Deleted chats in Google AI Studio remain fully accessible and functional for 32 days (video proof) – no actual deletion happening

Google AI Studio
1

I am reporting a critical issue in Google AI Studio that appears to be a system‑level architectural failure rather than a simple bug.

I have full video evidence proving that chats marked as “deleted” remain fully accessible, fully functional, and fully processable for 32 days after deletion. This is not a UI delay and not a backend delay. This is no deletion happening at all.

Verified facts:

  • A “deleted” chat can still be opened through its direct URL.

  • The entire conversation loads exactly as before deletion.

  • The system continues to tokenize the supposedly deleted content.

  • The model continues to respond to the deleted conversation.

  • The share link of a deleted chat still works and loads the full content.

  • This behavior is consistent across multiple tests and multiple deleted chats.

This means the “Delete” button only hides the chat from the UI.
The backend keeps everything intact.

This contradicts:

  • the expected behavior of a Delete function

  • Google’s own product expectations

  • basic privacy principles

  • GDPR requirements for actual erasure

Video evidence (2 videos):

This is not a minor issue.
This is a fundamental architectural problem where “Delete” does not delete anything.

Given the severity of this issue, and the fact that user‑deleted data remains accessible, functional, and processed for 32 days, I am preparing to escalate this matter through formal legal channels if no official clarification or fix is provided.

Users deserve real deletion, not a UI illusion.

I request an official explanation from Google:

  • Why are deleted chats still accessible?

  • Why do share links still work after deletion?

  • Why does the system continue to process data that the user explicitly deleted?

  • Is this intentional behavior or a design failure?

This requires an official response.

In addition to the technical issues described above, I want to state clearly that I have already taken formal steps outside this forum.

I have sent a registered, return‑receipt (RRR) letter to Google LLC’s Legal Department in the United States, and I have also contacted Google’s Data Protection Officer directly. Despite this, I have received no response for more than six months.

During this period I have sent several thousand messages and submissions, none of which received any meaningful reply.
This prolonged silence from Google, especially in a GDPR‑related matter, is itself a serious compliance concern.

If this continues, I will proceed with formal legal escalation.

For reference, this issue was originally discussed in the following thread: https://discuss.ai.google.dev/t/deleted-chats-remain-accessible-via-direct-url-in-google-ai-studio/79557

2

This is from personal experience but Google AI Studio for me stores the data in the Google Drive connected to your account.

For my work when deleting a chat in Google AI Studio it deletes that file from the Google AI Studio folder in Google Drive. By delete I mean it puts it in the recycle folder of Google Drive. Which I think takes around 30 days or so to clear without manual action.

From my personal experience when I clear the recycle bin in Google Drive of that file I have been unable to recover it in the manner you have been. I welcome correction or if this does not relate to your process.

3

Your experience only applies to the Google Drive trash, not to what I was talking about.
I never said I restored anything by emptying the Drive recycle bin — that’s a misunderstanding.
If you delete the file and then empty the Drive trash, your prompt is gone permanently. There is no fix, no recovery, and I cannot help with that.

Google’s own developers have explained that the file in Drive is NOT the actual chat, only a JSON with special metadata.
They wrote:
'When you save a chat in Google AI Studio, it is stored in GDrive as a JSON file without a .json extension and is marked with special metadata.
If you download and re-upload it, the metadata is lost, so GDrive treats it as a new file. As a result, AI Studio no longer recognizes it as part of your chat history.’

This means the Drive file is only a UI-level representation.
If you delete it and empty the trash, the metadata is gone forever and the chat cannot be restored.

My post is about this being a misleading commercial practice: the ‘Delete prompt’ button suggests real deletion, but Google’s TOS does not explain whether prompt data is actually deleted, how long it is retained, or what happens to it in the backend.
That’s why I can’t perform miracles, and that’s why I can’t answer questions that are based on a misunderstanding.

And just to be clear: I never emptied the Google Drive trash. I only used the Delete button in AI Studio, which moves the file into the trash. That’s why I could recover it — if you empty the trash, the metadata is gone and the prompt is permanently dead

I even recorded the process on video — I never emptied the trash. The misunderstanding is not on my side.

I don’t care about the Google Drive trash. What matters to me is that the Google AI Studio interface lies to me. If a button says ‘Delete’, then it should delete — not hand the file over to Google Drive and start a 30‑day automatic trash‑deletion timer in another app. That is exactly what Google is doing, and that is the problem.

