EPIC’s researchers were unable to locate an opt-out process at all on Meta, X, OpenAI, and Tinder without first logging in. And HireVue and the surveillance vendor DataTrust frame their opt-out instructions as available only to California residents, even though 20 other states have passed laws granting opt-out rights.
Palantir, the defense and intelligence contractor, provides a privacy form on its website but does not include an option to opt out of the sale or sharing of personal data—the same finding EPIC documented for TikTok, Amazon, and the gunfire-detection vendor SoundThinking. Palantir also does not clearly link the form from its homepage or its privacy policy, and the researchers were unable to locate any opt-out process on Palantir’s site, Meta, X, OpenAI, or Tinder without logging in first.
Amazon disputed the finding. Adam Montgomery, a company spokesperson, says that Amazon does not sell customer personal information, and therefore customers are opted out by default. Opt-out options for data sharing are available through its “Your Ads Privacy Choices” and “Advertising Preferences” pages, and through privacy settings on most Amazon devices. Montgomery says Amazon does not use the word “share” in its opt-out options, but said the options cover the same uses defined by applicable law.
Shane Bauer, a spokesperson for OpenAI, says the company does not sell user data, though it does acknowledge sharing limited data with marketing partners for targeted and cross-context behavioral advertising. “We give people straightforward ways to control how their data is used directly in our apps, so those choices are easy to make right where people are using our services,” Bauer says. “Our Privacy Portal is another way for people to submit privacy requests, including individuals who don’t have an OpenAI account but still want to exercise their privacy rights. We think giving users multiple ways to exercise their rights is a good thing.”
Jackie Quintana, a HireVue spokesperson, disputes EPIC’s findings on scope, saying the company’s public privacy policy applies only to people who visit its marketing website, not to job applicants, whose data is processed through HireVue’s HR platform under consent controls configured by each employer. The company did not address EPIC’s finding that its public-facing policy directs opt-out instructions only to California residents.
John Fisher, a spokesperson for SoundThinking, says the company’s opt-out forms can be found at the bottom of its privacy policy page, along with a customer help phone number.
Google, Meta, Spokeo, Whitepages, National Public Data, Bumble, X, DataTrust, Palantir, TikTok, did not respond to requests for comment. Tinder acknowledged the inquiry but did not immediately provide a statement.
“Consumers cannot effectively protect their own privacy by exercising opt-out rights,” EPIC says. Even a perfectly designed process—no buried links, no preselected toggles, no paywalls—would still require people to find and submit a request to every company that holds, sells, or transfers their data. The real remedy, EPIC concludes, is not better forms but less collection: rules that bar companies from gathering personal information they never needed in the first place.