Comment by try_the_bass

While your example isn't exactly coherent (I don't think GDPR would cover photos/videos taken by the user, unless maybe the user was in the photo/video?), presumably they could just train the model again without that user's data. I doubt the end result would be that much different