CCPA/CPRA data subject rights — handling 'opt-out of sale' for data shared with ML model training

The CCPA/CPRA 'opt-out of sale or sharing' requirement creates interesting technical challenges when personal data has been used to train ML models. Jurisdiction: US Unlike a database record you can delete, model weights are not reversible. When a user exercises their opt-out right, do you: 1. Exclude their data from future training runs only (forward-looking) 2. Attempt to untrain (machine unlearning — expensive, imprecise) 3. Retrain from scratch without their data (prohibitive at scale) We're currently using approach #1 with a data exclusion list that feeds into our training pipeline. But the legal interpretation of 'sharing' under CPRA might require more aggressive action. How are ML teams handling this intersection of data subject rights and model training?