Your Opt-Out Button May Do Nothing & NYC's Click to Cancel (07/20/2026)

The button that says you have opted out is, for a lot of businesses, doing considerably less than the person clicking it believes. That is the finding privacy counsel is circulating this week, and it is the cleanest example of a pattern worth naming: the interface of consent has gotten very good while the substance of it has not kept up. New York City moved the other way, making it as easy to cancel a subscription as to start one. Both stories are about the same question, which is whether the choice you were offered was ever real.

Top 5 Critical Privacy Alerts

1. Your Opt-Out Button May Not Be Doing What You Think

Privacy counsel is warning that the opt-out mechanisms most businesses bolted on to satisfy state privacy laws and head off wiretap claims frequently fail to stop the tracking the user believed they were stopping (Byte Back Law). A control that looks like a choice and delivers nothing is worse than no control at all, because it spends the user’s trust and gives them a false sense of what they have settled.

Operator Note: Test your own opt-out end to end, the way a user would, and watch what still fires afterward. If tags keep transmitting after the toggle, you have a legal exposure and a broken promise at the same time.

2. New York City Adopts a Click to Cancel Rule

On July 10, New York City’s Department of Consumer and Worker Protection announced a click to cancel rule, requiring that ending a subscription be as straightforward as beginning one (Inside Privacy). Cancellation friction has been a deliberate design choice for years, and rules like this treat the difficulty as the product decision it always was.

3. EFF Pushes Back on Stealth Crawler Bills

EFF argues that legislation aimed at so-called stealth crawlers would damage the open web more than the crawlers themselves do (EFF). The pattern is familiar: a genuine frustration with AI scraping gets channeled into a broad rule that ends up burdening archivists, researchers, and small independent sites who were never the target.

4. Celsius Founders Ordered to Pay $16.5 Million

The FTC announced that Alexander Mashinsky, the former chief executive of Celsius Network, and his business partners were ordered to pay $16.5 million to resolve charges (FTC). Naming the individuals rather than only the corporate entity is the detail worth watching, because personal liability changes how carefully the next set of founders reads their own marketing claims.

5. Experts Report a Global Rise in Coerced Child Exploitation

Child safety specialists are warning of a worldwide increase in cases where predators coerce children into harming themselves or producing abuse material (The Guardian). This is the hardest category of online harm, and it deserves to be reported plainly rather than used as a lever. Any organization building for young users should read the coercion pattern carefully, because the defenses that matter are about reporting paths and adult intervention rather than another age gate.

Additional Privacy Alerts

Privacy Laws & Regulations

• OMB Agenda Signals Coming HHS Health Privacy Updates: The 2026 Unified Agenda points to upcoming health privacy and interoperability rulemaking from the Department of Health and Human Services. Inside Privacy

Data Minimization & User Consent

• AI-Altered Bird Photos Are Corrupting Citizen Science: Experts warn that enhanced and fabricated images on birding platforms are producing fake sightings and undermining a dataset scientists rely on, a reminder that AI pollution damages shared records as well as individual privacy. The Guardian

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.