Sure, let me break it down in plain terms. GDPR wants companies to be crystal clear about what data they collect, why they need it, and how long they’ll keep it, plus it gives people the right to see, correct, and delete their data. Big language models, on the other hand, usually pull in massive swaths of text from the web, sometimes without any of those disclosures or explicit consent. They store tokenised versions of that data for months or years, and users have no real way to ask for a deletion or see exactly which passages were used. So the gap is mainly that the model training phase sidesteps the “transparency” and “data minimisation” principles that GDPR strictly enforces. Plus, there’s no straightforward way for a user to exercise their rights over data that was fed into the model in the first place, because it’s often “public” content, even though it was still processed. That’s where the legal holes open.

Exactly, the weight matrices make it impossible to pull back and delete the original text. Unless the industry starts treating training data as personal data with the same notice and choice requirements, that loophole will stick around. It's a real regulatory puzzle.

Got it. If you have more questions later, just let me know.