Opting out of inference and opting out of data collection are different controls

What it is

Turning off “personalization” sometimes only stops sending already-collected logs into ranking while logs still write; sometimes it stops writing logs while inferred tags in the old file still score. Users think they exited one thing. Inference opt-out versus collection opt-out asks for two independent controls: stop estimating identity or preference from traces you already have, and stop collecting new traces. A single “privacy” switch binds them, and neither end is clear.

Collection is the pipe. Inference is secondary use of what is in the pipe. Closing one is not closing the other.

Why it happens

The data life cycle has at least three cuts: coming in, becoming a tag, the tag being used in treatment. Someone may want playback history kept and still refuse to be estimated as an identity; someone else may want this session used for ranking and refuse long-term write. One switch cannot express both, so engineering turns off whichever cut is easier and the interface still says “personalization off.”

Binding them also harms in reverse: people who want inference off are forced to stop collection, so core functions (history, cross-device resume) are held hostage; people who want collection stopped find inferred tags still alive. Once split, each exit maps onto a verifiable system state.

Studying it

Give four control sets: inference off only, collection off only, both off, both on. Tasks: “do not estimate me as a kind of person, but keep my watch history,” and the reverse. Dependent variables: whether the task can be completed, what users think they turned off, actual state of the log pipe and the tagging service. Independent variables: whether copy splits the switches or binds them as “privacy,” whether the off state is explained.

Align the user’s mental model with system state. If copy says “personalization off” and the tagger still scores old logs, the control is misaligned. Do not replace per-cut success with one privacy-scale total.

Where it stops holding

Pipes the law requires (payments, safety audit) cannot be killed by a collection switch; mark them as “not preference collection.” A tool with no personalization has no inference to turn off. A master switch that means “both off” can be a shortcut; it must not be the only path. This entry only argues that the two cuts must be operable separately. It does not treat the default ranking after off, and it does not treat autonomy when off does not exist.

Applying it

• Place two controls side by side in settings: “stop estimating identity or long-term preference from my behaviour” and “stop saving new behavioural records.” Under each, one ordinary sentence of what still happens (resume, safety).
• When inference goes off, stop the tagger scoring old logs, and say what happens to existing tags (delete or freeze). When collection goes off, do not pretend the tags died too.
• Check: flip only one, then inspect the log pipe and the tagger. Inference-off should still write watch progress and emit no new identity tags; collection-off should stop new logs and either declare that old tags still apply or clear them. Copy that disagrees with state fails.

Related

• Same group: L6.06.1 Behavioural inference can reach information the user never disclosed · L6.06.2 Displaying an inference is itself a disclosure · L6.06.3 Inferences in sensitive categories need extra constraints · L6.06.4 Combinations of non-sensitive behaviours can yield sensitive attributes; item-wise compliance is not whole-system compliance · L6.06.5 Inferences on shared devices and shared screens disclose to third parties · L6.06.6 Wrong inferences also harm, and the misclassified often have nowhere to appeal · L6.06.7 Tolerance for inference depends on the setting; the same inference is judged differently across products
• Nearby: L6.05 Turning Personalization Off · L6.10 Turning Personalization Off and Resetting It · L5.05 The Moderation Principle of Transparency
• Search terms: inference opt-out versus collection opt-out · split privacy controls · stop inferring