The future becomes human when it preserves a way out. A technology, institution, or social network may promise access, efficiency, and community, but it truly respects people only when they can leave a decision without disproportionate penalties, correct false information, and recover what they handed over. An exit is not a decorative button at the bottom of a menu. It is an architecture of rights, deadlines, accountable roles, and alternatives that recognises changing circumstances. A person may cease to share an opinion, a family may withdraw permission, a worker may challenge a classification, and a community may decide that a system no longer serves the purpose that justified its adoption.

The question concerns truth as common infrastructure because systems without an exit turn the past into a sentence and opacity into an advantage for whoever runs the platform. When closing an account does not remove data, a correction fails to reach those who received the error, or an automated decision permits no review, the institutional version of events prevails even when incomplete. Everyday democracy needs memory, but it also needs context, rectification, and expiry. Keeping everything does not amount to knowing better. It may instead prevent somebody from explaining that they changed, that a record became outdated, or that an inference should never have been treated as fact.

An exit is a capability, not a promise#

An effective exit has at least five conditions. It must be visible before acceptance; understandable without specialist assistance; equivalent, so it does not remove basic rights; timely, because a delayed response can entrench harm; and verifiable, so the institution can demonstrate what it did. A link leading through successive forms does not meet those conditions. Nor does an alternative that requires surrendering an essential service, paying an opaque penalty, or repeating the same account to several departments. Formal freedom to leave is empty when the practical cost has been designed to make departure unworkable.

An effective exit has at least five conditions. It must be visible before acceptance; understandable without specialist assistance; equivalent, so it does not remove basic rights; timely, because a delayed response can entrench harm; and verifiable, so the institution can demonstrate what it did.

Reversibility does not require pretending that nothing happened. Some records must be retained for legal duties, public interest, or security. The professional response is to separate purposes and explain limits: what will be erased, what will be restricted, what must remain, for how long, and who may consult it. Removing content, correcting it, reducing its distribution, and keeping an evidential copy must also be distinguished. Such precision protects both the individual and collective memory. Automatic forgetting can conceal abuse; unlimited memory can perpetuate it. A humane exit manages that tension through public criteria and independent review.

Three cases in which an exit changes the outcome#

Case 1: an account that kept speaking after closure#

A teacher left a professional network after discovering that her old posts still fed recommendations and advertisements. The platform confirmed closure, yet retained an inferred profile linking interests, contacts, and active hours. Months later, colleagues still received suggestions based on that activity. The problem concerned more than privacy: the network continued to present a frozen version of the person without offering context or control. A dignified exit would have included a downloadable inventory, deletion of data not legally required, deactivation of inferences, an explanation of residual copies, and a dated final receipt.

The organisation improved the process when it stopped measuring closed accounts alone and began checking later effects. It created tests after thirty and ninety days to verify that no new recommendations appeared, separated security archives from commercial systems, and enabled third parties to flag persistent profiles. The important correction was conceptual: closure stopped meaning that the interface was hidden and began to mean that uses were halted. The system’s truth was no longer reduced to the state of a checkbox. It included what other people continued to see and what models continued to infer.

A school adopted a tracking application and requested authorisation at the start of the year. When a family wished to withdraw it, they discovered that the alternative meant receiving materials late and that some notices circulated only through the platform. Consent existed on paper, but leaving meant losing participation. The school reviewed the arrangement and established an equivalent channel, task export in open formats, deletion of unnecessary identifiers, and a quarterly permissions review. Withdrawal stopped being interpreted as distrust of teachers and became a legitimate option within educational design.

The change also improved information quality. Knowing that withdrawal would not disadvantage the pupil, the family explained its concerns more precisely. The school discovered that the application collected more data than necessary and renegotiated the contract to limit analytics and retention. The exit therefore served as an institutional sensor: it revealed a risk that initial acceptance had hidden. An organisation that facilitates withdrawal does not necessarily lose trust. It receives more honest signals about what it must correct to deserve that trust.

Case 3: a score that blocked an opportunity#

A housing applicant was rejected by a risk assessment system. Nobody could explain which record had tipped the decision, and the complaint form allowed documents to be attached but did not permit the logic to be challenged. An old address, mistakenly associated with another person, continued to weigh on the score. The organisation introduced human review with authority to suspend the outcome, communicated the main factors, set a response deadline, and notified the correction to companies that had received the record. The exit was not abandonment of the application. It was departure from an unjust automated path and a return to contextual assessment.

