Google ignores user privacy signals in 86% of cases

A forensic audit conducted in March 2026 by the non-profit organisation webXray has revealed that Google ignores 86% of requests from California users to stop online tracking.

The investigation, led by Dr Timothy Libert, analysed web traffic across the internet’s most popular platforms, discovering that 194 advertising services continued to deploy tracking cookies even after users explicitly opted out.

Under the California Consumer Privacy Act (CCPA), businesses are legally mandated to honour the Global Privacy Control (GPC) signal.

This browser-level header, known as sec-gpc:1, serves as a binding "do-not-sell" request. Despite this, the audit identified three distinct patterns of non-compliance among industry leaders.

Google’s servers reportedly respond to the GPC signal by creating two-year advertising cookies, while Microsoft returns a one-year cookie regardless of the user's choice.

Most notably, Meta’s tracking pixel was found to lack any code to process GPC signals, recording user events unconditionally.

The audit further highlighted systemic failures within the industry's compliance infrastructure. None of the Google-certified Consent Management Platforms evaluated by webXray worked correctly 100% of the time.

In total, 55% of audited California websites were found to be setting advertising cookies despite active user opt-outs.

Legal experts suggest these findings represent a significant risk for the tech sector. Based on current CCPA penalty structures, the authors calculate a potential aggregate liability exposure of $5.8 billion for the non-compliant services identified.

As GPC now carries statutory authority in four US states, failing to abide by these signals has transitioned from a policy oversight to a punishable legal offence.