The right that felt strongest
Deletion, we have written before, is a promise built on trapdoors: the retention windows, the compliance holds, the elastic exceptions that keep a "deleted" account warm for years. Which is why the quieter request always looked like the stronger one. Stop using my data. Stop the marketing, the profiling, the selling, the training. Keep the account if you must, keep the archive if the law makes you, but stop feeding me into the machine. No retention carve-out even applies. They can hold the data and still honour the ask.
On paper, that is the cleanest right you have. In practice, it has grown carve-outs of its own. Three of them.
Every settings page grew switches
Look at what apps now offer you, tucked a few menus deep. An ad-personalisation toggle. An off-platform activity control. A "Do Not Sell or Share My Personal Information" link, mandatory under one US state's law. The unsubscribe footer. The cookie banner's "reject all," when you can find it. And the newest arrival: the AI-training toggle. One network keeps it under privacy settings. A professional network added the toggle and, separately, a formal objection form. The largest platform accepts objections in Europe, where the law forces it to, and offers no guarantee anywhere else.
Notice the shape they all share. Every one of them was on before you knew it existed. Nobody walked you to any of them. The processing came first, enabled by a line you accepted years ago about "improving our services," and the switch came later, after the value had already been extracted. That ordering is not an accident of engineering. It is the deal.
Carve-out one: switches only work forward
Flip any of them today and today is when it takes effect. The profile built from years of your behaviour stays built. The data already passed to partners sits with whoever received it, on their servers, under their policies. And a model that has been trained on your posts does not untrain: nothing comes back out the way it went in. A switch is a valve on future flow. The reservoir behind it stays exactly as full as it was the moment before you found the setting.
Carve-out two: one switch, one use, one company
Each switch is narrower than it reads. Unsubscribe stops the sending; the profile that decided you were worth sending to stays live. "Do not sell" sounds absolute, but the first company ever publicly enforced against under that law had been handing customer data to ad and analytics partners in exchange for free services and calling it not-selling, while ignoring the browser signal that was flipping the switch automatically. It took a regulator to disagree.
And the AI-training toggle governs the platform's own training, nothing more. The terms you accepted include a worldwide, transferable, sublicensable licence to your content, the licence that outlives your account, and the AI market finally gave that boilerplate a price: one large discussion platform now licenses its users' posts to AI developers for tens of millions of dollars a year, per deal. "We do not sell your personal data" stays technically true throughout. Nothing was sold. The corpus was licensed, the licence was signed by you, and no settings page on earth reaches into someone else's training run.
Carve-out three: the formal ask resolves to their word
Behind all the switches sits the actual legal right, and it reaches further: a written objection covers profiling, targeted advertising, and training alike, across the whole company, and it forces a review no toggle ever triggers. But it ends the same way deletion does. The company must stop unless it decides its own "compelling legitimate grounds" outweigh yours, an assessment it performs on itself. Withdraw consent, and the same processing can carry on under a different legal basis they select from the menu. Even the opt-outs they do honour come with a dry footnote: to make sure they never contact you again, they keep you on a suppression list. Honouring "stop" is implemented as "keep."
Marketing objections they must always honour, everywhere. The rest resolves to a claim, exactly like "your data has been deleted" resolves to a claim, and we log claims, we don't believe them.
Where the stakes run deepest
This applies to every account you hold, but the order of urgency is not random. Social platforms hold a decade of posts, the messages you deleted your side of, the photos, the drafts of you at every age you have been since you joined: a working copy of how you think and speak, which is precisely what a language model is for. The training switches showed up there first because the data was worth the most there. The carve-outs showed up with them.
Do both moves, in order
The mistake is not the switch. The mistake is stopping at the switch, because a toggle is the one form of "stop" that produces no evidence at all. It works forward only, it covers one use at one company, and it does not even send you an email. You flipped it; you have nothing that says so, and nothing that says what happened before.
So run them in order. First, flip every control every app gives you: the ad settings, the do-not-sell links, the off-platform switches, the training opt-outs. Costs nothing, narrows the pipe. Then put the real request in writing: object to the processing that is not needed to run the service, ask what has already been shared and with whom, whether your data has been used to train models, and whether your content sits inside anyone else's licence. Assume they keep it. Assume they train on it. Their answer lands in your inbox with a date on it, and whatever it claims, it is the only artefact in this entire story that they cannot quietly reword later.
The switches narrow what happens next. The record proves what you asked, and when. Start your record →