Can the FTC make a buyer delete a model trained on your data?

The short answer

Not on your behalf. The FTC has ordered companies to delete models built from data the FTC said they collected or used unlawfully, like Everalbum, also known as Paravision, in 2021. The orders I found all came from consumer cases, so put deletion terms in your contract.

1FTC charges thecompany2Order namesthe models3Deleted, with aswornstatementIn the Everalbum order, the models builtfrom users' photos had to go within 90 days.1FTC charges thecompany2Order names the models3Deleted, with a swornstatementIn the Everalbumorder, the models builtfrom users' photos hadto go within 90 days.

The remedy is often called algorithmic disgorgement, because it reaches the model as well as the data. The FTC has used it several times, though it covers less than the name suggests.

What did the Everalbum order require?

Everalbum ran Ever, a photo storage app.

The FTC's January 2021 Everalbum announcement says the FTC alleged the company deceived Ever users about face recognition and about deleting their photos.

The FTC said Everalbum turned face recognition on by default for all mobile app users at launch, used their photos to build its own face recognition technology and kept deactivated users' photos after promising to delete them.

The final Everalbum Decision and Order, issued 6 May 2021, names "Everalbum, Inc., also d/b/a Ever and Paravision." Its deletion section required three things:

  • photos and videos of users who had deactivated their accounts, deleted within 30 days
  • face embeddings made without users' express consent, deleted within 90 days
  • any models or algorithms developed "in whole or in part" from Ever users' biometric data, deleted within 90 days

Each deletion needed a written statement to the FTC, sworn under penalty of perjury. The order runs for 20 years. The FTC's announcements list no money payment.

Did Paravision actually delete the models?

It says so. In a Paravision compliance report filed with the FTC in 2022, the company, renamed Paravision, Inc. on 7 September 2021, states that it sent the written statements the order required, confirming each deletion on time.

That is the company's own report to the regulator.

Has the FTC ordered model deletion in other cases?

Yes. The FTC's announcement of the WW International and Kurbo order, dated 4 March 2022, says the order required deleting children's data collected without parental consent, destroying algorithms derived from it and paying a $1.5 million penalty.

Orders against Rite Aid and Avast, announced in December 2023 and February 2024, required the same kind of deletion for face images and browsing data. Both are covered in what the FTC says about retroactive terms.

What does model deletion cover?

Read the Everalbum order closely and the reach has edges:

  • The data's origin. The model clause reaches models built from biometric data collected from Ever app users, the data at the center of the FTC's charges.
  • Derived work. Models built "in whole or in part" from that data are covered, so mixing it with clean data doesn't save the model.
  • The company named. The order binds the respondent, its successors and people acting with it who get notice of the order.
  • Proof. Deletion is confirmed in a sworn statement to the FTC.

What does this mean for your contract?

It cuts two ways.

First, the model-deletion orders I found all came from consumer cases. None enforced a business's license, so don't count on the FTC to undo a model if a buyer breaks yours.

Write the deletion terms yourself: the trigger, the deadline, whether derived data and trained models are included, backups, and a signed confirmation. Our deletion page lists what to look for in a draft.

Second, the risk can run back to you. My reading of these orders: if your records were collected under notices that don't cover an AI license, the buyer's model is what's at stake. That's analysis.

The nearest case is Avast, where the order reached what its subsidiary Jumpshot built from data the FTC says was sold against promises to users. No order I found has applied it to a company licensing its own records to an outside AI buyer.

Buyers ask for reps and warranties about lawful collection and consent. The rights check gathers what your customers and staff were told.

Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral