WebXRay Audit Finds Opt-Out Tracking Requests Are Not Honoured ⇥ globalprivacyaudit.org
WebXRay is a tool built by a former Google privacy engineer to audit websites for specific violations that may be legally actionable. The company markets its product to litigators finding privacy violations for lawsuits, and to businesses trying to understand their own compliance.
A recent audit by the company of popular websites indicates most still track users even when they opt out:
More concerning is that Cookie Choice Banners certified by Google fail to prevent Google from setting cookies after users opt out with a globally standard signal.
[…]
The California AG has endorsed Global Privacy Control (GPC) as the mechanism for consumers to exercise this right at scale. Under regulation, businesses must honor it. In 2022, the AG fined Sephora $1.2M for ignoring GPC. In 2025, Disney paid $2.75M — the largest CCPA settlement ever.
Google, Meta, and Microsoft all provided statements to 404 Media disputing its findings.
This report is split into two parts: Global Privacy Control and cookie banners, and I will begin with the latter. What is at best an attempt to put privacy controls in users’ hands is a burden and, according to WebXRay, does not work in most cases. Three providers audited by the company, all certified by Google and anonymized in this report, still permitted tracking in 77–91% of cases when users declined tracking cookies.
The irritation of these banners was supposed to be solved by the Global Privacy Control, which is more-or-less a replacement for the Do Not Track spec with actual legal obligation. But GPC is not yet a browser-level preference in Chrome or Safari. Also, this audit found tracking cookies from Microsoft were set 50% of the time when the GPC opt-out signal was set, Meta cookies were set 69% of the time, and Google’s were set 86% of the time.
I assume the numbers are not either 100% or 0%, as I would expect for out-of-the-box code, because some website developers must have customized their implementation to be legally compliant. That should be unnecessary. If we are going to make users responsible for carefully managing their privacy — which should also be unnecessary, but one thing at a time — they should at least work properly.