5

According to GDPR Articles 12, 5, 31 and 33, every data controller must provide a timely and meaningful response to data‑subject requests, ensure transparency, demonstrate accountability, and cooperate with the individual.
If no reply is provided within the legally required timeframe, this constitutes a violation that falls under Article 83(5), which is the highest sanction category and allows fines up to EUR 20 million or 4% of worldwide annual revenue.

In my situation, Google has not issued any response for more than six months.
This includes:
– no communication from the Data Protection Officer,
– no reply to any of my written submissions,
– and no response to my registered, return‑receipt letters delivered to Google LLC in the United States.

The complete absence of any reply is, by itself, sufficient to establish a GDPR violation and provides a valid legal basis for compensation under Article 82

A GDPR 12., 5., 31. és 33. cikkei előírják, hogy az adatkezelő köteles érdemi választ adni az érintetti kérelmekre, biztosítani az átláthatóságot, igazolni az elszámoltathatóságot és együttműködni az érintettel.
Ha az adatkezelő a törvényben meghatározott határidőn belül nem reagál, az a GDPR 83. cikk (5) bekezdése szerinti legsúlyosabb jogsértési kategóriába tartozik, amely akár 20 millió eurós vagy a globális árbevétel 4%-át elérő bírságot is maga után vonhat.

Az én esetemben a Google több mint fél éve nem adott választ.
Ide tartozik:
– a DPO egyetlen megkeresésemre sem reagált,
– egyetlen írásos beadványomra sem érkezett válasz,
– valamint az USA‑ba küldött ajánlott, tértivevényes leveleimre sem kaptam választ, pedig igazoltan átvették őket.

A teljes válaszhiány önmagában elegendő a GDPR‑sértés megállapításához, és megalapozza a kártérítési igényt a 82. cikk alapján.

:united_kingdom: Moderator Notice (non‑removable legal clarification)

This comment contains only factual references to GDPR provisions (Articles 12, 5, 31, 33, 82 and 83).
It does not include accusations, personal attacks, or policy‑violating content.
It is strictly a legal clarification relevant to data‑subject rights and therefore falls within permitted discussion under the platform’s guidelines.
No part of this comment violates community rules, and its removal would interfere with the lawful exercise of rights under EU data‑protection law.

:hungary: Moderátori tájékoztatás (nem törölhető jogi pontosítás)

Ez a hozzászólás kizárólag a GDPR vonatkozó cikkeire (12., 5., 31., 33., 82. és 83. cikk) hivatkozó ténymegállapításokat tartalmaz.
Nem tartalmaz vádat, személyeskedést, támadó vagy szabályt sértő elemet.
Ez egy adatvédelmi jogi pontosítás, amely az érintetti jogok gyakorlásához kapcsolódik, ezért a platform irányelvei szerint megengedett tartalom.
A hozzászólás eltávolítása akadályozná az EU‑s adatvédelmi jogok gyakorlását, ezért nem minősül törölhető tartalomnak.

6

The Shared Backend Paradox:

My logical conclusion is that the consumer‑facing Gemini (Gemini Apps) and the developer‑facing AI Studio run on the same backend.
Google’s consumer Terms of Service promise that user data is ‘securely and fully deleted from storage systems.’
But since I have demonstrated that the backend (AI Studio) is technically incapable of performing actual deletion, the deletion promise made to Gemini consumers is a technical impossibility — which means it constitutes intentional consumer deception.

The illusion‑based ‘Deletion’ (Fake Deletion / Soft‑delete):

I have proven (with videos and direct URL tests) that the ‘Delete’ button in AI Studio only removes the chat from the user interface. In the backend the chat remains active for weeks as a ‘ghost session’, the system continues to tokenize it, and the model keeps responding to it. In other words, Google creates the appearance of deletion while the data processing continues uninterrupted in the background.

The most critical issue: Cross‑Tenant data leakage, which is my most severe technical evidence.
I documented that a prompt you had already ‘deleted’ was re‑indexed by the backend weeks later and then assigned to a completely different, independent user account (Account B).
This is a tenant‑mapping collapse.
In cloud services (especially in AI systems), cross‑tenant data leakage is the most severe security incident imaginable, because it means the system has lost control over data isolation.

