Why We Do Not Support Opt-Out Forms

Every week, multiple organizations reach out to YourDigitalRights.org with the same request: they want us to redirect users to their online opt-out forms instead of sending email-based privacy requests. While we understand why companies prefer managing structured form data, we consistently decline these requests. This post explains our position and why email-based requests remain a far superior option for exercising privacy rights.

As a consumer protection organization, Consious Digital is obligated to view matters from the individual’s perspective. Over the years, we’ve observed that online opt-out forms provide a significantly worse user experience than email requests for individuals wishing to access or delete their personal data. We’ve also observed that companies often use these forms to implement deceptive design patterns that disadvantage individuals and place undue burden on them. Academic research confirms this: a 2024 study found that 68.5% of websites deploy at least one dark pattern in their privacy request forms.

Common Problems with Online Forms

Through our work helping hundreds of thousands of individuals submit privacy requests, we’ve documented recurring issues with online opt-out forms:

• Excessive personal information requirements. Forms require excessive data in order to verify the identity of the individual. Sometimes they require data that the organization has never previously collected. This violates regulations that prohibit collecting more information than necessary for verification. Research found that 10% of data brokers require government IDs or residency documents, despite never previously collecting this information. California recently fined a national retailer $345,178 for illegally requiring government identification for opt-out requests.
• Requiring multiple requests. Forms require individuals to select multiple requests for specific products, services, or departments, thereby fragmenting what should be a single, comprehensive request.
• CAPTCHA requirements. Adding CAPTCHAs creates accessibility issues and additional friction for a legal right that shouldn’t require proving you’re human.
• Request reinterpretation. Forms convert deletion requests into mere “do not sell” requests or marketing opt-outs, providing less than what individuals are legally entitled to.
• Data location requirements. Some forms require individuals to first locate their data on the organization’s website before submitting a request, an impossible task when you don’t know what data exists, and one that, legally, the organization is responsible for.
• Technical failures. Forms break due to browser incompatibility, session timeouts, server errors, or integration issues, often without clear error messages or recovery options. Studies document that 11.2% of opt-out forms fail due to malfunctioning pages, required offline steps, or login requirements. This provides the organization with plausible deniability.

All these patterns disadvantage individuals and generate friction, hoping they’ll abandon their request. Even when companies don’t deliberately employ deceptive patterns, online forms introduce unnecessary complexity compared to email.

The Superior Email Experience

When individuals use YourDigitalRights.org to send an email request, the entire process takes under a minute. We pre-generate an email containing all essential information: the individual’s name and email, organization details, request type, timestamp, and any additional information they choose to provide. One click sends it directly to the organization’s privacy contact.

Since emails are sent from the individual’s email account, they are already verified. A form, on the other hand, requires a separate verification email.

In addition, when using forms, which typically require 15-30 minutes per organization, individuals must complete CAPTCHAs, navigate confusing options, provide excessive information, and troubleshoot technical issues. For someone contacting multiple organizations, this time investment becomes prohibitive. The FTC documented this problem when it found Amazon deliberately designed its cancellation process with multiple pages and confusing options specifically “to stop” consumers from exercising their rights.

Our User Research

We surveyed people who’ve used our service to choose between our email-based system and organizations’ opt-out forms. The results were clear: 86% preferred sending requests through our platform, and 74% said they wouldn’t bother submitting requests at all if online forms were their only option. The most common reason cited was negative past experiences with forms.

A Message to Organizations

We understand that processing email requests may seem less convenient than structured form data. However, personal data fundamentally belongs to individuals, and handling these requests is therefore a cost of doing business for the organization. The evidence shows that online forms systematically suppress the exercise of privacy rights through friction and failure, whether intentional or not. Enforcement actions are increasing: California’s Privacy Protection Agency fined companies for broken privacy controls that “would have been discovered through basic monitoring”, while Healthline paid a record $1.55 million for deceptive checkboxes that appeared functional but didn’t actually stop tracking.

Organizations genuinely committed to upholding privacy rights should fully support email opt-outs as required by the GDPR.

Our Position

YourDigitalRights.org will continue supporting email-based requests exclusively. Our mission is to make data rights accessible to as many people as possible. Following our analysis, we believe that online forms introduce significant friction, deterring individuals from exercising their rights, particularly those who aren’t technically sophisticated.

Deceptive Design Patterns Gallery

Related