They would have a legitimate reason to doubt that all cards individually opted out and so they'd probably send people a letter or post a notice somewhere (updated ToS, idk) that there is now a new form that makes it more annoying for you to opt out (have to enter other details, send a letter, whatever) and that opt-outs after date X (when the mass additions started happening) have not been processed.

Or you do it like the EU and make excessive data processing opt-in. (Where by "excessive" I mean something that doesn't fall within recital 47 of GDPR: "legitimate [e.g. marketing] interests of [the company] may provide a legal basis for processing, provided that [users' rights] are not overriding, taking into consideration the reasonable expectations of [users]". It's a grey area where this line is exactly, but Visa can't simply do whatever they want. They have to tell you what data they process, but nobody reads that, and for unexpected (arguably excessive) things they'd have to ask you to opt in.) But I guess that's a little beyond the scope of this comment thread.

Yes.

Source: That is what everyone did when microsoft turned Do Not Track on by default on IE. That's what you get with "self regulation".

Visa will just say, on their news page: "we updated our terms and condition, if you opted out in the past you must opt out again"

The only winning move against corporation involves NOT giving them your money. Anything else is futile in the current US legal landscape.

Oh, and they will probably work with the FBI to get whoever did that behind bars pretty quick.

Only one way to find out! What are the possible legal risks to an innocent researcher testing this worthy hypothesis? Asking for a friend of course ;)

Pretty sure that someone would be prosecuted for violating the CFAA.

Not saying that’s right, just that’s my commentary on the state of things today.