Outbound Forms of Data Brokers and AI Firms Are Built to Fail, Reports Find

EPIC researchers were unable to find a way to log out of Meta, X, OpenAI, and Tinder without logging in first. And HireVue and vendor management DataTrust set their opt-out guidelines as available only to California residents, although 20 other states have passed opt-out laws.

Palantir, secure and smart, offers a privacy form on its website but doesn’t include the ability to log out or share personal information — something EPIC has documented for TikTok, Amazon, and gunsmith SoundThinking. Palantir also does not explicitly link features from its homepage or its privacy policy, and the researchers were unable to find any way to log out of Palantir, Meta, X, OpenAI, or Tinder without logging in first.

Amazon denied the findings. Adam Montgomery, a spokesman for the company, says Amazon does not sell customer information, so customers are randomly selected. Options to opt out of data sharing are available through the “Your Advertising Privacy Choices” and “Advertising Preferences” pages, and through privacy on many Amazon devices.” Montgomery says Amazon doesn’t use the word “sharing” in its options, but said those options use the same terms defined by applicable law.

Shane Bauer, a spokesman for OpenAI, says the company does not sell user data, although it does agree to share limited information with marketing partners for targeted and targeted advertising. “We give people simple ways to control how their data is used directly in our apps, so those choices are easy to make when people are using our services,” says Bauer. “Ours Privacy Portal is another way for people to submit privacy requests, including people who don’t have an OpenAI account but still want to exercise their privacy rights. We think that giving users multiple ways to exercise their rights is a good thing. “

Jackie Quintana, a spokesperson for HireVue, disagrees with EPIC’s findings in the development, saying that the company’s privacy policy applies to people who visit their business website, and not to employers, whose data is processed through the HR platform of HireVue under the approval rules that are prepared by each employer. The company did not respond to EPIC’s finding that its public-facing policies only provide advice to California residents.

John Fisher, a spokesman for SoundThinking, says the company’s exit forms can be found below. secret pagealong with a customer service phone number.

Google, Meta, Spokeo, Whitepages, National Public Data, Bumble, X, DataTrust, Palantir, TikTok, did not respond to a request for comment. Tinder acknowledged the request but did not immediately make a statement.

“Customers cannot protect their privacy by using the right to opt out,” says EPIC. Even a perfectly designed system—no buried links, no pre-selected toggles, no paywalls—would still require people to find and submit a request to any company that stores, sells, or transfers their data. The real way, EPIC concludes, is not the best types but limited collection: laws that prevent companies from collecting personal information they didn’t want in the first place.