Want to Opt Out of Your Data Being Sold, Shared or Used? Good Luck

Read the fine print. And even that might not help. A new report reveals that some of the world’s largest online platforms, including Google, Meta, Amazon and TikTok, make it very difficult for users to opt out of the collection and use of their data.

In its report, Good Luck Opting Out — Manipulative Design Patterns in Opt-Out Processes, the digital privacy advocacy group and e-privacy advocacy group Privacy Information Center examined the opt-out procedures of 38 large companies that collect customer data.

Many of these companies use “dark patterns” in their opt-out processes, the investigation found. This term refers to intentionally misleading, guiding, or pressuring consumers into allowing the collection, sharing, and sale of their data through deceptive or confusing methods on companies’ websites and apps.

Too many companies deny their customers real choice over how their personal data is used, EPIC attorney Caroline Kraczon said in a statement. “For people facing increased risks, including stalking, doxxing or targeted harassment, these barriers can have serious real-world safety consequences,” Kraczon said.

Asked by CNET for comment, a Meta spokesperson highlighted the company’s public confidentiality terms. “As we explicitly state in our privacy policy, we do not sell any of your information to anyone and we never will.” However, this policy states that Meta shares customer information with other companies and that “some information is necessary for our products to work. Other information is optional, but without it the quality of your experience may be affected.”

Representatives for Google and OpenAI, both mentioned in the EPIC report, did not immediately respond to requests for comment.

Learn more: A Guide to Data Removal Services: Should You Pay for Privacy?

The report highlights the real-world consequences of the widespread dissemination of personal information online due to the buying, selling and sharing of data by brokers and other businesses. Vance Boelter, the man accused of killing Minnesota Congresswoman Melissa Hortman and her husband Mark last year, used “people search” data brokers to find out where they lived.

“For decades, violent individuals have also used technology and data to locate, stalk, and harass, intimidate, assault, and even murder others, primarily affecting women, women of color, and LGBTQ+ people,” the report said.

Twenty states, including California, Texas and Florida, have laws requiring companies to allow customers to opt out of data collection. used, shared and sold.

But misleading opt-out processes hinder this legislation, according to the EPIC study. Researchers identified eight patterns that companies use to make it difficult to unsubscribe, such as not including an unsubscribe link on the home page, requiring customers to fill out multiple forms, using confusing and/or deceptive language, and requiring customers to log in or pay for a subscription before unsubscribing.

The report reveals that Meta, Google, TikTok, OpenAI, Whitepages and Tinder – among 15 companies – “did not clearly link their unsubscribe form to the homepage.” TransUnion, one of the “big three” credit reporting agencies, requires its customers to submit multiple forms to opt out, as do people search sites Whitepages and Spokeo.

EPIC also found that White Pages – used by more than 30 million people each month – require users to provide the URLs of profiles containing their information. That’s fair enough, but you may have to pay for a White Pages subscription to see these reports. EPIC also said that Whitepages hides some pages behind a paywall.

Spokeo describes itself as “an industry leader in respecting consumer privacy preferences.” However, its opt-out page also states that “your information may reappear on Spokeo in the future without notice” and that people should continue to check the site in case new listings appear.

Harrison Tang, Spokeo’s chief operating officer and co-founder, told CNET that while his site collects publicly available information from a variety of sources, consumers “should have control of their data.”

Tang said Spokeo “does its best to remember each consumer’s privacy preferences so that if Spokeo receives public information about the consumer in the future, it will not automatically reappear or be made available for sale.”

The investigation found that some companies checked the “opt-in” box by default on their opt-out pages, including ride-hailing companies Uber and Lyft and dating apps Grindr and Bumble, so that “consumers must click the button or checkbox to opt-out.”

EPIC’s Kraczon told CNET that there are now tools consumers can use to stop companies from using their data. One of them is called Global Privacy Control – a request not to sell or share – which “sends an opt-out signal to every site you visit as you browse the web.” Kraczon said 12 states require businesses to comply with universal opt-out preference signals.

Kraczon said Californians can “submit a deletion request” with the state’s new Deletion Request and Opt-Out platform, “which allows Californians to send a signal to all data brokers operating in the state to delete and stop selling their information.”

Justin Sherman, scholar in residence at EPIC and author of the report, said companies are undermining privacy rights and public trust through deceptive opt-out processes.

“Manipulative design has no place in privacy,” Sherman said in a statement. “Businesses must remove these barriers, and regulators must step up enforcement to ensure that consumers can meaningfully control how their personal data is collected, sold and shared.”