Data Brokers’ Opt-Out Forms Fail Purposefully, Report Finds

Some of America’s most powerful data collectors,including major AI vendors, defense contractors, data brokers, and dating apps,are deliberately making it difficult for consumers to opt out of having their personal information sold or shared. That is the central finding of a new report from the Electronic Privacy Information Center (EPIC), a digital rights nonprofit.

EPIC researchers examined the opt-out processes of 38 large data companies and identified at least eight distinct categories of manipulative design. These include opt-out forms that do not actually allow users to stop the sale of their data, links hidden in fine print and missing from homepages, and processes that force consumers to navigate multiple separate forms just to complete a single request. Some companies even require users to create accounts or pay for subscriptions before they can opt out at all.

“Manipulative design has no place in opt-out requests,” EPIC states. “Companies must design opt-out processes with respect toward consumers’ rights, and if they do not, regulators at the state and federal level should step in to defend consumer rights to opt out.”

The report highlights how companies like Google, Meta, and OpenAI,all of which offer large language models,fail to clearly link their opt-out forms from their homepages or privacy policies. Several require consumers to submit multiple separate forms to complete a single request. In the case of OpenAI, the form a consumer eventually finds does not offer a way to opt out of the sale or transfer of personal data. Instead, it provides an option to “remove personal information from ChatGPT responses,” which EPIC describes as a filter on the chatbot’s output, not the removal of any underlying data.

EPIC frames these opt-out failures as a safety issue, pointing to the case of Vance Boelter, who was charged with murdering Minnesota state representative Melissa Hortman and her husband Mark in June 2025. Prosecutors allege Boelter used people-search data brokers to locate his targets’ home address.

EPIC researchers found that the people-search brokers they audited,Spokeo, Whitepages, and National Public Data,do not offer consumers a way to opt out of the sale or transfer of their data at all. Instead, these companies provide a process for removing individual listings one URL at a time, with no commitment to stop selling that same person’s information in the future. Spokeo explicitly tells consumers that their information “may reappear on Spokeo in the future without notice” and instructs them to “regularly check” the site for new listings.

The report notes that abusive individuals have for decades used commercially available data and technology to locate, harass, and assault their targets, with women, women of color, and LGBTQ+ people bearing the brunt. It cites a separate EPIC analysis from December 2025 on the use of data brokers against domestic violence survivors, and another on threats to public officials at every level of government. For people in those categories, the report argues, the opt-out is often the only mechanism available to remove a home address from circulation before someone shows up at the door.

“Many people may need to remove their information from Spokeo for safety reasons, such as domestic violence survivors or public officials and their families,” the report says.

The Whitepages opt-out process requires consumers to submit URLs for every listing of themselves on the site, but full reports are gated behind a paid Whitepages Premium subscription. This means people may have to pay the broker to find the information they need in order to opt out of it. Four other companies, including Bumble, default users into data sharing through preselected toggles. On Bumble, the “Do Not Sell” option is styled to look selected by default, when in fact it is the option a user must click to opt out.