---

Part 3: The Countermeasure Stack

This is the final installment of a three-part series. Part 1 mapped the architecture of extraction — what gets collected, where it flows, what “vendors, service providers, affiliates, and partners” actually authorize. Or maybe it had nothing to do with any of that shit at all and was more or less an informative report on the ways that companies “Get ya.”

Part 2 examined why the architecture works: consent manufactured under cognitive load, financial scarcity, and decision environments engineered for compliance.

Part 3 is the countermeasure stack, hopefully… the one that takes the actual effort of staying on topic. Let’s see how this goes. And yes, this is a really fuckin super late submission. I’ll tell you why — because the reason is the thesis. Pay attention to how the reason for something can also be another edge of the same blade. You’ll see.

What this post is and what it isn’t

Consumer education and structural commentary. Not legal advice, not an accusation against any specific company. Where companies, statutes, or documents are referenced, they appear as examples of industry-wide patterns, and any reader is encouraged to verify current practices and current law directly, noting the date of access. Laws cited below vary by state and change frequently.

The ten-week confession

Here’s the reason, as promised. I run a consulting practice, produce a podcast, parent two teenagers alone, and am finishing a graduate degree in machine learning. I wrote Part 2 — the one about how cognitive load converts deliberation into heuristic compliance — and then I did not write Part 3 for ten weeks, because my cognitive load converted deliberation into heuristic compliance. The diagnosis post was written because the diagnosis is downhill. The treatment post stalled because treatment requires exactly the resource the system is designed to deplete: surplus bandwidth. That’s not an excuse. That’s a replication study with an n of 1. Same blade, other edge.

So here is the design constraint for everything below: no countermeasure in this stack is allowed to assume you have free time, legal training, or emotional slack. Part 2 established that those assumptions are what make the trap work. A defense that requires you to become a different person is not a defense. It’s a second trap with better branding.

One more thing before the stack. None of this gets you out. There is no out. You cannot un-exist from the substrate economy — Zuboff (2019) is right that participation in modern life is participation in extraction. What you can change is your resolution. The system doesn’t need you to disappear to lose interest in you. It needs you to become expensive to process. Every layer below has one function: raise the cost of extracting you until the math stops working in their favor.

You cannot opt out of existing. You can opt out of being legible.

---

Layer 1: The Four-Sentence Scan // read 4 minutes, not 55

Part 2 established that reading the whole policy is structurally impossible — 55 minutes for one Microsoft agreement, 200+ hours per year across all services (McDonald & Cranor, 2008). The mandated-disclosure model failed categorically (Ben-Shahar & Schneider, 2014). Fine. Stop trying to read policies. Start triaging them.

Four clause types carry almost all of the load. Ctrl+F them. Four minutes, not fifty-five:

1. The arbitration clause. Search “arbitration,” “class action,” “waiver.” This tells you whether you can ever sue them, alone or together. Usually the answer is no, and usually there’s a 30–60 day window to opt out of arbitration by mail after signing — a right almost nobody exercises because almost nobody knows it exists. [Side note: they buried your one procedural weapon in a clause about giving up your procedural weapons. Respect the craft, hate the craftsman.]
2. The sharing sentence. Search “affiliates,” “partners,” “third parties.” Part 1 covered this — it’s the sentence that authorizes everything, including entities that don’t exist yet.
3. The modification clause. Search “modify,” “changes,” “continued use.” This is the clause that makes every other clause temporary. Whatever you agreed to is a draft.
4. The corpse clause. Search “bankruptcy,” “merger,” “sale of assets.” This is where your data becomes inventory if the company dies or gets eaten.

Those four searches tell you 90% of what the document does to you. This is not full informed consent — Part 2 proved that’s not on the menu. It is consent with your eyes open instead of taped shut, performed at a cognitive price point a person under load can actually pay.

Layer 2: Reference Firewalling // stop donating your family to the machine

Part 1 told you about my older sister’s voicemail box — the one that spent years absorbing colorful two-minute messages from debt collectors hunting me through the references I’d handed over to lease furniture. I gave the machine her number. The machine never gave it back. That’s not a bug in my past; that’s a permanent edge in a graph database, and I drew it myself.

So: compartmentalize what you feed the intake form.

