An AI Training Opt-Out Cannot Recall Copies Already Made

Take one illustration stored at `example.com/portfolio/fox.jpg`. Its creator adds `Disallow: /portfolio/` to the site’s `robots.

txt` file, switches on an AI-training opt-out at the portfolio platform, and emails a model provider asking for removal. Meanwhile, the same image remains in a syndicated article, a repost, a web archive, and a dataset assembled months earlier.

That one file exposes the central problem with creator opt-outs: each control acts on a different layer. A website directive addresses crawlers visiting one host. A platform setting governs uses covered by that platform’s system and terms. A license controls parties bound by it.

A removal request targets a named copy, account, dataset, or provider. None automatically follows the image everywhere it has traveled.

The useful question is therefore not whether a creator has opted out. It is what the recipient must stop doing, with which copy, from what point forward, and whether anyone can verify compliance.

A robots.txt rule closes one collection route

A `robots.txt` file is a text file at the root of a website that tells identified web crawlers which paths they may fetch. In the illustration’s case, the creator might block OpenAI’s GPTBot or Google-Extended while leaving ordinary search indexing available through separately identified crawlers.

That separation matters. OpenAI documents GPTBot as the crawler used for content that may help train its generative models, while OAI-SearchBot supports search features. Google says the Google-Extended product token controls whether crawled content may help improve Gemini models and related generative systems without changing Google Search inclusion or ranking. A creator who writes only a blanket rule, or blocks the wrong user agent, may get a different result from the one intended.

The rule also depends on crawler compliance. The Robots Exclusion Protocol specification states that its rules are “not a form of access authorization.” A bot can ignore them, and the file does not prevent a person, browser extension, contractor, or another site from downloading the public image. Authentication, signed URLs, paywalls, and network access controls restrict retrieval more directly, though they also reduce reach and add account or infrastructure costs.

Timing is the harder limit. When GPTBot next visits `example.com`, the new rule can tell it not to fetch `/portfolio/fox.jpg`.

The file does not contact a dataset operator that collected the image last year, alter a Common Crawl snapshot, or place instructions inside a repost hosted elsewhere. Each domain publishes its own crawler rules. The creator controls the canonical host, not the mirror.

Server logs can at least provide a receipt for future traffic. They may show whether a declared user agent requested the blocked path after the rule changed, although user-agent strings can be forged and a missing request does not prove that no other collection route existed. Robots.txt is valuable as a prospective signal.

It is weak evidence of deletion.

A platform switch governs the platform’s copy

Account settings can reach uses that robots.txt cannot. A portfolio or social platform may store private uploads, interaction data, prompts, captions, or high-resolution originals that a public crawler never sees. Its AI setting can tell the operator not to use eligible account data for its own model development, or not to share that data with named collaborators, depending on the wording shown beside the switch.

The wording is the control surface. “Do not use future posts to train our models” has a narrower effect than “do not use your content to develop or improve generative AI,” and neither necessarily covers models trained before the preference was recorded. Settings may also distinguish public posts from private interactions, first-party models from outside partners, and training from retrieval, where a system fetches a source at response time rather than learning it into model weights.

For `fox.jpg`, switching the setting on may flag the platform’s stored copy or emit metadata such as a `noai` marker. It cannot edit the syndicated article or force an unrelated scraper to honor that marker. If the platform previously licensed or transferred a dataset under terms that allowed continued use, its ability to retrieve every downstream copy will depend on those contracts rather than the current account interface.

A useful settings screen should identify the covered data, affected models or partners, effective time, and treatment of earlier training runs. If it offers only a toggle and a broad assurance, the creator has expressed a preference but has little evidence about execution.

License changes do not travel backward automatically

Licensing terms work through permission and contract, not crawler mechanics. A site owner can state that content may not be used for machine learning, place conditions in a commercial license, or require dataset customers to delete files when an agreement ends. Those terms can create obligations for parties that accepted them. They do not physically prevent copying, and whether a scraper became contractually bound can depend on how the terms were presented and the governing law.

Earlier grants present another constraint. Creative Commons licenses, for example, are generally irrevocable for recipients who follow their terms. Replacing a permissive license on `fox.jpg` with an all-rights-reserved notice can restrict new grants from the creator, but it does not automatically cancel a valid license someone already received.

