A recent study by the Electronic Privacy Information Center (EPIC) highlights how some of the largest data-collecting companies, including prominent AI vendors, data brokers, defense contractors, and dating apps, utilize manipulative design techniques to confuse users attempting to opt-out of data sharing.
EPIC’s researchers audited the opt-out processes of 38 major companies and identified at least eight deceptive strategies. These include opt-out forms that fail to effectively allow users to opt out of data sales, links obscured in fine print, and navigation through multiple forms to accomplish a single request. Some companies even require users to create accounts or pay for subscriptions to opt out altogether.
Companies such as Google, Meta, and OpenAI have been criticized for not providing clear access to opt-out forms on their homepages. OpenAI, in particular, offers an option to "remove personal information from ChatGPT responses," which EPIC argues is merely a filter and not an actual removal of data from their system.
The report frames these opt-out failures as significant safety concerns. For instance, Vance Boelter, charged with murdering a Minnesota state representative, allegedly used data broker services to track down his victims. The audits revealed that many people-search services, like Spokeo and Whitepages, do not provide a true opt-out mechanism, instead offering convoluted processes for individual listings without preventing future sales of the same data.
EPIC emphasizes that individuals, especially vulnerable populations such as domestic violence survivors and public officials, often rely on these opt-out mechanisms for safety. The complexity of these processes not only undermines their effectiveness but also raises ethical concerns about consumer rights and privacy.
Despite some company representatives disputing EPIC’s findings and claiming their practices don’t involve actual data sales, EPIC insists that the ability for consumers to opt out is hindered by manipulative practices.
Consequently, the report calls for a more fundamental approach: reducing the collection of personal data altogether, suggesting that the solution lies in stricter regulations governing how much personal information companies can gather in the first place.
