The Opt-Out Illusion - Why US Privacy Law Cannot Technically Work

23 US states have now enacted 'comprehensive' consumer privacy laws, twenty of them in force in 2026, with Oklahoma, Louisiana, Alabama and Vermont following through 2027 and 2028. With narrow exceptions, they are all built on the same doctrinal foundation: opt-out "Notice and Consent". Organisations can collect, profile, sell and share personal data by default, and the burden falls on the individual to opt-out after the fact. The entire American model of online privacy protection rests on a single assumption: that when a person clicks "opt out", something real happens.

That assumption is nothing more than a fallacy a "sleight of hand" by AdTech and the Consent industry that supports them. It is a fallacy because the opt-out mechanism the entire doctrine depends on is not technically capable of doing what the statutes require. Since Netscape in 1995 the web's own security architecture has forbidden it. US persons are being offered a 'privacy control' that controls nothing essentially leaving all US persons completely unprotected.

The five-second problem

Consider what actually happens when a consent management platform is configured for an opt-out audience (for example, a website serving US persons), which is precisely how the major platforms ship their US configurations (I know because I have configured them for clients directly based on these requirements). The legal default is "permitted until the consumer opt-out" and as such the tags fire on page load (often long before the consent tooling is even visible). Analytics, advertising pixels, session replay, real-time bidding calls: all of it executes the moment the page renders, before the visitor has read a single word of the consent banner. Identifiers are written, the visitor's presence on that page is broadcast into the ad-tech supply chain and bid requests containing that data have been bought and sold within milliseconds of the "consumer" landing on the page.

In a forensic audit we conducted to test our WebSentinel forensic audit tool, we captured full browser telemetry across 98 of the top 200 global English-language content websites: news, media and reference destinations, deliberately excluding retailers and B2B properties. Every script execution, network request, cookie write and device API access was recorded for 5 minutes on every site we visited without any interaction (no clicks on consent banners, no opt-ins, no opt-outs - the page was just loaded in a default installation of Google Chrome on MacOS and left open for 5 minutes with out audit instrumentation running in the background. What executes on these pages, before and regardless of any privacy choice, deserves to be seen in full and I am finalising the white paper currently, but for now here are some of the headline numbers:

The median site ran 285 scripts and put the visitor's browser in contact with 10 distinct third-party hosts; at the 90th percentile that was 41 hosts, and the worst site reached 107. Ninety-two of the 98 sites set cookies, a median of 14 each and a maximum of 115; 640 of the 2,015 unique cookies observed (32 per cent) belonged to third-party origins. Fingerprinting was baseline behaviour, not an edge case: a median of 163 attempts per site probing a median of 19 distinct device surfaces (screen geometry, navigator properties, timing, page visibility and focus chief among them), with one site making 4,377 attempts across 38 surfaces. Remember, this happened before any interaction in the first 5 minutes of the page being loaded in the browser.

Five seconds later the visitor finds the link and clicks "opt out" but nothing that just happened, none of those events can be undone, none of that data can be clawed back. The data is already in the hands of dozens of downstream companies within milliseconds of the page loading. The identifiers are already set. The bid-stream data has already been logged, matched and enriched in systems the publisher has no access to and in many cases has never heard of. The opt-out governs, at best, the next page view and even then only if the consent tool and tag managers have been configured correctly to block the scripts (which in my experience is rare).

Under California's regulations a business then has up to fifteen business days to give effect to an opt-out of sale. Three weeks of continued processing, on top of instantaneous collection at first load, in response to a mechanism whose entire purpose is to stop processing. You might think this is an error - something is broken, nope it is entirely by design.

The same-origin wall

It gets worse...

Browsers enforce a foundational security rule called the same-origin policy (sometimes referred to as the same origin principle). In plain terms: code running on one domain (such as a website) cannot read, modify or delete data that belongs to another domain (such as Google DoubleClick). This means your bank's cookies cannot be inspected by a news site you visit and without this principle, e-commerce and online banking would have never been able to exist as they would be insecure by design and by default. There is no way to bypass the rule , it isn't optional and there is no switch for a consent platform bypass it. See Mozilla's documentation of the policy for the technical detail (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy).

