ML models improve with more data, but privacy requires collecting less. This creates a fundamental tension: Data hunger — models need large, diverse datasets to perform well. GPT-4 was trained on trillions of tokens from the internet. Privacy rights — individuals have the right to control their personal data, know how it’s used, and request its deletion. Memorization risk — ML models can memorize and leak training data. LLMs have been shown to reproduce phone numbers, email addresses, and even copyrighted text from their training data. Re-identification — even “anonymized” data can be re-identified. Researchers have shown that 87% of the US population can be uniquely identified by zip code, birth date, and gender alone. Privacy-preserving ML techniques aim to resolve this tension.

The General Data Protection Regulation (GDPR, 2018) is the world’s most influential data protection law. Key principles for AI: Lawful basis — you need a legal basis to process personal data (consent, legitimate interest, contract). Data minimization — collect only the data you need, nothing more. Purpose limitation — data collected for one purpose can’t be used for another without consent. Right to access — individuals can request a copy of their data. Right to erasure (“right to be forgotten”) — individuals can request deletion of their data. Right to explanation — individuals can request meaningful information about automated decisions. Data Protection Impact Assessment (DPIA) — required for high-risk processing. Penalties: up to €20M or 4% of global annual turnover.

Differential privacy (DP) provides a mathematical guarantee: the output of an analysis doesn’t change significantly whether any single individual’s data is included or not. In practice, this means adding carefully calibrated noise to the data or the model’s gradients during training. The privacy parameter ε (epsilon) controls the privacy-utility trade-off: smaller ε = more privacy but less accuracy; larger ε = less privacy but more accuracy. DP-SGD (Differentially Private Stochastic Gradient Descent) applies DP during model training by clipping gradients and adding Gaussian noise. Used by Apple (keyboard predictions), Google (Chrome usage stats), and the US Census Bureau (2020 Census). DP is the gold standard for privacy because it provides provable guarantees, not just heuristic protection.

Federated learning (FL) trains a model across multiple devices or organizations without sharing raw data. Instead of sending data to a central server, the model goes to the data: (1) the server sends the current model to each client, (2) each client trains on its local data, (3) clients send only model updates (gradients) back to the server, (4) the server aggregates the updates (e.g., FedAvg) and updates the global model. Raw data never leaves the client device. Used by: Apple (Siri, keyboard predictions), Google (Gboard next-word prediction), hospitals (collaborative medical AI without sharing patient records). Limitation: model updates can still leak information about the training data (gradient inversion attacks), so FL is often combined with differential privacy.

When a user exercises their “right to be forgotten” (GDPR Art. 17), you must delete their data. But what about the model that was trained on it? The model has memorized patterns from that data. Simply deleting the raw data doesn’t remove its influence from the model. Machine unlearning aims to remove a specific individual’s contribution from a trained model without retraining from scratch. Approaches: Exact unlearning — retrain the model from scratch without the deleted data (expensive but guaranteed). Approximate unlearning — modify the model to approximately remove the data’s influence (cheaper but less certain). SISA training (Sharded, Isolated, Sliced, Aggregated) — train on data shards so you only retrain the affected shard. This is an active research area with no perfect solution yet.

Data minimization is a core GDPR principle: collect only the personal data that is strictly necessary for the specified purpose. For ML, this means: Feature selection — don’t include features “just in case.” Every feature increases privacy risk. Retention limits — delete data when it’s no longer needed for training or evaluation. Aggregation — use aggregated statistics instead of individual records when possible. Synthetic data — generate synthetic training data that preserves statistical properties without containing real personal information. Anonymization — remove direct identifiers (name, SSN) and apply k-anonymity or l-diversity. But remember: true anonymization is very hard. Pseudonymization (replacing identifiers with tokens) is not anonymization.

LLMs create unique privacy challenges: Training data extraction — researchers have extracted verbatim training data from GPT models, including phone numbers, email addresses, and copyrighted text. Prompt injection for data leakage — attackers can craft prompts to extract system prompts, RAG context, or other users’ data. Conversation logging — users share sensitive information in chat (medical symptoms, legal issues, personal problems). Who owns this data? How long is it retained? Fine-tuning data leakage — models fine-tuned on proprietary data can leak that data through careful prompting. Embedding privacy — text embeddings stored in vector databases can be inverted to reconstruct the original text.

Privacy-by-design means building privacy into the system from the start, not bolting it on after. The checklist: Data collection — minimize what you collect, get informed consent, document the legal basis. Data storage — encrypt at rest and in transit, implement access controls, set retention limits with automated deletion. Model training — consider differential privacy (DP-SGD), use federated learning where possible, design for unlearning (SISA). Deployment — PII detection on inputs and outputs, data retention policies for logs, on-premise option for sensitive data. User rights — implement data access, deletion, and portability APIs. Provide clear privacy notices. Governance — conduct Data Protection Impact Assessments (DPIAs), appoint a Data Protection Officer (DPO), regular privacy audits.