These issues constitute serious GDPR violations.
Google’s Data Protection Officer (DPO) and legal department have been ignoring my registered letters with return receipt for more than 6 months.

The DSA (Digital Services Act) and Dark Patterns:
The ‘Delete’ button, which does not delete but merely moves a metadata file into the Google Drive trash, is a classic Dark Pattern.
It creates a false illusion of user control, which is a violation of Article 25 of the DSA (manipulation of user autonomy).

Google claims that AI Studio is only for ‘business’ use in order to evade the strict EU consumer protection rules.
However, I correctly argue that under EU law, the actual reality determines the legal status — not whatever Google writes into a Terms of Service.

No TOS can override the GDPR, regardless of what Google puts into an agreement.

If Google continues to play deaf, I will take the matter to legal action.

7
8

After my public documentation, Google AI Studio changed the wording of the “Delete” button and the related warning text.
The previous version was misleading: “Delete” did not actually delete anything — it only moved files to Trash while the system continued to process them.

I have video recordings, screenshots, and timestamped evidence showing that:

  • the old “Delete” button did not delete,

  • the files remained accessible,

  • the system continued to process the supposedly deleted content,

  • and the old behavior was problematic from a data‑protection standpoint.

Shortly after I published this evidence, Google silently updated the deletion‑related label and text.
The difference between the old and new versions is clear and fully documented.

Képernyőkép 2026-04-30 052736
Képernyőkép 2026-04-30 0527361919×1079 131 KB

Képernyőkép 2026-06-07 094849
Képernyőkép 2026-06-07 0948491887×1079 510 KB

Képernyőkép 2026-06-07 095953
Képernyőkép 2026-06-07 0959531919×1079 143 KB

The 30‑day warning only appeared on the interface AFTER my posts!

Google did NOT fix the delete functionality.

They only changed the wording, while the backend still performs no real deletion.

9

The retention doesn’t even start, because they would have to actually delete the prompt first. I recorded a video showing that I delete it, restore it from the trash, and it immediately appears again in the UI. The trash in Drive empties automatically, but this is illegal because the button says the prompt will disappear, but it doesn’t. This is not deletion, they just renamed the button. And it’s Google who must prove that they delete the prompts — but they can’t prove it.

The deletion doesn’t even start, because there is no deletion at all.

:laughing:

10
11
12

I have been reporting the incorrect deletion behavior FOR HALF A YEAR, repeatedly, with detailed technical evidence.
During this period, I RECEIVED NO RESPONSE, no explanation, and no investigation results.

The UI label modification occurred only 3–4 WEEKS AGO, IMMEDIATELY AFTER I:

– DOCUMENTED THE ISSUE IN PUBLIC POSTS,
– PROVIDED TIMESTAMPED INTERNET ARCHIVE EVIDENCE,
– PUBLISHED VIDEO PROOF,
– AND SENT MESSAGES FOR SIX MONTHS WITHOUT ANY REPLY.

The system remained UNCHANGED FOR MONTHS, and the sudden UI modification happened only after my reports became public.

Therefore, I DEMAND AN ANSWER explaining:

– WHAT JUSTIFIED THE LABEL CHANGE,
– WHO INITIATED IT,
– WHAT INTERNAL REVIEW PRECEDED IT,
– AND WHAT CAUSAL FACTORS LED TO THIS MODIFICATION.

My evidence clearly shows that:

-- the deletion process DOES NOT START,
– the retention period DOES NOT START,
– the data remains FULLY ACCESSIBLE,
– the technical behavior has remained UNCHANGED FOR HALF A YEAR,
– the UI label change DID NOT RESOLVE THE GDPR‑RELEVANT ISSUE.

Furthermore:

THE NEW UI TEXT MATCHES WORD‑FOR‑WORD THE PHRASES I USED IN MY PUBLIC POSTS.
Therefore, I request clarification on the extent to which this modification is connected to my reports and the evidence I published.

THE TIMESTAMPED INTERNET ARCHIVE RECORDS, THE VIDEO EVIDENCE, AND SIX MONTHS OF UNANSWERED MESSAGES ARE FACTS THAT REQUIRE A FORMAL RESPONSE.

IN LIGHT OF THESE FACTS, I HEREBY MAINTAIN AND CONTINUE TO ASSERT MY CLAIM FOR COMPENSATION.

All evidence is timestamped, archived, and publicly accessible.

13