A Level1Techs researcher has documented technical evidence that Google AI Studio's Delete function does not remove conversation data from backend servers, only from the user interface—a potential GDPR violation.
Testing showed that after deletion and emptying trash, restoring a JSON pointer file from Google Drive caused the full conversation to reappear unchanged, proving the data was retained server-side.
The researcher formally reported the issue to Google's Data Protection Officer and published detailed evidence; Google later changed the Delete button's warning text but did not fix the underlying problem, prompting the researcher to threaten legal action under EU data protection law.
What happened
A researcher documented that Google AI Studio's Delete button does not remove conversation data from Google's servers, only hides it from the user interface. The researcher performed a JSON restoration test: after deleting a conversation and emptying Google Drive trash, restoring only the JSON pointer file caused the entire conversation to reappear with the same link and context intact. The researcher reported the issue to Google's Data Protection Officer and published evidence on Google's developer forum.
Why it matters
Under GDPR, deletion must actually remove personal data from backend storage, not merely hide it from users. The researcher claims Google changed the Delete button's warning text (copying the researcher's own wording months after the issue was reported) but did not fix the underlying retention behavior — which could constitute data protection violation and concealment. Google received the report via email and indexed all documentation through its own search system, establishing awareness of the issue.
What to watch
The researcher states they have filed a compensation claim under GDPR Article 82 and reserve the right to initiate civil proceedings, contact the Irish Data Protection Commission, or pursue EU-level legal remedies if Google does not respond to a follow-up letter.
Ask the AI about this article →
The researcher's claim rests on a technical distinction between client-side and server-side data storage. Google AI Studio stores two things: a JSON file in the user's Google Drive (which contains metadata and serves as a pointer to the backend conversation) and the actual conversation data on Google's servers. The researcher argues that Google's Delete button only removes or hides the JSON pointer, leaving the backend data intact. The JSON restoration test is intended as proof: if restoring a file from Drive storage—which has no access to Google's backend—causes a full conversation to resume, the backend copy must have survived deletion.
The researcher also notes that Google's own search indexing system read and cached all the documentation of this issue, which under the researcher's interpretation legally establishes Google's awareness of the problem. The timing claim—that Google changed the Delete button's warning text weeks after the researcher published the explanation—is presented as evidence that Google learned from the disclosure but chose UI modification over backend fix. This framing aligns the accusation with GDPR Article 82 (right to compensation for material or non-material damage) and suggests potential concealment, since a misleading delete function that retains data could harm users' data protection rights.
For example, today's edition would include:
AI-summarized, only the topics you pick — one digest a day via Email, Slack, or Discord.
Free · takes 30 seconds · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. Q&As are published on this page for other readers too.
A UK study by UK AI Security Institute and Limbic AI surveyed 6,474 British adults
Broadcom's Clayton Donley says companies are doing mission-critical work with AI agents quickly, but without t…
Bank of England governor Andrew Bailey warned that advanced AI poses risks to financial infrastructure in a le…
As AI agents perform real business tasks, 'Agentic Identity' (giving each AI a unique employee-like ID) and 'D…
Andrew Bailey, head of the world's financial stability watchdog, warned in a letter to G20 finance ministers a…
The European Union is expanding regulation of ChatGPT and will mandate protections for minors
