Google Ignores Your Privacy Opt-Out 86% of the Time, Audit Finds

Laptop screen displaying code in a dark room with light reflecting off the display — Photo via Unsplash

TL;DR: Dr. Timothy Libert (a privacy researcher who spent two years as Google’s own lead on cookie policy and compliance) audited over 7,000 California websites in March 2026. He found that Google ignores legally required Global Privacy Control (GPC) opt-out signals 86% of the time. Meta ignores them 69% of the time. Microsoft, 50%. In total, 194 of 242 advertising services tested kept tracking users who explicitly asked them to stop. The estimated aggregate liability under California law: $5.8 billion. Google’s response? It called the findings a “fundamental misunderstanding.”

The Man Who Knows Where Google’s Cookies Are Buried

Tim Libert isn’t some random security researcher with a blog. He spent 15 years in academia studying web privacy. Then Google hired him. From 2021 to 2023, he worked at Google’s Sunnyvale offices as the lead on cookie policy and compliance. He built the tools. He knew the systems. He saw how it all worked from the inside ^[1] ^[2].

Now he runs webXray, a privacy analysis firm whose methodology has been peer-reviewed and cited in academic research over 1,000 times. National and state regulators have used his tools. Courts have accepted his data as evidence in federal and state litigation ^[3].

In March 2026, Libert pointed those tools at 7,634 popular California websites. He ran two scans using unmodified Google Chrome: one with the Global Privacy Control signal enabled, one without. Then he counted the advertising cookies ^[3].

The results? “In my view this stuff isn’t complicated,” Libert told 404 Media. “You say, ‘don’t set the cookie.’ They set the cookie” ^[1].

What Is GPC and Why It Matters

Global Privacy Control is an HTTP header, a single line of code (Sec-GPC: 1), that your browser sends to every website you visit. It says: “I opt out of the sale or sharing of my personal information.”

This isn’t a polite suggestion. California’s Attorney General formally endorsed GPC as a valid opt-out mechanism under the CCPA. When a California user sends a GPC signal, businesses are legally required to treat it as a binding opt-out request. Full stop ^[2] ^[3].

The AG proved they meant it in 2022 when Sephora got hit with a $1.2 million fine, the first major CCPA enforcement action, specifically for ignoring GPC signals ^[3].

The Numbers, Company by Company

Google: 86% Failure Rate

Google’s advertising infrastructure is on 77% of the websites Libert sampled. Despite receiving the GPC signal, Google set 11,021 advertising cookies anyway. That’s an 86% failure rate ^[3].

The cookies include __gads, __gpi, IDE (a two-year advertising cookie), and trackers from Google’s core services, Marketing Platform, and YouTube. When Google’s ad servers receive the Sec-GPC: 1 header, they routinely respond with a command to create the two-year IDE advertising cookie on the user’s device ^[3].

Google’s response: the findings are based on a “fundamental misunderstanding” of how its products work, and the company honors opt-outs “as required by law” ^[3].

Meta: 69% Failure Rate

Meta’s Facebook Pixel is installed on an estimated 5.8 million websites. The audit found a 69% opt-out failure rate, with 1,293 advertising cookies set despite the GPC signal ^[3].

The reason is almost comically blunt: Meta’s tracking code contains zero code to check for the GPC signal. It fires unconditionally. Every page load. Every time. The pixel doesn’t even look for the opt-out header before recording tracking events ^[3].

Meta called the audit “a marketing ploy that mischaracterizes how GPC works.” The company said GPC “only restricts certain uses” and can be overridden by site operators ^[3].

Microsoft: 50% Failure Rate

Microsoft’s tracking network is present on 35% of the sites Libert tested. Despite receiving opt-out signals, Microsoft set 7,550 advertising cookies, a 50% failure rate ^[3].

The primary culprit: MUID, a one-year advertising tracker on the .bing.com domain. Microsoft also sets tracking cookies through LinkedIn integration (li_fat_id, li_sugr, UserMatchHistory) ^[3].

Microsoft spokesperson Courtney Ramirez said the company opts users out of third-party data sharing when receiving GPC signals and that “certain Microsoft cookies are necessary for operational purposes” ^[2].

The Consent Tools Don’t Work Either

Here’s where it gets worse. Those cookie consent banners that pop up on every website? The tools that manage them (called Consent Management Platforms, or CMPs) are supposed to enforce your opt-out choice. Google certifies these platforms as compliant.

