The privacy button that does nothing

I feel a particular kind of confidence when I enter the privacy settings of a large technology company. It is the confidence of a man who has discovered a commercial airplane's cockpit and believes the illuminated buttons mean he can fly it.

“Limit tracking,” one button says.

“Disconnect,” says another.

“Delete my information,” says the most exciting one, usually in a color that suggests either danger or Christmas.

I press it and feel briefly powerful.

Somewhere, I imagine, a machine sighs and begins feeding my personal information into an industrial shredder. My shopping history disappears first, followed by my location data, political leanings, and the record of the evening I spent comparing garden hoses despite not having a garden.

Then I close the window and continue with my life.

The problem is that I couldn’t imagine what happened next.

And I don’t think that was an accident. Neither, apparently, does the state of New Mexico. This month, a New Mexico judge ordered Meta to pay $25 billion after a jury found nearly 44 million violations of the state’s consumer-protection law. The case grew out of Facebook’s representations about privacy, third-party access, and the Cambridge Analytica scandal (remember that?).

Meta disputes the ruling and plans to appeal, so the final number may change, but twenty-five billion dollars will likely spark further conversation.

I’m not even thinking about the amount. I’m more concerned about the accusation underneath: Facebook promised people it controlled their data when, according to the court, it didn't.

And even though the modern internet is covered in consent banners, preference centers, privacy dashboards, and pages with enough toggle switches to run a medium-sized electrical grid, they don’t actually give us control.

Companies ask us whether we want to “personalize our experience,” which is an elegant way of asking whether they may follow us around carrying a clipboard.

A button can express a preference. It cannot prove that anyone listened. Consider what some of the most popular buttons actually do.

Turning off tracking may stop some future collection while leaving years of existing information untouched. Disconnecting an application may revoke its access without deleting the information it already received. Deleting an account may remove the visible profile while preserving transactions, inferred interests, backups and records held by outside vendors.

Even “unsubscribe” (perhaps the internet’s most optimistic word) often means only that one particular department has agreed to stop emailing you. The company still knows who you are. Your account still exists. Somewhere in its systems, you remain a person deeply interested in garden hoses.

And that’s only what one company keeps. Things get much harder to track once your information starts traveling.

When you share information with an app, you probably think you’re sharing it with one company. Often you’re sharing it with a crowd of companies you’ve never heard of.

Grindr is a good example: its members, I would guess, value their privacy, like all dating apps, and love technology, which, as of this writing, is still one of the most-asked support questions we get at Yorba: people trying to delete past love ghosts. Using the app feels like a private exchange between you and Grindr. But data about Grindr users ended up with Xandr, an advertising platform, which passed it along to thousands of companies bidding in automated auctions to show those users ads. Norway fined Xandr for it.

Xandr defended itself by saying it assumed Grindr had obtained users’ consent. The regulator didn’t buy it. In effect, it said that “we assumed somebody else handled it” is not a privacy program.

That’s the real problem. Once your data leaves the app you gave it to, it can pass through a long chain of companies, each assuming another handled consent (remember the 2027 subprime mortgage checks and balances?). Nothing you tap inside the app can follow it down that chain. So what would it look like if the button actually worked?

Real control would need to answer questions like these: What information exists? Who received it? What did I ask to have deleted? What was actually removed? What was retained, and why? Did it reappear six months later wearing a fake mustache?

These are not unreasonable questions. They are simply questions most digital services are not designed to answer. While researching Yorba's potential consumer base, we have run across people who create new emails for each service, with the service name in them, so they can trace where it goes later when it inevitably surfaces in weird ways down the line.

Companies organize privacy around their own products, departments, and legal obligations. People experience it as one enormous, badly labeled attic. We don't remember every account we opened, every quiz we took, every free trial we began, or every company that acquired another company that once acquired our email address.

The burden remains on us to climb into that attic, identify everything, and negotiate with every box separately.

Some people have already started. While researching Yorba’s potential customers, we’ve met people who make a brand-new email address for every service, with the service’s name right in it, so when that address inevitably turns up somewhere weird, they know exactly where it came from. They’ve just figured out that if anyone’s going to keep track of their data, it’s going to be them.

Most of us, understandably, would rather leave the attic door shut.

This is exactly why we need a different standard. We shouldn't judge a privacy control by whether it can be found, clicked, or described in a policy. We should judge it by whether it produces a visible, verifiable result.

A cancellation should end the billing. An unsubscribe request should end the email. Account deletion should explain what disappeared, what did not, and who else still has a copy.

For three decades, the internet has asked us to trust that something meaningful happens behind the screen after we make a choice. The Meta judgment, whatever happens on appeal, clearly signals that the age of decorative control should end.

A setting is a promise. A deletion button is a promise. A cancellation confirmation is a promise.

The next version of consumer privacy must do more than collect our choices. Right now, most of those promises come without a receipt.

It must prove that those choices mattered.

Less, please.

Chris