• Email: use aliasing (most modern email providers and several dedicated services offer per-service addresses). One service, one alias. When the spam starts, the alias tells you exactly who sold you, and killing the alias kills the channel.
• Phone: a VoIP number for applications, sign-ups, and retail is one of the highest-yield moves in this entire stack. Your real number is a join key — the field that lets a hundred databases confirm they’re all describing the same person. Starve the join.
• References: if an application demands personal references, understand what you’re doing — you are entering people who never consented into a skip-tracing network. Warn them. Better: use contacts who’ve agreed to play goalie. And know the boundary line — under the Fair Debt Collection Practices Act, collectors may contact third parties essentially only to locate you, generally may not reveal the debt, and generally may not contact the same third party repeatedly (Fair Debt Collection Practices Act, 1977). What happened to my sister’s voicemail had a statute against it the whole time. Nobody in that transaction was ever going to tell either of us.

The existential note here is quiet but real: the data you surrender is rarely just yours. Every reference, every synced contact list, every “find my friends” toggle is you spending other people’s privacy as currency. The substrate economy runs on that ambient betrayal being frictionless. Add friction.

Layer 3: The Statute Stack // rights you already own and never invoice

As of this writing, roughly 20 states have comprehensive consumer privacy laws in effect, granting some mix of access, deletion, correction, and opt-out-of-sale rights, with enforcement now resulting in seven- and even ten-figure penalties. Consumer privacy enforcement is no longer theoretical; verify your state’s current status, because this map redraws itself annually.

Here’s the part that matters if, like me, you live outside that map: companies frequently honor deletion and opt-out requests nationally because maintaining fifty different compliance pipelines costs more than just processing your request. The law gives Californians the right. The economics often give it to you. Send the request anyway — the worst case is a form rejection, and the best case is a row deleted from a table you were never supposed to know existed.

Illinois residents, we hold one weird ace: the Biometric Information Privacy Act (740 ILCS 14) — the strongest biometric law in the country, with a private right of action. Remember the ID-capture systems from Part 1 quietly harvesting biometric identifiers during rent-to-own applications? In Illinois, that harvesting has rules, written consent requirements, and teeth. Know which of your body parts your state protects. [Side note: that is a sentence I typed soberly, in a consumer finance article, in 2026. The field I work in is not okay.]

Round it out with the Fair Credit Reporting Act: you have the right to dispute inaccurate information with both the furnisher and the credit bureaus, and they are legally required to investigate (Fair Credit Reporting Act, 1970). Disputes cost you a template letter. They cost the company a regulated workflow with deadlines. That asymmetry is the whole point of this layer.

Layer 4: The Signal Layer // one browser setting with a statute behind it

Cookie hygiene advice is usually theater — clear your cookies, feel virtuous, get re-fingerprinted in eleven milliseconds. Skip the theater. Do the two things with structure behind them:

• Turn on Global Privacy Control. GPC is a browser-level signal that tells every site you visit “do not sell or share my data” — automatically, on every page load, forever (Global Privacy Control, n.d.). In roughly a dozen states, honoring that signal is now legally mandatory, and regulators have already extracted multimillion-dollar settlements from companies that ignored it. This is the rarest thing in privacy: a countermeasure that costs one browser setting and is backed by enforcement actions. It is the closest thing to a free lunch in this entire series.
• Use a browser or extension stack that blocks third-party trackers by default. Part 1 counted twelve named advertising partners watching a single rental application. A tracker-blocking browser turns twelve witnesses into zero without you performing any ongoing labor. The best countermeasure is the one that works while you’re too tired to care, because Part 2 established that “too tired to care” is your default state by design.

Layer 5: Obfuscation // become bad data

Everything above focused on shrinking whatever leaves you in the first place — minimizing the data exhaust you emit at all. This layer works differently: it degrades what they think they already know.

Brunton and Nissenbaum (2015) call it obfuscation: the deliberate production of ambiguous, misleading, or excessive signals to make surveillance data less valuable. It’s the privacy strategy of people who can’t realistically refuse data extraction — which, in modern consumer economies, is effectively everyone. Part 2 established that opting out is mostly a fantasy; systems you rely on to live and work demand data as the price of admission.

Practically: your loyalty account doesn’t need your real birthday. The store demanding a phone number at checkout can have the VoIP one, or the classic (area code) 867-5309, which I’m told has racked up somebody an ungodly number of fuel points. Optional fields are optional. Forms that demand truth you’re not legally required to give can receive plausible noise instead — details that look realistic to a marketer but don’t uniquely and verifiably pin you down. The profile they compile becomes a portrait painted from a police sketch of a rumor.

