A new independent privacy audit has found that Google, Meta, and Microsoft are frequently ignoring user requests to opt out of tracking, potentially violating California privacy regulations.
The audit, conducted by privacy search engine webXray, analyzed web traffic from more than 7,000 popular websites in California during March 2026. The study found that 55 percent of the sites checked set advertising cookies even when a Global Privacy Control (GPC) signal was present.
Google showed the highest rate of non-compliance, failing to honor opt-out signals 87 percent of the time. The audit specifically noted that Google’s servers responded to opt-out requests with commands to create an advertising cookie named 'IDE.'
Meta’s failure rate was recorded at 69 percent. The report claims Meta instructs publishers to install tracking code that lacks any check for standard opt-out signals, causing it to load and set cookies regardless of user preferences.
Microsoft failed to honor opt-out requests in 50 percent of the audited traffic.
Conflict of interest in cookie management
The report also scrutinized Consent Management Platforms (CMPs), the pop-up banners used to manage user permissions. The audit found that no Google-certified CMP evaluated by webXray worked 100 percent of the time.
WebXray founder Timothy Libert, a former Google employee, noted a potential conflict of interest since Google runs the program that certifies these platforms. Libert stated that his previous role at Google focused on protecting users, but his superiors prioritized protecting the company.
"In many ways fines have come to replace taxes," Libert said regarding the multibillion-dollar penalties these companies have previously paid for privacy violations. He argued that the current enforcement of privacy laws is failing because the companies do not fear the financial impact of such penalties.
Google disputed the findings, claiming the audit was based on a "fundamental misunderstanding" of how its products operate.
