PRESS RELEASE: EPIC Releases New Report on Manipulative Design Patterns in Opt-Out Processes

Washington, D.C. — Today, EPIC Scholar in Residence Justin Sherman and EPIC Counsel Caroline Kraczon released “Good Luck Opting Out: Manipulative Design Patterns in Opt-Out Processes.” 

The report found that the opt-out processes of many major online platforms—from social media platforms to data brokers to dating apps—use manipulative design patterns to make it more difficult for consumers to exercise their right to opt out of the collection, use, transfer, or sale of their personal data.

That’s despite privacy legislation in 21 states that includes the right to opt out of the sale and sharing of personal data. Most of these laws require companies to provide clear, easy-to-use opt-out mechanisms for consumers to exercise their rights.

Sherman and Kraczon systematically documented and analyzed the opt-out processes of 38 major data-collecting companies to identify the presence, or lack thereof, of manipulative design practices (often also called “dark patterns”).

Manipulative design patterns are deceptive, manipulative, coercive, or exploitative design choices that undermine consumers’ ability to make choices that reflect their true preference and intentions.

In response to the findings of this report, EPIC makes several recommendations, such as:

• the FTC should consider using its Section 5 authority to protect consumers from manipulative designs;
• state AGs should evaluate these practices against state legal requirements for opt-outs; and
• more states should consider following California’s lead to adopt a universal deletion mechanism and joining the group of states that has passed laws requiring companies to honor opt-out requests from universal opt-out mechanisms.

Above all, states should strengthen privacy protections for consumers by passing legislation that includes robust data minimization standards instead of relying on outdated notice-and-choice frameworks. Manipulative design has no place in opt-out requests. It is already a near-impossible task to identify all of the companies that hold our data, and the presence of manipulative design in opt-out processes makes protecting our privacy even more difficult.

Caroline Kraczon, EPIC Counsel:
“When opt-out processes use manipulative design patterns, they only give the illusion of choice instead of giving people real autonomy over their personal information. Our research shows that too many companies use manipulative design to frustrate, confuse, and discourage consumers from trying to protect their personal data. For individuals facing heightened risks, including stalking, doxxing, or targeted harassment, these barriers can have serious real-world safety consequences.”

Justin Sherman, EPIC Scholar in Residence: 
“When companies design opt-out processes that confuse, discourage, or exhaust consumers, they undermine privacy rights, harm public trust, and threaten people’s physical safety when the data in question can be used for doxxing or interpersonal violence. Manipulative design has no place in privacy compliance. Companies must eliminate these barriers, and regulators must step up enforcement to ensure that consumers can meaningfully control how their personal data is collected, sold, and shared.”

Please contact [email protected] with requests for further comment on the report.

###

ABOUT EPIC
The Electronic Privacy Information Center (EPIC) was established in 1994 to protect privacy, freedom of expression, and democratic values in the information age. Our mission is to secure the fundamental right to privacy in the digital age for all people through advocacy, research, and litigation.