Understand what this layer actually is, because this is the existential core of the whole stack. You are not hiding. Hiding is unavailable. As Part 1 showed in the context of consumer-finance applications — where a single form ties together identity, employment, location, and behavior into one highly prized asset (Federal Trade Commission, 2014) — the value of data comes from its role as a verified, linkable record. Verified is the load-bearing word. You are lowering your resolution: converting yourself from a high-fidelity, cross-checked, monetizable record into a smeared, self-contradicting, low-confidence one. Break the verification, break the price.

Individually, a fake birthday or a burner number seems trivial. Together, consistent layers of plausible noise break the clean lines that would otherwise connect one singular, verified you across databases and contexts. They don’t stop data from leaving; they change what that data can reliably say.

[side note: obviously do not obfuscate on credit applications, government forms, or anything with a fraud statute or comparable legal obligation attached. This is a practical rule of thumb, not legal advice: where the law requires truth, give truth; where a marketing department merely prefers truth, give art — understanding that even art can sometimes have practical consequences, like account lockouts or lost perks.]

Layer 6: The Complaint Weapon // ten of your minutes vs. their compliance department

Last layer, most underused. The Consumer Financial Protection Bureau operates a public complaint database. When you file, the company is expected to respond, typically within about 15 days, and the complaint — including the company’s handling of it — becomes a permanent public record that regulators, journalists, and class-action attorneys mine for patterns (Consumer Financial Protection Bureau, n.d.). Your state attorney general runs a parallel channel, and in the twenty states, the AG is the privacy enforcer.

Run the asymmetry math, because asymmetry is what this whole series has been about. Their side of the architecture works because your cost to resist is high and your individual value to them is low. A complaint inverts it: costs you ten minutes and a paragraph; costs them a tracked, deadlined, regulator-visible workflow. One complaint is a mosquito. A pattern of complaints is how enforcement priorities get set. The record producing those billion-dollar settlements didn’t materialize out of nowhere — it aggregated from individuals who spent 10 minutes.

You spent fifty-five minutes not reading their agreement. Spend ten minutes writing your own entry in the public record. Make the paperwork flow uphill for once.

---

The reckoning, itemized

Six layers. Not one requires a law degree, a threat model, or a personality transplant. Triage the four sentences. Firewall your people. Invoke the statutes you already own. Flip the GPC switch. Degrade your resolution. File the complaint. Each one is small. Stacked, they change what kind of object you are in the dataset — from a verified, compliant, high-yield record into something noisy, self-aware, legally armed, and annoying to process.

I started this series because a rent-to-own application I signed under exactly the conditions Part 2 describes is still echoing through my family’s phones years later. I can’t unsign it. Neither can you unsign yours. The substrate doesn’t offer refunds. What it offers — what it can’t help offering, because it’s made of math — is a price sensitivity. Extraction continues exactly as long as you’re cheap.

So stop being cheap.

Automatic consent made you compliant. Informed consent brought the reckoning. The reckoning is a checklist, and now you have it.

References

Ben-Shahar, O., & Schneider, C. E. (2014). More than you wanted to know: The failure of mandated disclosure. Princeton University Press.
Biometric Information Privacy Act, 740 ILCS 14 (2008). https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004
Brunton, F., & Nissenbaum, H. (2015). Obfuscation: A user’s guide for privacy and protest. MIT Press.
Consumer Financial Protection Bureau. (n.d.). Submit a complaint. https://www.consumerfinance.gov/complaint/ [Accessed July 2, 2026]
Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. (1970).
Fair Debt Collection Practices Act, 15 U.S.C. § 1692 et seq. (1977).
Federal Trade Commission. (2014). Data brokers: A call for transparency and accountability. https://www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014/140527databrokerreport.pdf
Global Privacy Control. (n.d.). Take control of your privacy. https://globalprivacycontrol.org/ [Accessed July 2, 2026]
McDonald, A. M., & Cranor, L. F. (2008). The cost of reading privacy policies. I/S: A Journal of Law and Policy for the Information Society, 4(3), 543–568.
Zuboff, S. (2019). The age of surveillance capitalism: The fight for a human future at the new frontier of power. PublicAffairs.