A new audit by researchers at webXray has found widespread noncompliance with California's privacy law, with major companies such as Google, Microsoft, and Facebook parent company Meta ignoring the requirement to not track users who set a specific "Global Privacy Control". The report estimates that if all websites found to be violating the law were fined, it could result in billions of dollars in penalties. Google was found to continue tracking users 86% of the time despite receiving the signal, while Microsoft failed to honor the signal in 50% of instances. The researchers say the companies' failures are due to a lack of effort to comply with the law.
Written by the local model on 2026-09-04,
using this article's own text rather than the other coverage of the
same event (that is the story summary below).
The Markup, now a part of CalMatters, uses investigative reporting, data analysis, and software engineering to challenge technology to serve the public good.
asserted
Markup → use → good
Sign up for Klaxon, a newsletter that delivers our stories and tools directly to your inbox.
asserted
that → sign → inbox
A new audit has found that websites across the internet may be failing to abide by California privacy law, ignoring a requirement to not track visitors who set a privacy control.
uncertain
who → find → control
The report, from researchers at webXray, a firm headed by a former Google privacy engineer, said the findings suggest major companies may be simply ignoring the law, and could point to “industrial-scale noncompliance with California requirements.”
uncertain
companies → head → requirements
WebXray estimates that if the California Privacy Protection Agency fined all of the websites it found failing to comply with the law, it could result in billions of dollars in penalties.
uncertain
it → estimate → penalties
“While we don’t have comment on the finding of this specific report,” Tom Kemp, executive director of the privacy protection agency, said in a statement, “we do appreciate that the report brings visibility to the importance of opt out rights.”
asserted
report → have → rights
Why a new California law could change the way all Americans browse the internet
Legislation recently enacted in California will make it easier for consumers nationwide to protect their data
Under California law, businesses are required to respect a signal called the Global Privacy Control.
uncertain
businesses → change → signal
If users navigate the web with the control turned on — either through a setting in the browser or a third-party tool — it tells websites not to sell or share their personal information.
asserted
it → navigate → information
The California Consumer Privacy Act requires businesses to acknowledge the control and to not track people who use it.
asserted
who → require → it
The state privacy agency has fined companies millions for failing to honor the control, among other violations.
asserted
agency → fin → violations
To understand whether the law is truly being respected, the researchers visited more than 7,000 popular websites from a California internet address.
asserted
researchers → understand → address
According to the report, major tech companies continued to track users, even with the signal turned on.
uncertain
signal → accord → users
Google continued to track users in 86% of cases despite receiving the signal, according to the report.
uncertain
Google → continue → report
When visitors traveled to the websites while using the signal, the sites still frequently set a cookie from Google to follow those visitors.
asserted
sites → travel → visitors
Similarly, according to the report, Microsoft failed to honor the signal in 50% of instances.
uncertain
Microsoft → accord → instances
The report found that trackers from Facebook parent company Meta don’t just ignore the signal — they fail to check for it at all, leading to tracking 69% of the time despite the signal.
asserted
they → find → signal
All of those failures could be remedied with slight changes to the tracking code to respect the signal, the engineers said in the report.
uncertain
engineers → remedie → report
“They don’t make any substantive effort to comply,” said Tim Libert, founder and chief executive of webXray.
asserted
Libert → make → webXray
The report also found that third-party tools that purport to help businesses place advertisements that comply with the law still frequently failed to honor the anti-tracking signal.
asserted
that → find → signal
In one case, a product did not honor those requests more than 90% of the time, the report found.
asserted
report → honor → time
The tech companies dispute the idea that they are failing to abide by the law.
asserted
they → dispute → law
“As outlined in our Privacy Statement, when we receive a GPC signal, we opt the user out of sharing personal data with third parties for personalized advertising, and our advertising systems are designed to reflect that choice,” Courtney Ramirez, a Microsoft spokesperson, said in a statement.
asserted
Ramirez → outline → statement
“Certain Microsoft cookies are necessary for operational purposes, and may therefore be placed and read even when a GPC signal is detected.”
uncertain
signal → place → purposes
Jackie Berté, a spokesperson for Google, said the company complies with the law and that the audit was “based on a fundamental misunderstanding of how our products work.”
asserted
products → say → misunderstanding
A spokesperson for Meta didn’t immediately respond to a request for comment.
asserted
spokesperson → respond → comment
“The idea that I misunderstand anything is a demonstrable falsehood,” Libert said, pointing out his work on cookie policy at Google.
asserted
Libert → misunderstand → Google
“I would assert that, when I was there, I knew more about it than anybody else,” he added.
asserted
he → assert → anybody
