Instead, the Microsoft-backed AI startup only offers an option to “remove personal information from ChatGPT responses”, which is more to do with the chatbot’s output rather than the removal of any underlying data, as per the EPIC study.

The findings are significant as they suggest that AI firms are now part of the same ecosystem of data brokers, defence contractors, and dating apps enabling the silent trading of users’ personal data in an opaque marketplace. Weak or non-existent data-sharing opt-out policies also pose a grave risk to user safety.

For instance, Vance Boelter, the man charged with murdering US lawmaker Melissa Hortman and her husband Mark in June 2025, allegedly used people-search data brokers to locate the victims’ home address.

Commercially available data has also been used to locate, harass, and assault women, women of colour, and LGBTQ+ people in the past, as per EPIC. “Manipulative design has no place in opt-out requests. Companies must design opt-out processes with respect toward consumers’ rights, and if they do not, regulators at the state and federal level should step in to defend consumer rights to opt out,” the report read.

Key findings of the study

As part of the study, EPIC researchers said that they audited the opt-out processes of 38 major data companies. The results showed manipulative design that were categorised into eight broad types, including:

-Opt-out forms that do not actually let users opt out of the sale of their data.
-Links that are buried in fine print and missing from homepages.
Consumers routed through multiple separate forms to complete a single request.
-Requirements that users create accounts or pay for subscriptions before opting out at all.

Based on an audit of opt-out processes on Meta, X, OpenAI, and Tinder, the researchers found that users were not able to opt-out of data-sharing without logging in first.

Defence firm Palantir, along with TikTok and Amazon, provide privacy forms on their respective websites but do not include an option to opt out of the sale or sharing of personal data. Palantir also does not clearly link the privacy form from its homepage or its privacy policy, the researchers found.

When it comes to dating apps, the researchers said that all Bumble users are opted into data-sharing by default through pre-selected toggles. Additionally, the ‘Do Not Sell’ option on the platform is styled to look selected by default, when in fact it is the option a user must click to opt out.

Responses from companies

Amazon disputed the researchers’ finding and said that customers are opted out by default as it does not sell customer personal information, as per a report by Wired.

OpenAI acknowledged that it shares limited data with marketing partners for targeted and cross-context behavioral advertising.

“We give people straightforward ways to control how their data is used directly in our apps, so those choices are easy to make right where people are using our services. Our Privacy Portal is another way for people to submit privacy requests, including individuals who don’t have an OpenAI account but still want to exercise their privacy rights. We think giving users multiple ways to exercise their rights is a good thing,” OpenAI spokesperson Shane Bauer was quoted as saying.

In terms of remedies, EPIC said that even a perfectly designed process with no buried links, paywalls, or pre-selected toggles, would still require people to find and submit a request to every company that holds, sells, or transfers their data.

“Consumers cannot effectively protect their own privacy by exercising opt-out rights,” the group said. Instead of better forms, EPIC advocated for less data collection and laws that prohibit companies from gathering personal information they never needed in the first place.