blocking the output. How exactly LLMs process a granted request remains unclear. A generally safe assumption is that they align with the way search engines do so: by removing the specific URLs as sources for all questions and answers involving the name of the applicant. A cruder measure would be to remove the specific URLs completely.
What can you do when an AI provider ignores your request?
When an AI provider ignores or rejects a request, you can file a complaint with the data protection authority in your own country, which will involve the authority where the provider has its European establishment. For several of the large providers that is the Irish Data Protection Commission.
The whole process will take many months, at minimum. The LLM providers grudgingly accept that the GDPR applies to them, but many are not yet set up to comply with it properly. So keep a record of every date and every reply, and escalate when an LLM provider does not do what it should do.
In what order should you act?
A person with a damaging story attached to their name should work from the outside in, starting with the search engines and ending with the AI providers.
- Ask the search engines first, as described in my earlier piece.
- Ask the AI providers next, with the delisting decisions in hand.
- Check again, across assistants and over time.
Each step needs knowledge that is not written down anywhere: how search engines and providers have answered earlier requests, what they label outdated or irrelevant, and which requirements they may not impose. An AI assistant cannot tell you, because those requests and answers were never in its training data.
Online reputation management in the age of AI is often described as a matter of feeding the models better content, and generative engine optimization (GEO) and the Everything-PR guide to AI reputation management cover that work. That approach has its place. But in Europe, for private individuals, that place is second place, after the legal requests. Organisations that want a wider view can read the corporate reputation management guide and Everything-PR research on how AI assistants cite sources.
