Google, Microsoft, Meta Tracking You Even if You Opt Out – New Research

webXray's March 2026 California Privacy Audit finds that many online advertising services and certified Consent Management Platforms systematically ignore the Global Privacy Control (sec-gpc:1) opt-out signal, resulting in widespread tracking-cookie deployment despite user opt-outs (examples: Google 86% failure, Microsoft 50%, Meta 69%; CMP opt-out failures 77–91%). The report highlights potential industry liability (estimated ~$5.8B), documents technical bypass mechanisms, and recommends server-side GPC rejection, conditional loading of third-party scripts, and independent network auditing to ensure compliance.