Data Brokers’ and AI Firms’ Opt-Out Forms Are Built to Fail, Report Finds

Some of the largest data-collecting companies in the United States—including major AI vendors , data brokers , defense contractors , and dating apps —rely on deceptive methods to keep consumers from opting out of the sale and sharing of their personal information, according to a new study from the digital rights nonprofit Electronic Privacy Information Center. Researchers at EPIC audited the opt-out processes of 38 major data companies and documented at least eight distinct categories of manipul

Consumers routed through multiple separate forms to complete a single request. And requirements that users create accounts or pay for subscriptions before opting out at all, among others. “Manipulative design has no place in opt-out requests,” EPIC says. “Companies must design opt-out processes with respect toward consumers’ rights, and if they do not, regulators at the state and federal level should step in to defend consumer rights to opt out.” Major companies offering large language models, such as Google, Meta, and OpenAI, fail to clearly link their opt-out forms from their homepages or privacy policies, according to the report, and several require consumers to submit multiple separate forms to complete a single request. OpenAI's form, when a consumer finds it, does not offer a way to opt out of the sale or transfer of personal data. What it offers instead is an option to “remove personal information from ChatGPT responses,” which EPIC says is a filter on the chatbot's output, not the removal of any underlying data. EPIC frames opt-out failures as a safety issue, pointing to, among others, the case of Vance Boelter , the man charged with murdering Minnesota state representative Melissa Hortman and her husband Mark in June 2025. Prosecutors say Boelter used people-search data brokers to locate his targets’ home address. EPIC's researchers found that the people-search brokers they audited—Spokeo, Whitepages, and National Public Data—do not offer consumers a way to opt out of the sale or transfer of their data at all. Instead, the companies offer a process for removing individual listings by URL, one at a time, with no commitment to stop selling that same person's information in the future. Spokeo tells consumers directly that their information “may reappear on Spokeo in the future without notice” and instructs them to “regularly check” the site for new listings. The EPIC report notes that abusive individuals have for decades used commercially available data and technology to locate, harass, and assault their targets, with women, women of color, and LGBTQ+ people bearing the brunt.

Key points

• Consumers routed through multiple separate forms to complete a single request.
• And requirements that users create accounts or pay for subscriptions before opting out at all, among others.
• “Manipulative design has no place in opt-out requests,” EPIC says.
• “Companies must design opt-out processes with respect toward consumers’ rights, and if they do not, regulators at the state and federal level should step in to defend consumer rights to opt out.” M…
• OpenAI's form, when a consumer finds it, does not offer a way to opt out of the sale or transfer of personal data.