Bottom line: Those annoying cookie-consent banners that have flooded the internet over the past several years are supposed to give users the option to block most tracking cookies from advertisers. However, a recent California audit claims that the largest ad tech companies usually send cookies anyway, having decided that simply paying potential billions in fines is more profitable.

California-based auditor webXray reports that tech giants have continued to use cookies to track users across the internet, even when website visitors reject them. Google, Microsoft, and Meta have all disputed the findings.

The now-ubiquitous cookie banners emerged in response to European privacy laws requiring explicit consent before deploying advertising and tracking cookies.

After years of complaints about dense, manipulative prompts that users often click through without reading, regulators have begun pushing for simpler rules. Still, webXray's March 2026 audit found nearly 200 ad services ignoring opt-out signals from California users, sidestepping rules modeled on Europe's framework.

Across the sample, 55% of sites set cookies even after users declined them, and 78% of consent banners do nothing to enforce the user's choice. webXray estimates ad tech companies could pay some $5.8 billion in fines instead of complying. On sites using Google or Microsoft ad networks, the systems frequently issue commands to drop cookies even after receiving explicit rejection signals.

The audit traces this behavior directly in open network traffic, suggesting little effort to conceal it. Microsoft's network reportedly ignores about half of opt-out signals and still tracks users on 35% of client sites, resulting in an estimated $390 million in fines. Google's figures are higher, with 86% of opt-out requests ignored and tracking active on 77% of sites, for an estimated $2.31 billion in penalties.

Meta's implementation stands out for a different reason: its tracking code does not appear to check for opt-out signals at all. Among sites that do detect those signals, 69% still ignore them, with 21% actively tracking users. webXray estimates Meta may have paid as much as $9.3 billion in fines to date.

webXray founder and CEO Timothy Libert, who previously worked as a privacy engineer at Google, told 404 Media that during his time there, leadership often failed to distinguish between taxes and fines.

All three companies pushed back on the report, saying the audit mischaracterizes their technologies. Microsoft said some cookies are necessary for site functionality, while Meta argued that certain implementations allow websites to override opt-out signals.