An independent audit has revealed that Google, Microsoft, and Meta continue to track users’ browsing habits for ad-targeting purposes even after they opt out. The audit, conducted by the team behind the privacy-focused search engine webXray, examined traffic from California users visiting thousands of popular sites. They tested how companies handle opt-out requests submitted through the user’s web browser, and unfortunately, more than half of the tested sites still used ad cookies after being told not to.
According to the report, Google’s ad systems set an IDE tracking cookie in most cases, even when the browser submits a do-not-track preference. IDE tracking is a third-party advertising cookie that identifies a browser across sites, allowing Google to show targeted ads and measure ad performance.
Microsoft’s advertising services allegedly behave similarly about half the time. And for Meta, it’s even worse: The report says the tracking code publishers add to their websites doesn’t even check whether users have opted out. It still runs the tracking cookies either way.
This behavior likely violates California’s rules requiring companies to respect recognized browser privacy preferences, and continued noncompliance at this scale could expose the tech giants to significant fines. Of course, Google, Microsoft, and Meta dispute the audit’s conclusions and question its methods. Google says the webXray team misunderstands how its products and cookies work; overall, the companies maintain that they respect privacy laws and provide users control over data use, per 404 Media.
Independent researchers have not yet fully reproduced the audit, so there is still ongoing debate about what the traffic captures mean in both legal and technical terms.
