LLM Attribution and Compliance: GDPR, CCPA, and Your Data

Sending order or customer rows to an LLM provider is processing on your behalf, and GDPR Article 28 says that needs a contract with specific terms. The fast check: list the columns of the last file you gave a model, because a Shopify orders export includes email addresses, phone numbers, names and billing and shipping addresses. Recorded enforcement puts the risk in proportion, and is no reason to skip the contract: CMS counted 2,685 fines to 1 March 2026, averaging EUR 2,277,122.

What does the evidence say about exposure?

• Fines. The law firm CMS publishes a GDPR fines tracker (published by CMS, not independently audited). Its 2026 report, cut off on 1 March 2026, counts "a total number of 2,685 fines" and says "the average fine was EUR 2,277,122 across all countries". It adds that "only very few fines" were imposed for "missing data processing agreements".
• Memorisation. Carlini et al. (arXiv, revised 2021) attacked GPT-2, trained on scrapes of the public internet, and extracted "hundreds of verbatim text sequences" from its training data, including (public) personally identifiable information: names, phone numbers and email addresses. No public measurement was found of API inputs resurfacing for other users.

Is an attribution export personal data?

Often. GDPR defines personal data as information about an identifiable person, including through "an online identifier" (Article 4(1)), and Recital 26 says pseudonymised data that "could be attributed to a natural person by the use of additional information" is still information on an identifiable person, so a hashed email or a pseudonymous ID can still count. The CCPA reaches information that "could reasonably be linked, directly or indirectly, with a particular consumer or household" (section 1798.140(v)(1)). GA4's BigQuery export is "raw event and user-level data". A channel-by-day table has no per-person row; whether it is personal data for you is your DPO's call.

What must the processor agreement cover?

Article 28(3) says processing by a processor "shall be governed by a contract" that sets out the subject-matter and duration, the nature and purpose of the processing, the type of personal data and the categories of data subjects. It must stipulate, among other things, that the processor:

• processes the data only on your documented instructions, including for transfers to a third country;
• binds the people handling it to confidentiality and takes the security measures the regulation requires;
• engages another processor only with your authorisation, on the same obligations;
• helps you answer data subjects' requests;
• deletes or returns the data when the service ends, at your choice;
• gives you what you need to demonstrate compliance, and allows audits.

Who the processor is depends on the route. Anthropic's page says it covers services "where Anthropic is the data processor", and that on Amazon Bedrock and Google Cloud the cloud provider is. OpenAI's page says abuse monitoring logs "may contain certain customer content, such as prompts and responses" and are by default retained for up to 30 days, longer where the law or safety requires it. The CCPA has a parallel: section 1798.100(d) requires an agreement limiting disclosure to "limited and specified purposes", and a "service provider" is defined by a written contract that prohibits selling or sharing the information.

What do you run today?

1. List the columns of the last file or table you gave a model, and mark each personal one: email, phone, name, address, IP address, or an ID that links back to a person.
2. Search the logs. Search your prompt history, or the tool's logs, for "@" and for your order ID format. Pass: no hits. Fail: any hit means row-level data left.
3. Check your records. Article 30(1) says your record of processing lists the categories of recipients, including recipients in third countries. Is the provider there?
4. Check the contract against the six points above.
5. Send aggregates. Article 5(1)(c) asks for data "adequate, relevant and limited to what is necessary". For a question about channels, send channel by day, not rows; an LLM can still draft and explain queries on that table.
6. Check deletion. Under section 1798.105(c)(1) of the CCPA, a business must "notify any service providers or contractors to delete the consumer's personal information from their records". Can your process reach the provider's copy?

This reads the texts; it isn't legal advice. Your DPO decides what applies to you.

Sources, 30 September 2026: Regulation (EU) 2016/679 (Official Journal, 2016); California Civil Code, Title 1.81.5 (CCPA) (California Legislature, 2026); GDPR Enforcement Tracker Report 2026: Numbers and Figures (CMS law firm, 2026); Extracting Training Data from Large Language Models (Carlini et al., arXiv, 2021); Data controls in the OpenAI platform (OpenAI, 2026); API and data retention (Anthropic, 2026); Export orders (Shopify, 2026); BigQuery Export (Google, 2026).

Related answers

• The security risk of feeding marketing data to LLMs
• Does an LLM leave an audit trail for attribution numbers?
• GDPR in plain language
• Data privacy in plain language
• How to check EU data residency and GDPR posture for an analytics tool