I am curious about how opt-outs and PII removal work.

Who confirms those requests are legit?