Now apply that rule to the opt-out button. The consent platform is a script running on the publisher's origin (the website domain) or often even their own domain. The tracking cookies it is supposed to manage belong to other origins: the ad exchanges, the data brokers, the social networks etc. The same-origin policy means the publisher's consent tool cannot delete a third-party cookie, cannot rewrite it, cannot even see it. The most it can do is decline to load those third parties' scripts on future page views. Every identifier already written sits untouched on the consumer's device, ready to be recognised the moment any other website loads the same tracker, which it will if you use Google Chrome (the most popular browser with a massive market share) because cookie jars are not restricted to a site, they are global. In Mozilla Firefox you are a little more protected because they partition their cookie jars on a per site basis - but for our testing we have to use the most popular browser to collect real world and relevant data affecting the majority of people who use the web.

So the opt-out button on the publisher's site is structurally incapable of deleting the data. The consumer is shown a consent tool for technologies that sit behind the same-origin policy that the tool cant bypass. It is quite simply "smoke and mirrors" or "sleight of hand" - your opt-out is passive - it has no force behind it other than the text of the law with no mechanism to comply with it.

The audit data presented above allows me to say exactly what an opt-out cannot reach on a real page, in four categories.

First, the third-party cookies themselves: 640 unique in the set, every one behind the same-origin wall, none deletable by the publisher's consent tool.

Second, storage beyond cookies: we recorded 14,224 localStorage operations, 5,133 sessionStorage operations, 1,744 uses of IndexedDB and dozens of service worker and cache registrations, persistence mechanisms most consent platforms do not even claim to manage, some of which survive the visitor clearing their cookies.

Third, the stateless techniques: 50,790 fingerprinting attempts, 14,038 referring-URL leaks and 17,091 transmissions of high-entropy client-hint headers identify the visitor without storing anything on the device, which means there is nothing an opt-out could delete even in principle.

Fourth, everything already transmitted: 54,047 cookie sends and nearly twenty thousand network requests had already carried the data to third-party servers - so in other words, the gate is wide open and the horse is gone.

So out of each of those 4 categories of collection an opt-out click retrospectively controls none of them.

Then there are the covert events: 48 instances of CNAME cloaking, trackers disguised as the publisher's own subdomains in a way that defeats even the browser's third-party protections; 54 cookie-sync events knitting ad-tech identifiers together across companies; 92 link decorations smuggling identifiers across navigations; 495 instances of mouse-behaviour capture and 1,148 reads of form fields. Basic cookie hygiene failed on its own terms as well: 76 per cent of cookies lacked HttpOnly, 46 per cent lacked SameSite and 35 per cent were not even flagged Secure. These are the top content destinations of the English-speaking web, real web sites with traffic amounting to billions of visitors each month.

The industry proved this itself

The advertising industry's own self-regulatory opt-out tools support my claims.

The Digital Advertising Alliance and Network Advertising Initiative opt-out pages work by asking each participating ad company to set an opt-out cookie on its own origin, from inside the industry's page (and because those are third-party cookies, this fails in any browser that blocks third-party cookies, which Safari and Firefox have done by default for years). To use the industry's opt-out tool, a user must first lower their browser's privacy protections. If you later clear your cookies (an act of privacy hygiene) - you delete your opt-outs with them, silently opting yourself back in to everything. When The Markup tested the DAA tool it found companies failing to synchronise opt-outs across 129 participants, and at least one ad server simply overwrote the opt-out cookie with a fresh tracking identifier (https://themarkup.org/privacy/2021/03/25/i-tried-to-use-the-ad-tech-industrys-tool-to-opt-out-of-personalized-ads-did-it-work).

I have made my position clear already on what I think about consent solutions that require a cookie work in my piece on why CMPs are unlawful by design (https://www.thatprivacyguy.com/blog/cmps-unlawful-by-design/) so I won't repeat it here (but you should probably read it).

