Study Finds AI Firms Use Fake Opt-Out Forms

A privacy audit covering 38 data-collecting companies, reported by 9to5Mac, found a pattern of deceptive opt-out mechanisms, including fake opt-out forms, links hidden in fine print, routing users through multiple separate forms to complete a single request, and requirements to create accounts or pay subscriptions before an opt-out can be completed (9to5Mac). 9to5Mac reports that the audit flags major firms including Google, Meta, and OpenAI, and that people-search brokers such as Spokeo, Whitepages, and National Public Data did not offer a global opt-out of sale or transfer but only URL-by-URL removals (9to5Mac). 9to5Mac also reports that EPIC characterized ChatGPT's removal option as a filter on chatbot output rather than removal of underlying data; 9to5Mac quotes a spokesperson for OpenAI saying the company does not sell user data while acknowledging sharing limited data with marketing partners (9to5Mac).

The audit documents classic privacy friction and UI dark-patterns rather than novel technical exploits. Companies implement barriers at the user interface and process level, hidden links, multipart submission flows, and account or payment gating, that increase the operational cost for consumers to exercise privacy rights. For data brokers, the absence of a bulk sale/transfer opt-out in favor of individual-listing removal is a structural design choice that materially reduces effective opt-out coverage for indexed datasets.

Industry context: Regulators and privacy teams treat implementation friction as meaningful for compliance because practical accessibility of opt-out flows affects enforceability. For practitioners integrating third-party data or building downstream systems that rely on data brokers or model providers, these audit findings increase the compliance and data-governance burden: downstream controllers may need to verify not just vendor policies but actual opt-out efficacy. The inclusion of large platform names in the audit raises the visibility of these practices beyond niche brokers and could shape regulatory scrutiny.

Indicators an observer should track include:

• •follow-up audits or transparency reports by the named vendors
• •regulatory inquiries or enforcement actions citing obstructive opt-out designs
• •updates to privacy policy language that add explicit sale/transfer opt-out mechanisms
• •technical disclosure from vendors about how user removal requests affect datasets used for model training or inference

Observers should also watch for third-party tooling or standards that automate verification of vendor opt-out effectiveness.