Cookie opt-out banners persist as major tech firms face multibillion-dollar fines over data collection

Cookie opt-out banners have been widely used for years to let users refuse ad tracking. But a California audit cited by the webXray report suggests that, even after users click “Reject,” many major advertising companies continue to collect data as if no refusal was made.

Audit findings: opt-out signals not enforced

webXray says its March 2026 audit found that nearly 200 advertising services ignored opt-out signals in California, where privacy rules are described as similar to European requirements. The report frames the issue as one of superficial compliance: users are presented with a “Reject All” option, but the tracking behavior continues.

Across the sample, webXray estimates that up to 55% of websites still set cookies after a user declines. It also reports that 78% of banners could not protect users.

How the audit was conducted

The report states that the behaviors were observed directly through open network traffic, indicating the results were not limited to a rare bug or random occurrence. It also notes that violation levels vary by company.

Company-by-company results and potential fines

Microsoft: webXray found Microsoft’s ad network ignored about half of opt-out requests and continued tracking on 35% of client websites. The report estimates potential fines of about $390 million.

Google: the report says ignored opt-out signals were much higher for Google, with 86% of opt-out signals not enforced. Tracking appeared on 77% of tested websites, which webXray estimates could lead to fines up to $2.31 billion.

Meta: webXray describes Meta’s tracking code as not appearing designed to check opt-out signals from the outset. Among websites that detected such signals, 69% were still ignored and 21% actively continued to track users. The report estimates total potential fines for Meta could reach $9.3 billion.

Regulatory context and cost-of-business argument

The report links the current cookie-banner environment to privacy rules originally shaped by European laws requiring clear consent before tracking tools are enabled. It also notes that regulators have attempted to simplify cookie rules after years of complaints about confusing, manipulative, or obstructive banners.

webXray estimates advertisers could face fines totaling up to $5.8 billion, rather than giving up revenue tied to user data. Timothy Libert, founder and CEO of webXray and a former privacy engineer at Google, is quoted arguing that leadership may treat fines as a cost of doing business—contrasting “taxes due” with “fines for violations.”

Responses from the companies

Microsoft, Google, and Meta all deny the report’s conclusions. Microsoft says some cookies are necessary for normal website operation. Meta says that, in certain configurations, site administrators can override a user’s rejection choice. The companies involved argue that the report misinterpreted how their technology operates.