Pressing delete produces an immediate and convincing result. The item disappears from view and the interface confirms the action.
What happened underneath is usually different. In most systems the record is marked as removed rather than erased, because immediate destruction is slower, breaks references, and eliminates any possibility of recovering from a mistake.
What the operation typically does
The common implementation sets a flag indicating the record should no longer be returned. The data remains until a background process removes it, which may run daily, weekly, or after a defined retention period.
This is sound engineering rather than deception. It makes deletion fast, reversible during a grace period, and safe against a fault mid operation. It also means the gap between disappearance and destruction is real and is rarely stated.
Where the copies actually live
| Location | Reached by deletion |
|---|---|
| Primary database | Yes, eventually |
| Search index and caches | Usually, with delay |
| Backups | No, until they expire |
| Application and access logs | Rarely |
| Analytics warehouse | Rarely |
| Third parties already sent the data | No |
| Models trained on it | No |
The lower half of that table is where the difficulty concentrates, and none of it is visible from the interface that reported success.
Backups are the honest exception
Backups exist to restore a system to a previous state, which requires them to be immutable. Selectively editing them would defeat their purpose and is not supported by most backup systems at all.
Deleted records therefore persist in backups until those backups age out, commonly after thirty to ninety days. Providers generally acknowledge this, and it is a legitimate limitation rather than an evasion.
Derived data usually survives
Deleting a source record does not remove what was computed from it. Aggregate statistics, behavioural segments, and recommendation weights all persist, because they no longer contain the original record in any retrievable form.
Models trained on the data are the strongest version of this. Removing a specific example from a trained model is not a supported operation, which means content used for training before a deletion request cannot be withdrawn from it afterwards.
Closing an account is not deletion
The two are routinely conflated and they are different operations. Closing an account commonly disables access while retaining the underlying records, on the reasoning that the person may return and that the data supports fraud prevention and legal obligations.
Some services offer both a deactivation and a deletion path, with only the second triggering removal, and the first is usually the more prominent option. Where only one is offered, it is worth establishing which of the two it actually performs before assuming.
What the legal right covers
Where a right to erasure exists it is genuine and enforceable, and it is narrower than commonly assumed. It typically applies to personal data held by an identifiable controller, and it is subject to exceptions where retention is required by other law, needed for legal claims, or serves an overriding public interest.
It also relies on the controller propagating the request to processors and to parties it shared with, which is an obligation on paper and an operational challenge in practice, particularly where the data has passed through several hands.
What actually works
Reduce what is created, since data never collected requires no deletion and appears in no backup. Prefer services that state retention periods explicitly, because a stated period is a commitment while silence is not. Exercise the right where it exists, accepting it as partial rather than complete.
And treat anything published openly as permanent, because copies made by others are entirely outside any deletion mechanism.
Note: the practical assumption worth holding is that deletion removes data from the interface and from the primary store, and leaves it in backups, logs, derived datasets, and anywhere it was already sent. The only reliable control is at the point of collection.