New Research: Google, Microsoft, Meta Track Users Despite Opt-Outs

Key Takeaways

• A forensic audit by webXray reveals that Google, Microsoft, and Meta are consistently circumventing user privacy opt-out signals.
• Despite users enabling Global Privacy Control (GPC), 194 online advertising services were found to set tracking cookies.
• Google exhibited an 86% failure rate, Meta 69%, and Microsoft 50% in honoring GPC signals.
• Consent Management Platforms (CMPs), including Google-certified ones, largely failed to prevent tracking.
• The industry faces a projected $5.8 billion in potential liability under the California Consumer Privacy Act (CCPA) due to these violations.

A comprehensive forensic audit has cast a critical spotlight on the privacy practices of tech titans Google, Microsoft, and Meta, alleging that these companies routinely disregard explicit user opt-out requests. The investigation indicates a systemic failure to adhere to privacy signals, with tracking cookies being deployed even after users activate the Global Privacy Control (GPC).

The March 2026 California Privacy Audit, conducted by webXray, uncovered that 194 distinct online advertising services continued to establish tracking cookies, bypassing users’ clear privacy preferences. This research, spearheaded by Dr. Timothy Libert, formerly a lead on Google’s cookie policy, involved an in-depth analysis of web traffic across thousands of popular websites located in California.

The findings paint a picture of widespread non-compliance with the California Consumer Privacy Act (CCPA). Researchers concluded that an alarming 55% of audited websites proceeded to set advertising cookies despite users having opted out, pointing to what they describe as industrial-scale privacy violations.

How Tracking Persists Despite Opt-Outs

The audit meticulously detailed the technical strategies employed by these companies to circumvent privacy settings. When a user activates GPC, their browser transmits a sec-gpc: 1 network request header. California law mandates that businesses must recognize this signal as a valid directive to cease sharing personal data. However, the audit identified significant failures across major platforms:

• Google (86% Failure Rate): Google’s ad servers frequently ignored the sec-gpc: 1 signal. Instead, they responded by instructing the user’s browser to create a two-year “IDE” advertising cookie. The researchers noted that Google could easily rectify this by returning an HTTP 451 “Unavailable For Legal Reasons” status code.
• Microsoft (50% Failure Rate): Microsoft’s tracking network exhibited a similar pattern. Upon receiving the GPC signal, it still unconditionally issued a one-year “MUID” tracking cookie to the user’s device.
• Meta (69% Failure Rate): Meta’s tracking pixel snippet, commonly embedded by publishers on their websites, was found to lack any mechanism to detect or respond to the GPC signal. Consequently, it fired without condition, recording tracking events irrespective of the user’s privacy choices.

Perhaps even more concerning was the revelation regarding Consent Management Platforms (CMPs). The audit determined that the vast majority of cookie banners, often presented as privacy solutions, failed to effectively protect users. This issue extended even to cookie choice banners officially certified by Google. Across three prominent Google-certified CMP vendors tested by webXray, the failure rates for preventing Google from setting cookies after an opt-out ranged from 77% to 91%.

Regulatory Fallout and Mitigation

California regulators have previously emphasized that disregarding the GPC constitutes a punishable offense. Recent CCPA enforcement actions have led to substantial penalties for organizations found to be improperly processing opt-out requests. The California Privacy Audit estimates a potential aggregate industry liability exposure of $5.8 billion stemming from these ongoing violations.

What You Should Do

To mitigate these privacy risks and avoid potential regulatory fines, organizations should consider the following practical steps:

• Implement Server-Side Rejection: Configure ad servers to actively detect the sec-gpc: 1 header. Upon detection, these servers should immediately terminate the request, ensuring no tracking payloads are delivered to the user.
• Adopt Conditional Script Loading: Website administrators should encapsulate all third-party tracking scripts within conditional statements. These statements must verify the presence of navigator.globalPrivacyControl before allowing script execution.
• Conduct Independent Traffic Auditing: Do not solely rely on third-party consent banners. Compliance teams must proactively monitor live network requests to independently verify that tracking cookies are indeed being blocked as intended after a user opts out.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.