Proven intentional data retention after deletion in Google AI Studio – official GDPR complaint submitted to the DPO

[Bitu79]

During the past weeks I have performed multiple fully documented tests inside my own Google account, and the results are now absolutely undeniable:

Google AI Studio does NOT delete user prompts, even after:

• deleting the prompt inside AI Studio,

• emptying the Google Drive Trash,

• and the system claiming that “no data remains.”

Despite this, the official Google Drive Recovery Tool can fully restore the supposedly deleted prompt, and the restored file immediately continues the previous AI session.

This is technically impossible unless Google never deletes the server‑side session data.

This is not a bug.
This is not a misunderstanding.
This is intentional, systemic data retention.

What this proves:

• The JSON file stored in Drive is NOT the actual chat.

• The AI Studio backend keeps the entire session alive even after “permanent deletion.”

• Restoring the JSON only re‑links the frontend to the already existing server‑side data.

• Therefore, the deletion process shown to the user is misleading and not real.

Evidence provided:

• uncut videos of the delete → trash empty → restore → session continuation process

• Google Drive Activity logs showing permanent deletion followed by successful restoration

• official Google recovery confirmation emails

• archived forum discussions documenting the issue

Official GDPR complaint submitted

Because this behavior violates GDPR Articles 5, 12, 17, and 25, I have submitted a formal GDPR complaint and a mandatory data access request (Article 15) to the Google Data Protection Officer.

I included the full evidence package and demanded:

• disclosure of all server‑side session data retained after deletion

• explanation of the retention mechanism

• legal basis for keeping deleted data

• identification of all systems, indexes, caches, and logs storing the data

• official acknowledgment that the “deleted” session was never deleted

Developers: you are required to respond

This issue is not theoretical.
It is not speculative.
It is proven, reproducible, and documented.

I expect a developer‑level response, not user‑level speculation, and not deflection to Drive documentation.
This is an AI Studio backend issue, not a Drive UI misunderstanding.

Below I attach the exact letter I sent to the Google DPO.

Evidence uploaded to the Internet Archive:

https://archive.org/details/kepernyokep-2026-06-12-054539/Képernyőkép%202026-06-12%20034525.png

[Bitu79]

https://web.archive.org/web/20260612035758/https://discuss.ai.google.dev/t/proven-intentional-data-retention-after-deletion-in-google-ai-studio-official-gdpr-complaint-submitted-to-the-dpo/170944

[Bitu79]

Google copied my deletion logic text, but they did it wrong, and the way their system works completely contradicts what the interface claims. The “Delete” button promises that the prompt will be permanently deleted after 30 days, but this is false. If I don’t empty the trash, the chat continues to work with the link for the full 30 days, which means the prompt is not deleted at all. If I do empty the trash, the UI lies and says “no such prompt”, but that is also false, because the JSON can still be restored for another 25 days using Google’s own recovery tool. The reality is that the prompt remains on the server for a total of 55 days: 30 days in the trash while the chat still works, and another 25 days after the trash is emptied during which it can still be restored. This means Google keeps claiming the deletion is permanent while the server continues to retain the data. Renaming the button doesn’t fix anything, because the underlying logic is still wrong and unlawful. Deletion is not deletion, the interface is misleading, and the actual behavior is provably the opposite of what they claim.

[Bitu79]

https://web.archive.org/web/20260612092728/https://discuss.ai.google.dev/t/proven-intentional-data-retention-after-deletion-in-google-ai-studio-official-gdpr-complaint-submitted-to-the-dpo/170944

[Bitu79]

More than a damn month has passed, and Google still hasn’t responded to my official GDPR request.
This alone is a separate GDPR violation, because they are legally required to respond within 30 days.

And here’s the point:

They’re not responding because any response would be an official admission that they read my complaint, saw the evidence, and know exactly that the deletion does NOT happen in the backend.

If they replied, they would be admitting:

• the session actually persists,

• the Drive Recovery Tool proves server‑side retention,

• the “permanent deletion” UI is misleading,

• the backend continues processing supposedly deleted data.

So they choose silence, because answering would incriminate them.

Their silence is evidence.
Missing the 30‑day deadline is evidence.
The retention is evidence.
The Wayback archive is evidence.
The Drive Activity logs are evidence.
The videos are evidence.
The letter to the DPO is evidence.

Now it’s not just proven that backend deletion doesn’t happen, but also that Google violated the mandatory GDPR response deadline.

This is KO.

Evidence video:

https://youtu.be/LBQfNbPCxQw

https://youtu.be/m4U6ajKuLRo

[Bitu79]

https://web.archive.org/web/20260718021731/https://discuss.ai.google.dev/t/proven-intentional-data-retention-after-deletion-in-google-ai-studio-official-gdpr-complaint-submitted-to-the-dpo/170944/print

[Bitu79]

this is Google’s own server log. (user_archive-Bitu79-260718-025112-2863.zip)

https://archive.org/details/user_archive-Bitu79-260718-025112-2863

[Bitu79]

https://web.archive.org/web/20260718030017/https://d3qe71uytubmmx.cloudfront.net/original/3X/8/8/88ce2d0550b864a7cf8576bd7c89f88d14b434ed.png

https://web.archive.org/web/20260718025923/https://discuss.ai.google.dev/t/proven-intentional-data-retention-after-deletion-in-google-ai-studio-official-gdpr-complaint-submitted-to-the-dpo/170944

[Bitu79]

https://archive.ph/56XRf

https://archive.ph/56XRf/image