The Industry Selling Your Data Doesn't Want You to Find the "Opt Out" Button

#cybersecurity #techtalks

What the investigation found

A February 2026 report from the U.S. Senate Joint Economic Committee examined the practices of registered data brokers — companies that collect and sell personal information, often without most people ever knowing it’s happening. The investigation followed an earlier news report finding that more than 30 data brokers had used code to specifically tell search engines like Google and Bing to exclude their opt-out pages from search results — making the one page a consumer would need to find nearly invisible by design.

Regulators elsewhere have been tracking related harms. In one of the most significant recent enforcement actions, the FTC took action against a location-data company for collecting and selling billions of precise location points harvested from smartphone apps — data specific enough to show individual visits to medical facilities, religious institutions, domestic violence shelters, and military installations.

Why “just opt out” has been harder than it sounds

The core problem the investigation identified isn’t that opt-out rights don’t exist on paper — most registered brokers technically offer one. It’s that exercising the right often requires finding a deliberately obscured page, then repeating the process across each broker individually, since data brokers don’t share a single opt-out system by default. And because brokers continuously re-collect data from public records and other sources, a one-time opt-out doesn’t necessarily stay effective indefinitely.

The practical takeaway

Some regions now offer a real fix for the scale problem: as of January 2026, California residents can use a single state-run platform to submit one opt-out request that covers all California-registered data brokers at once, rather than tackling each one separately — a model other states are watching closely. Outside of that, the realistic approach is targeting the handful of data brokers with the widest reach and the most sensitive data first (people-search sites that surface your address and phone number publicly) rather than attempting to chase down every company at once, which isn’t a realistic goal for most people’s time.

Opting out reduces exposure going forward — it doesn’t erase data that’s already been sold, resold, or copied into other systems before the opt-out took effect. Treat it as damage reduction, not a full data-privacy reset.