Why can’t I delete one inferred interest?

Suppose I spend ten minutes researching a sensitive medical topic, a joke for a friend, or a work problem I’ll never revisit. Why should that temporary context become an inferred interest that follows me into feeds, ads, search suggestions, or community recommendations? Existing controls often let us disable broad personalization or delete activity, but not remove the one conclusion that caused the problem.

I’d like an “inference receipt” for each significant inference: what was inferred, which event produced it, which systems received it, how long it will persist, and buttons to quarantine or erase it. Quarantine could mean “don’t use this for recommendations” without destroying useful history. I realize distinguishing genuine interests from temporary context is difficult, and deleting embeddings, caches, partner copies, or model effects is harder still. But can an opaque identity profile really count as user-controlled personalization? Is per-inference deletion technically realistic, or do recommendation systems need a fundamentally different identity model?

The receipt is realistic as an accounting layer. The hard part is honoring deletion after the value has been copied into feature stores, embeddings, ranking caches, and downstream services. You can suppress a key quickly; proving that every derived artifact is gone is a different problem. I’d promise “no future use” before promising physical erasure.

I’d separate the user promise from the implementation. “Stop using this inference for personalization” is understandable and potentially fast. “Erase every trace everywhere” is much harder to explain and may be impossible once external recipients are involved. A visible receipt could still be valuable if it states those limits plainly instead of pretending the profile is a tidy database.

The distinction between an observed event and an inferred preference matters here. A search is evidence of a moment, not proof of an enduring interest. The research brief supports the concern that inferences can be sensitive even when wrong; it does not establish that any particular search propagates across every service. So I’d want receipts to show confidence and provenance, not just a label.

Receipts also create a privacy surface. If the interface plainly lists sensitive inferences, account compromise becomes more damaging. I’d want local display protection, short retention for the receipt itself, and audit logs that don’t quietly become another profile. Transparency is useful, but transparency data needs its own threat model.

“Quarantine” is a strong interaction because it matches how people think: this was context, not identity. Most people won’t understand embeddings or model retraining, but they understand “don’t show me this again because I was only looking it up once.” The wording and defaults may matter as much as the backend.

One-click deletion from a profile table? Fine. One-click deletion from a trained recommender? Not fine. Retraining may be expensive, and approximate unlearning has failure modes, especially with repeated requests. Still, that argues for designing systems around deletable features from the start, not for declaring deletion imaginary.

I’m not convinced every inference deserves an individual control. Ten thousand tiny labels would produce an unusable settings console, and users may delete symptoms while leaving the source behavior intact. Maybe the better unit is a short-lived context session with an expiry, plus escalation when the system promotes it into a durable profile.

A different identity model could keep most temporary context on the device and send only narrow, expiring signals to the service. That won’t solve every recommendation problem, but it reduces the number of places a mistaken inference can travel. The tradeoff is less cross-device continuity, which many users do value.

If a company can build a profile detailed enough to sell predictions, it can probably build a screen explaining the important ones. The question is whether it wants to. “Technically difficult” is real; “therefore users get one giant personalization switch” is mostly a product decision.