Whether a particular license permitted model training remains a disputed legal question in several jurisdictions; changing the label today does not resolve the status of yesterday’s copy.

The European Union has moved machine-readable reservations closer to a compliance requirement. Article 53 of the AI Act requires providers of general-purpose AI models to maintain a copyright policy that can “identify and comply with, including through state-of-the-art technologies, a reservation of rights” made under the EU text-and-data-mining rules. For online works, those rules contemplate rights reservations expressed through machine-readable means.

That requirement is enacted, but its operational boundary is still being tested through standards, provider practices, and enforcement. It does not declare that every robots.txt rule has identical legal meaning worldwide, nor does it promise retroactive removal from models. The obligations apply to newer general-purpose AI models on the EU timetable, while models already on the market before August 2025 have a longer transition ending in August 2027.

Removal has several technically different meanings

A removal email should name the object and the requested operation. “Delete my art from AI” leaves too many possibilities: take down a hosted file, exclude it from a future training dataset, remove a search result, delete a stored prompt, stop producing a close match, or alter a released model.

The first operations are tractable. A host can delete `fox.jpg`; a search service can de-index its URL; a dataset maintainer can remove a row and record its hash, which is a compact fingerprint used to identify matching files. Those actions still leave backups, transformed versions, and copies under other URLs unless the operator searches for them and has authority to remove them.

Changing an already trained model is different. Training adjusts large collections of numerical parameters called weights so that the system becomes better at predicting patterns across its data. A work usually does not occupy one separable slot. Its influence may overlap with captions, duplicates, related images, and prior training, while memorized examples can sometimes be reproduced more directly.

A provider can block prompts or outputs, fine-tune behavior, apply machine unlearning methods intended to reduce a training example’s influence, or rebuild a later model without the identified files. Each remedy answers a different claim. An output filter can stop a known image from appearing while leaving the underlying weights unchanged; retraining offers a cleaner provenance story but costs substantial compute and still requires finding duplicates before the run begins.

For the creator of `fox.jpg`, a credible response would specify which source records were removed, which future training runs will exclude them, whether deployed model weights changed, and how the provider tested for close reproduction afterward. “Removed from our systems” is not enough if it quietly means that one support attachment was deleted.

Build an opt-out around evidence, not one switch

The practical setup starts at the canonical copy. Publish bot-specific crawler rules, preserve the dated version, and check server logs for later requests. Use platform settings as well, then save the policy text shown when the choice was made because interfaces and partner lists can change.

Keep the original file, publication record, license history, and URLs of material reposts. If a removal becomes necessary, send the provider identifiers it can act on: exact URLs, file hashes, account IDs, dataset references, or example outputs. Ask it to separate source deletion, future-training exclusion, deployed-model changes, and output suppression in its answer.

Access restrictions remain the stronger technical choice for unreleased or high-value work. They also undermine public discovery, search traffic, and frictionless sharing. Once `fox.jpg` is publicly downloadable, every additional legitimate copy creates another collection point whose rules and contracts the creator may not control.

Questions people ask

Does robots.txt legally stop an AI company from training on my work?

Robots.txt records a machine-readable instruction, and EU rules give rights reservations growing compliance significance. The protocol itself is voluntary and explicitly does not authorize or deny access. Any legal effect depends on jurisdiction, the instruction used, the company’s conduct, and other applicable terms or rights.

Can a platform opt-out remove posts from models already trained?

Only if the platform says it will address existing models and can explain how. Many settings govern future use or future sharing. Removing a stored post is technically separate from retraining a model, applying unlearning, or filtering outputs, so the setting’s scope and effective date matter.

What should I ask for in an AI removal request?

Identify the exact URLs, files, accounts, dataset entries, or outputs at issue. Ask whether the provider will delete stored copies, exclude matches and duplicates from future training, modify deployed models, or only suppress outputs, then request a completion record and the policy that covers downstream recipients.

Is keeping work offline the only reliable opt-out?

It is the strongest way to prevent public web collection, but private services, collaborators, and licensed recipients can still create copies under their own rules. Authenticated delivery or limited-resolution previews reduce exposure more than metadata alone, at the cost of reach, search visibility, and convenience.