# GDPR and Large Language Models: Technical and Legal Obstacles
## 1 Introduction
### Real-World Implementation Examples  
Although fully documented GDPR compliance cases for LLMs remain relatively scarce, a few noteworthy examples indicate industry movement toward addressing the Right to Erasure in practice. OpenAI, for instance, has introduced user controls allowing individuals to request deletion of conversation logs, which are then excluded from subsequent training updates [30]. Nonetheless, it remains unclear how effectively these logs can be \"unlearned\" from the core model parameters, as current unlearning methods often require resource-intensive retraining [31]. Similarly, Google has responded to EU regulatory pressures by refining its data usage policies and quarantining user data when erasure requests are granted [32].  
Preliminary evidence suggests that while user-facing deletion controls and opt-outs reduce the volume of retained data, selectively removing or editing data that has already shaped an LLM's internal parameters poses significant technical hurdles. Indeed, many solutions focus on filtering model outputs rather than permanently eliminating learned representations [30; 31]. Until more robust machine unlearning techniques achieve scalability and third-party validation, practical implementations of the Right to Erasure in large-scale LLMs will likely remain partial, relying on procedural measures (e.g., privacy policies, segmentation of training data, and post-deployment filtering) rather than guaranteed removal of all personal information from model weights.  
Moreover, LLMs are increasingly integrated into applications across various domains. In healthcare, they assist in diagnostics, facilitate patient communication, and summarize medical records [33]. In finance, they analyze market sentiment, automate customer service, and aid in fraud detection [34]. In the education sector, LLMs provide personalized tutoring and language learning support [35], while in customer service they power chatbots and virtual assistants to efficiently handle inquiries [36].  
Despite their impressive capabilities, LLMs raise several concerns related to data privacy, security, and ethical considerations. For instance, these models may inadvertently memorize and reproduce personal or sensitive information present in their training data, potentially leading to privacy breaches [37]. Recent work on securing sensitive data in LLMs has proposed comprehensive trust frameworks that incorporate adaptive output control and user trust profiling to dynamically manage the disclosure of sensitive information [38]. Such approaches emphasize the necessity of embedding trust mechanisms into LLMs, especially in domains where data sensitivity is paramount. They can also inherit and amplify biases found in the training data, resulting in discriminatory or offensive outputs [39]. Furthermore, the black-box nature of LLMs makes it challenging to interpret their decision-making processes, complicating accountability and trust [40]. Finally, the methods used to collect and process data for training LLMs may conflict with legal requirements regarding consent and data minimization, posing further challenges to legal compliance [41; 42].