This case shows that portability alone is insufficient. Moving inaccurate data to another provider reproduces the harm more quickly. A rectification mechanism and an audit trail that can propagate changes must precede export. The affected person needs to know who originated the record, who transformed it, and who received it. For the institution, such traceability turns an individual complaint into learning: it enables detection of rules that produce false positives, measurement of the groups affected, and review of the model before the same error reaches more people.

Designing reversibility from the beginning#

Exit must appear in purchasing and design, not after the first conflict. A responsible contract defines export formats, migration assistance, deletion at termination, treatment of backup copies, service continuity, and subcontractor duties. It also establishes what happens if the supplier disappears or changes essential terms. On the technical side, the organisation avoids unnecessary dependencies, documents interfaces, and maintains a manual alternative for high-impact decisions. On the social side, it explains consequences, duration, remedies, and support channels before enrolment. Exit costs then become part of evaluating a service rather than an unexpected burden transferred to users.

The most useful test is an exit rehearsal. A team can select a fictional account, withdraw consent, request its data, correct an error, and check what remains visible in every system. It then records time, obstacles, contradictory responses, and labour transferred to the person. Another test simulates an outage or the supplier’s disappearance. If an essential service stops, documents cannot be recovered, or nobody knows who authorises migration, the organisation has found a dependency before it becomes a crisis. Resilience does not emerge from a declaration; it grows from practising decoupling.

Metrics that do not reward retention at any price are also necessary. The number of users who remain may conceal how many cannot find the door. More informative measures include average closure time, requests resolved without repeated contact, the proportion of data actually deleted, availability of reusable formats, corrections propagated, and complaints reopened. Results should be disaggregated by age, ability, language, and digital access. An exit that works for an expert but fails when somebody needs assistance remains a defective exit.

Truth, explanation, and the right to rectify#

Rectification deserves a central place because a physical exit does not release anyone from a record that continues to circulate. When an institution corrects a record, it should identify active copies, alert relevant recipients, and retain evidence of the change. If a record is disputed and cannot be resolved immediately, it should be marked as contested instead of continuing to appear as certainty. That label protects later decisions and makes uncertainty visible. Mature truth infrastructure does not confuse authority with infallibility: it shows provenance, date, transformations, and degree of confidence.

Explanation should match the effect of a decision. A simple indication may suffice for a music recommendation; housing, employment, credit, health, or education demands a fuller account and a person able to review the case. It may not always be possible to disclose code or protected information, but purpose, decisive factors, data used, consequence, timeframe, and available remedy can be communicated. A useful explanation lets someone detect an error and act. Legal text that describes general categories without connecting any of them to the specific result satisfies a formality but restores no agency.

Shared responsibility without diluted accountability#

Providers, public institutions, companies, and citizens have different roles. The provider must enable export, deletion, and traceability; the organisation choosing the system remains accountable for its effects; regulators establish minimum protections and complaint routes; civil society organisations detect shared harms; and individuals contribute context that no model possesses. Collaboration must not become a chain of referrals. A single front door should receive the case, coordinate internally, and respond with authority. A harmed person should not have to reconstruct an organisational chart to discover who can provide repair.

Governance also needs an expiry date. Permissions, profiles, and systems must be reviewed because the original purpose may disappear. An independent or plural committee can periodically examine exit rates, complaints, exceptions, and affected groups. Its conclusions should produce verifiable changes and proportionate public communication. When the organisation keeps a restriction, it explains why the restriction remains necessary. When it removes one, it documents how data and rights will be recovered. Review turns the possibility of leaving into institutional discipline rather than an exceptional concession.

Institutional sources for turning the principle into practice#

Four frameworks provide concrete reference points. The Spanish Data Protection Agency explains rights of access, rectification, erasure, objection, and portability. The European Commission’s Digital Services Act package places platform transparency and accountability within a common framework. The OECD’s work on digital government assembles principles for people-centred public services. The UNESCO Recommendation on the Ethics of Artificial Intelligence links human oversight, proportionality, and the protection of rights.

These frameworks do not replace situated judgement, but they support verifiable questions: whether the exit is known before entry, whether it preserves an equivalent alternative, whether it corrects information wherever that information circulates, whether human review exists, and whether somebody is accountable for the result. The future becomes human when innovation does not imprison people in old choices. A democratic community demonstrates maturity not by never making mistakes, but by allowing its systems to be stopped, contested, and corrected. Where the exit is real, truth ceases to belong to whoever administers the database and returns to being a common construction, open to context, learning, and repair.