Defense Contractors Named in EPIC Audit of 38 Firms Blocking Consumer Data Opt-Outs

The Electronic Privacy Information Center (EPIC) found that 38 major data-collecting companies, including defense contractors, AI vendors, and data brokers, use manipulative design to prevent consumers from exercising opt-out rights, according to a report published May 20.

EPIC scholars Justin Sherman and Caroline Kraczon documented at least eight obstruction categories, including buried opt-out links, fake forms, and paid subscription requirements before data removal. Privacy laws in 21 states require clear opt-out mechanisms.

According to the report, many companies use manipulative design to frustrate, confuse, and discourage consumers from trying to protect their personal data.

Among the companies named, Palantir and SoundThinking, a gunfire-detection vendor, offered no opt-out for data sale. A Palantir spokesperson said the company “does not collect, sell, or buy personal data.”

The audit comes months after the Federal Trade Commission (FTC) sent warning letters to 13 data brokers in February 2026 under the Protecting Americans’ Data from Foreign Adversaries Act (PADFAA), which bars data transfers to adversary nations.

People-search brokers Spokeo, Whitepages, and National Public Data provided no opt-out of data sales, offering only URL-by-URL listing removal. EPIC cited the June 2025 murder of Minnesota state Representative Melissa Hortman, whose alleged killer prosecutors say used people-search data brokers to locate his targets’ home addresses.

Google, Meta, and OpenAI did not clearly link opt-out forms from their homepages or privacy policies, the report found. OpenAI spokesperson Shane Bauer said the company does not sell user data but shares limited data with marketing partners for targeted advertising.

EPIC urged the FTC to use its Section 5 authority over deceptive business practices and called on states to adopt data deletion programs similar to California’s.

“Regulators must step up enforcement to ensure that consumers can meaningfully control how their personal data is collected, sold, and shared,” the report concluded.