The checkbox has an actual statement associated with it about what it does. You don’t need to assume anything.
The only verification you could do so far is GDPR-style data export, and also the adherence to GDPR regulations (and even those might get skirted if they aren't operating in europe).