Rights and compliance · Observability
Drive your own deletion and opt-out paths with a canary account
An opt-out or deletion path is only real if it has been driven end to end by something that then checks the backing stores, because the front end confirms success independently of whether anything downstream changed.
Do this firstTest the consent dialogue against the law, not the vendor default
Run a synthetic account through the flow a stranger would have to use, then query the warehouse, the replicas and the backups and confirm the data is gone within the promised window.
Both halves fail in measurement. The front end fails on findability — in lab testing, people routinely could not locate the controls at all, fell back to help pages or emailing support, and misunderstood what a written request needed to contain. The back end fails on propagation, and the propagation numbers are the more alarming: implemented does not mean honoured, and honoured by you does not mean honoured by the seventeen third parties you forward to.
This is the sector’s defining shape. Nobody notices any of it. There is no outage, no error rate, no page — the obligation is simply unmet, from day one, until somebody checks on purpose.
The decoy
Implementing the opt-out API. Adoption is not behaviour: of publishers who had implemented it, only 46.1% actually flipped their signal when a real opt-out was sent, and only 17.9% of downstream chains propagated it at all.
Evidence
- It's a scavenger hunt: Usability of Websites' Opt-Out and Data Deletion Choices — III partly self-reportedParticipants routinely failed to find the correct path to opt-out and deletion controls and misunderstood what written requests required. Controls in account settings were markedly easier than those buried in privacy policies, and a substantial share fell back on help pages or emailing support to do something the site nominally offered as self-service.
- Johnny Still Can't Opt-out: Assessing the IAB CCPA Compliance Framework — IIOnly 8.2% of publishers implemented the opt-out API at all, and only 3.6% stored the signal in the standard cookie. Where it was implemented, sending a global opt-out flipped the signal for only 380 of 825 publishers — 46.1%. Across more than 1.2 million advertising chains, 17.9% propagated the opt-out downstream, and tracking-pixel deployment showed no statistically significant change when the signal was present.
Last reviewed 2026-08-19.