Opt-out theater

Every privacy policy has an exit door. Researchers keep checking whether the doors open.

Mostly, they don't. Or they open onto another form.

The audit

In May 2026, Wired reported (opens in a new tab) on an audit by the Electronic Privacy Information Center (EPIC) of the opt-out processes at 38 companies, including major AI developers and data brokers. EPIC found at least eight categories of manipulative design.

Some of the details are almost funny, in a tired sort of way. EPIC couldn't find an opt-out on Meta, X, OpenAI or Tinder without first logging in. OpenAI's form offers to "remove personal information from ChatGPT responses," which EPIC describes as an output filter. In other words, the information may still be there. The model just tries not to repeat it.

Several companies, including Amazon, OpenAI, Palantir and Spokeo, disputed parts of the findings. That's fair, and worth noting. But even taking the disputes into account, the picture isn't one of exit doors that swing open easily.

The signal test

A second set of tests looked at something simpler. Most browsers can now send a standard signal, called Global Privacy Control, that tells websites "don't sell or share my data." No forms, no logins. The browser says it on your behalf.

In a March 2026 audit of sites in California, webXray, which audits websites for privacy compliance, found that 55% of sites set advertising cookies despite the opt-out signal, according to TechRadar (opens in a new tab). Google's failure rate was 86%. The Record (opens in a new tab) reported Microsoft at 50% and Meta at 69%.

The companies pushed back hard. Google called the research a "fundamental misunderstanding of how our products work." Meta called it a "blatant marketing ploy."

I want to be precise about what this test measured. It was about advertising cookies, not about whether AI companies train on your data. I'm not suggesting those numbers carry over to AI training. I'm pointing out that even the simplest, most standardized opt-out we have is, at best, contested.

Even the researchers agree on the fix

Here's the part I find most telling. After auditing 38 companies' opt-out processes, EPIC's conclusion wasn't "build better forms." It was less collection.

That's the right instinct, and it applies well beyond consumer privacy. Every opt-out depends on someone else doing the right thing after you've already handed something over. It's a request. The company receiving it decides how, when, and whether to honor it.

It's worth remembering the default, too. A Stanford HAI study (opens in a new tab) in October 2025 found that all six major US AI developers it reviewed use people's chat data to train their models by default. Opting out, where it exists, is the user's job.

What this means for firms

For a person, a failed opt-out is annoying. For a firm handling client records, patient information, case files or financial data, it's a different kind of problem. Once sensitive material has gone into someone else's system, getting it back out depends on their processes, their honesty and, increasingly, their technical ability to undo what a model has already learned.

Take a simple hypothetical. A team pastes a few client documents into a public AI tool to speed up a summary. Later, someone realizes those documents shouldn't have left the firm. The team goes looking for the opt-out. Maybe they find it. Maybe it requires an account login nobody remembers creating. Maybe it removes the data from future outputs but says nothing about what's already been used. Every one of those outcomes depends on someone else's choices.

Now compare that with a firm that decided, ahead of time, which categories of data are allowed to leave its environment, which tools are approved for which work, and where the sensitive work happens instead. That firm doesn't need an opt-out for its most sensitive material, because it never opted in.

You can't opt out of a cloud you never upload to

This isn't an argument against cloud services, or against using AI. Plenty of work is perfectly fine to send out, and the convenience is real. It's an argument for drawing the line deliberately, before the upload, rather than hoping to redraw it afterward.

In practice, that means a few unglamorous decisions. Sort your data by sensitivity, in plain language people actually use. Decide which categories may go to outside services, and under what terms. Make sure the approved path for sensitive work is easy, so nobody needs to improvise. And write down who made each of those calls.

Choosing where data goes is a decision for people, made up front. It shouldn't be made by a default setting, and it certainly shouldn't be left to a form you fill in afterward.

An opt-out is a request. Not sending the data in the first place is a decision.