Libert evaluated all 11 Google-certified CMPs. Every single one failed to block Google’s tracking cookies after a user opted out. That’s a 100% failure rate among the tools Google itself certifies as privacy-compliant ^[3].

Three major Google-certified CMP providers had opt-out failure rates of 77%, 90%, and 91%. Those three alone face an estimated $1.3 billion, $305 million, and $229 million in potential liability ^[3].

So the opt-out button doesn’t work. The consent tool doesn’t work. The company that certifies the consent tool doesn’t honor opt-outs either. It’s opt-out theater all the way down.

$5.8 Billion in Potential Fines

Libert’s team calculated the potential aggregate liability by applying the average fine from six public CCPA enforcement cases to the 4,170 non-compliant websites they identified ^[3]:

Sephora (2022): $1.2 million
Healthline Media (2025): $1.55 million
Tractor Supply Co. (2025): $1.35 million
PlayOn Sports (2026): $1.1 million
Ford Motor Co. (2026): $375,703
Walt Disney Co. (2026): $2.75 million (the largest CCPA settlement to date)

Average fine per site: $1,387,617. Multiply by 4,170 non-compliant sites: $5.8 billion in aggregate exposure ^[3].

And that’s using the standard $2,500-per-violation penalty. California Civil Code §1798.155 raises it to $7,500 when intent is established. Given that Libert’s audit shows these companies systematically ignore a one-line code check, establishing intent shouldn’t be hard ^[3].

Tom Kemp, Executive Director of the California Privacy Protection Agency, acknowledged the report: “We do appreciate that the report brings visibility to the importance of opt-out rights” ^[2].

“Industrial-Scale” Noncompliance

The audit found that 55% of all 7,000+ sampled websites set advertising cookies despite the opt-out signal. Of the 242 ad tech vendors evaluated, 194 (80%) were found setting cookies despite GPC opt-out requests ^[1] ^[3].

CalMatters, the California nonprofit newsroom, described it as noncompliance at “industrial scale” ^[2].

Libert put it more bluntly to 404 Media: “This is the Strait of Hormuz in the data economy. If you want to make a change, this is where you cut it off. Anything short of that is theatrical political posture” ^[1].

The fix is technically trivial. Check for the header. Don’t set the cookie. A few lines of code. Google, Meta, and Microsoft all have the engineering talent to implement this in hours. They choose not to.

How Much Have These Companies Already Paid?

This isn’t their first time at the privacy-violation rodeo. The cumulative privacy fines tell their own story ^[3]:

Meta: $9.3 billion total, including the $5 billion FTC settlement in 2019, the €1.2 billion Irish DPC fine in 2023, and the $1.4 billion Texas AG settlement in 2024
Google: $2.3 billion total in privacy-related fines
Microsoft: $390 million, including a €60 million CNIL fine in 2022 for Bing cookies and a €310 million Irish DPC fine in 2024 for LinkedIn

Combined: roughly $12 billion in privacy fines. And they’re still setting the cookies.

What You Can Do Right Now

The audit proves that opt-out signals alone don’t work. Here’s what actually does:

Enable GPC anyway. It creates a legal record of your opt-out. In Firefox: Settings → Privacy & Security → Website Privacy Preferences → check “Tell websites not to sell or share my data.” In Brave: it’s on by default
Use uBlock Origin. It blocks tracking scripts before they run, so there is no cookie to set if the tracker never loads
Try Firefox with Enhanced Tracking Protection set to Strict. Firefox partitions cookies by default and blocks known trackers
Consider Brave. Shields block third-party cookies, trackers, and fingerprinting by default. GPC is enabled out of the box
File a CCPA complaint. California residents can file complaints at cppa.ca.gov. Every complaint creates enforcement pressure. The CPPA can’t fine what it doesn’t know about

The Bottom Line

Google’s former privacy engineer just proved that Google, Meta, and Microsoft systematically ignore a legally mandated, one-line privacy signal. The technical fix is trivial. The companies know exactly what they’re doing. They’ve paid $12 billion in fines and still won’t check for a single HTTP header.

As Libert put it: “You say, ‘don’t set the cookie.’ They set the cookie.”

The question isn’t whether California’s privacy laws work on paper. They do. The question is whether anyone will enforce them at the scale the violations demand.