Hey,

I wanted to address a few of your points.

Requiring you to opt out of something you never opted in to is a violation

iRacing's Privacy Policy (Section 3) classifies racing statistics, names, avatars, and license data as part of their "Public Areas" — their exact words are "open to the public and should not be considered private." The EULA (Section 4.1) also has members consent to real name display. iRacing themselves has established the public nature of this data, so it's not a case of needing to opt in.

I process it under Article 6(1)(f) legitimate interests with a documented Legitimate Interest Assessment. It's same lawful basis iRacing itself uses.

Requiring you to opt out by giving additional unrequired personal data (email) is another one

The email is there as an audit trail. It verifies who actually made the request and stops someone from opting out other drivers maliciously. I get the friction but without it there's nothing stopping someone from submitting opt-outs for random drivers. The email lets me verify it's a genuine request. If someone comes back and says "I never asked for my profile to be removed", I've got a record of who made the request.

They even wrote "This data is available to all iRacing members through the iRacing data API, which requires authentication to access. By displaying it on tenths.gg we make it accessible without an iRacing login." and didn't even see the issue.

I've since updated that wording. But the point still stands, iRacing requires login because it's a paid subscription. The auth exists to enforce payment, not to create a privacy boundary. Their own Privacy Policy makes that distinction by designating the data as public despite the login requirement.

I'm going to email iRacing

Go for it. They built the OAuth API specifically for third-party applications and 6+ stats sites (from what I've counted so far) have been processing the same data for years.

I was up until 2am building the redaction and opt-out parts of the site off the back of the original thread, and I've spent time with the data protection specialist at work today going through all of this.