Read the fine print. And even that might not help. A new report found some of the largest online platforms in the world — Google, Meta, Amazon and TikTok among them — are making it very difficult for people to opt out of their data being collected and used.
In its report, Good Luck Opting Out — Manipulative Design Patterns in Opt-Out Processes, the digital privacy and advocacy group Electronic Privacy Information Center examined the opt-out procedures for 38 major companies that collect customer data.
Many of these companies use “dark patterns” in their opt-out processes, the investigation found. That term refers to intentionally tricking, guiding or pressuring consumers to allow their data to be collected, shared and sold through deceptive or confusing methods on company websites and apps.
Too many companies deny their customers true choice over the use of their personal data, EPIC Counsel Caroline Kraczon said in a statement. “For individuals facing heightened risks, including stalking, doxxing, or targeted harassment, these barriers can have serious real-world safety consequences,” Kraczon said.
Asked by CNET for comment, a Meta spokesperson pointed to the company’s public privacy terms. “As we say explicitly in our Privacy Policy, we don’t sell any of your information to anyone and we never will.” However, that policy says Meta does share customer information with other companies and that “some information is required for our products to work. Other information is optional, but without it, the quality of your experience might be affected.”
Representatives for Google and OpenAI, both mentioned in the EPIC report, didn’t immediately respond to requests for comment.
Read more: A Guide to Data Removal Services: Should You Pay for Privacy?
The report noted the real-world consequences of personal information being widely available online due to the buying, selling and sharing of data by brokers and other businesses. Vance Boelter, the man charged in the murder of Minnesota lawmaker Melissa Hortman and her husband Mark last year, used “people search” data brokers to find out where they lived.
“For decades, abusive individuals have likewise used technologies and data to locate, hunt down, and harass, intimidate, assault, and even murder other people, predominantly impacting women, women of color, and LGBTQ+ people,” the report said.
There are 20 states — including California, Texas and Florida — that have laws requiring businesses to let customers opt out of data collection. used, shared and sold.
But deceptive opt-out processes hamper that legislation, the EPIC study found. Researchers identified eight patterns that companies use to make it hard to opt out, such as not including an opt-out link on the home page, requiring customers to fill out several forms, using confusing and/or misleading language and requiring customers to log in or pay for a subscription before opting out.
The report found that Meta, Google, TikTok, OpenAI, Whitepages and Tinder — among 15 companies — “did not clearly link their opt-out form from the homepage.” TransUnion, one of the “big three” credit bureaus, forces customers to submit several forms to opt out, as do people-search sites Whitepages and Spokeo.
EPIC also found that Whitepages — used by more than 30 million people each month — requires people to indicate the URLs of profiles containing their information. Fair enough, but you might need to pay for a Whitepages subscription to see those reports. EPIC also said Whitepages hides some pages behind a paywall.
Spokeo describes itself as “an industry leader in respecting consumers’ privacy preferences.” However, its opt-out page also states that “your information may reappear on Spokeo in the future without notice” and that people should keep checking the site in case new listings appear.
Spokeo COO and co-founder Harrison Tang told CNET that, even though his site harvests publicly available information from various sources, consumers “should have control over their data.”
Tang said that Spokeo “does its best to remember each consumer’s privacy preference so that, if Spokeo receives public information about the consumer in the future, it won’t automatically reappear or be available for sale.”
The investigation found that some companies have the “opt-in” checkbox selected by default on their opt-out pages, including ride-hailing companies Uber and Lyft and dating apps Grindr and Bumble, so “consumers must click the toggle or checkbox to opt out.”
EPIC’s Kraczon told CNET there are tools consumers can use now to prevent companies from using their data. One of those is called the Global Privacy Control — a Do Not Sell or Share request — that “sends an opt-out signal to every site you visit while browsing the web.” Kraczon said 12 states require companies to honor universal opt-out preference signals.
Kraczon said people in California can “submit a deletion request” with the state’s new Delete Request and Opt-out Platform, “which allows Californians to send one signal to all data brokers operating in the state to delete and stop selling their information.”
Justin Sherman, EPIC’s scholar in residence and an author of the report, said companies are degrading privacy rights and public trust with deceptive opt-out processes.
“Manipulative design has no place in privacy compliance,” Sherman said in a statement. “Companies must eliminate these barriers, and regulators must step up enforcement to ensure that consumers can meaningfully control how their personal data is collected, sold, and shared.”
