Major AI companies and data brokers use deceptive designs to block opt-outs, EPIC report reveals

Major Tech Firms Employ Manipulative Design Tricks to Block Data Sharing Opt-Out

The Electronic Privacy Information Center has released a damaging privacy study exposing how AI companies and data brokers systematically obstruct consumer data protection efforts. The EPIC report, published Wednesday, audited 38 major data-collecting companies and documented at least eight distinct categories of deceptive designs that prevent users from opting out of the sale and sharing of their personal information1

1

. The findings reveal that major AI vendors, data brokers, defense contractors, and dating apps rely on these tactics despite privacy laws in 21 states requiring clear, easy-to-use opt-out mechanisms2

2

.

Google, Meta, and OpenAI Fail to Provide Clear Access

Major companies offering large language models face particular scrutiny in the report. Google, Meta, and OpenAI fail to clearly link their opt-out forms from their homepages or privacy policies, and several require consumers to submit multiple separate forms to complete a single request1

1

. OpenAI's form presents an especially problematic case: it does not offer a way to opt out of the sale or transfer of personal data at all. Instead, it provides an option to "remove personal information from ChatGPT responses," which EPIC characterizes as merely a filter on the chatbot's output rather than actual removal of underlying data1

1

. An OpenAI spokesperson's response appeared contradictory, stating the company does not sell user data while acknowledging it shares limited data with marketing partners for targeted and cross-context behavioral advertising3

3

.

Dark Patterns Range From Hidden Links to Fake Forms

The research documents a troubling array of manipulative design patterns that confuse and discourage consumers from protecting their personal data. Companies employ opt-out forms that don't actually let users opt out of data sales, bury links in fine print, route consumers through multiple separate forms for a single request, and require users to create accounts or pay for subscriptions before opting out1

1

. Dating apps like Grindr and Bumble use preselected checkboxes or toggles that exploit the "default effect," a cognitive bias where people tend to stick with pre-selected options2

2

. Bumble's interface styles the "Do Not Sell" option to appear selected by default when it's actually the option users must click to opt out1

1

.

People-Search Brokers Present Severe Safety Risks

Data brokers specializing in people-search services demonstrate the most egregious violations of consumer rights. Spokeo, Whitepages, and National Public Data do not offer consumers any way to opt out of the sale or transfer of their data. Instead, they provide only a process for removing individual listings by URL, one at a time, with no commitment to stop selling that person's information in the future1

1

. Spokeo explicitly tells consumers their information "may reappear on Spokeo in the future without notice" and instructs them to " regularly check" the site for new listings1

1

. Whitepages requires consumers to submit URLs for every listing but gates full reports behind a paid Whitepages Premium subscription, potentially forcing people to pay the broker to find information they need to opt out1

1

.

Real-World Consequences Include Doxxing and Harassment

EPIC frames these opting out of data sharing failures as serious safety issues with documented consequences. The report cites the case of Vance Boelter, charged with murdering Minnesota state representative Melissa Hortman and her husband Mark in June 2025, with prosecutors alleging he used people-search data brokers to locate his targets' home address1

1

. "When opt-out processes use manipulative design patterns, they only give the illusion of choice instead of giving people real autonomy over their personal information," said EPIC Counsel and co-author Caroline Kraczon, noting these design choices enable doxxing, stalking, and targeted harassment2

2

. The risks disproportionately affect women, women of color, and LGBTQ+ people, with domestic violence survivors and public officials particularly vulnerable2

2

.

Regulatory Intervention and Stronger Privacy Laws Needed

EPIC recommends multiple paths forward requiring action from companies, policymakers, and regulators. Companies should evaluate their opt-out processes for manipulative design patterns and conduct ongoing audits to ensure they're not sharing information from users who have opted out2

2

. The FTC could use its Section 5 authority, which bars unfair or deceptive business practices, to protect consumers from these tactics2

2

. State attorneys general should evaluate whether companies comply with state opt-out laws, while more states should adopt data deletion programs similar to California's that allow consumers to request data brokers delete personal information with one request2

2

. The report urges states to strengthen privacy laws with data minimization standards that limit companies to collecting and sharing only data reasonably necessary to provide their services2

2

. "Manipulative design has no place in opt-out requests," EPIC states, calling for regulators at state and federal levels to defend consumer rights to opt out1

1

.