gdpr

GDPR erasure and copyright takedowns require pulling a user's influence out of trained weights, not just deleting a dataset row. The signal is knowing why deletion falls short and where retrain, SISA, and approximate scrubbing each sit on the cost-versus-proof curve.

Deleting a row is trivial. Removing a person's influence from embeddings, caches, derived datasets, and a trained model is not. GDPR and CCPA demand it regardless. Here is the plan that survives an audit.

Consent and retention decide whether you can lawfully train on data and how long you may hold it. The signal is purpose limitation, granular consent, enforceable TTLs, and a plan for deleting data already baked into a model. Here is the answer.

Most teams stop their governance work at 'we can explain the decision.' The obligation, and the interview signal, is what happens after the user reads the explanation and says it is wrong.