Global Privacy Control: a signal, not a control

Regulators know consent tools have failed so they created a universal opt-out mechanism (more smoke and mirrors). A dozen states, with Connecticut and Oregon joining in January 2026, now require businesses to honour browser-level signals such as Global Privacy Control, which announces the visitor's objection to every site automatically (https://www.thsh.com/publications/universal-opt-out-mechanisms-and-global-privacy-control-state-law-requirements-and-compliance-guidance/).

GPC attempts to solve a real problem: nobody can express a choice on thousands of websites one banner at a time. But look at what it actually is: an HTTP header. It is a request not to be tracked but it is delivered to the same server-side systems and all the opacity that comes with it - there is no way for the visitor to verify it was honoured (the very same issue faced with Do Not Track (DNT) signal developed by the World Wide Web Consortium (W3C - the body responsible for web standards)). Compliance is based entirely on trust against an industry that has proven overwhelmingly time and time again, that it cannot be trusted. In my circles we work on the basis of "Zero Trust & Verify" (not "Trust but Verify") because that is what true compliance requires and anything else is just theatre.

Again, this is not just ThatPrivacyGuy being a sceptic, the enforcement record shows how that trust is repaid. Sephora paid $1.2 million in 2022 in the California Attorney General's first CCPA action, precisely for ignoring GPC signals while selling data (https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement). Healthline paid $1.55 million in 2025, the largest CCPA settlement to date, after the consent tool it deployed to honour GPC was misconfigured and personal data kept flowing to advertisers after visitors opted out (see my point above about badly configured consent tools) (https://www.hklaw.com/en/insights/publications/2025/07/california-attorney-general-enters-ccpa-settlement). Honda paid $632,500 partly because opting out took two clicks while "Allow All" took one. Todd Snyder paid $345,178 because its banner glitched and the opt-out could not be submitted at all. In September 2025 California, Colorado and Connecticut had to launch a coordinated three-state sweep just to check whether anyone was honouring the signals. From January 2026 California's updated regulations require businesses to display that an opt-out signal has been "processed". Display, not prove: the visitor still has no technical means of verifying that anything was honoured.

Every one of these cases is the same finding dressed in different facts: the mechanism the doctrine depends on either was not implemented, was misconfigured, or failed silently.

The problem is Notice and Choice (Opt-Out)

Compare the direction of travel with the European model. Opt-in consent under the GDPR and the ePrivacy framework has its own enforcement failures and I have written about them at length, but the doctrine points the right way around: nothing may be stored on or read from the user's device before consent is granted (unless it is strictly necessary for the provision of the requested service - a test which is extremely narrow), there is no doubt on this, the CJEU stated so explicitly in the Planet49 ruling. This is something a browser can enforce because scripts that are never loaded write no cookies and broadcast no bid requests. Refusing to open the door is technically trivial - finding the horse, let along reigning it in and getting it back into the barn is technically impossible (well almost, see below).

The American "Notice and Choice" doctrine can not ever offer any protection to US persons and no amount of banner design/configuration, regulatory guidance or enforcement sweeps will change what the browser's security model that has existed for 31 years, permits.

Opt-out consent for online tracking should be recognised for what it is: a legal fiction that launders continued collection through the appearance of choice. Essentially, the 23 state laws are quite simply not fit for purpose because they offer no real protection at all because they do not address this fundamental, technical issue.

A note on WebSentinel Guard

This failure is an engineering problem as much as a legal one and it is solvable at the right layer. ThatPrivacyGuy's WebSentinel Guard (patent pending) is, to my knowledge, the first product that gives a first-party publisher real control over third-party cookies: it blocks third-party cookie writes at write time, before they ever land on the visitor's browser, removes existing third-party cookies the instant a visitor revokes consent, continuously reconciles the cookie state on the device against the visitor's recorded choice, and keeps an audit-grade record of everything it blocked or removed. In other words, it enforces at the layer the banner cannot reach, which is where enforcement should have lived all along - but it does it in a way which doesn't ever reach the same origin policy rather than trying to override it. Details are at https://www.thatprivacyguy.com/websentinel.