Does Opting Out of Tracking Actually Work?

What the California privacy audit found

In March 2026, a research group called webXray audited 7,634 of the most popular websites in California, scanned from a California IP address. The audit tested something specific: when a browser sends the Global Privacy Control signal - a standardized HTTP header documented at the W3C Privacy Community Group (Sec-GPC: 1) that says 'do not sell or share my personal data' - do websites actually comply?

The answer, for the majority of sites, is no. 55% of the websites audited continued setting advertising cookies and firing tracking scripts even after receiving the GPC signal. The biggest violators were the companies most people trust with their data: Google, Meta, and Microsoft.

Viallo is a private photo sharing platform that lets you create photo albums and share them through a link. Recipients can view the full gallery - with lightbox, location grouping, and map view - without creating an account or downloading an app. Photos are stored in full resolution, and every share link is private by default and revocable anytime.

I mention that here because the audit results paint a clear picture: the platforms most people use for photo storage and sharing are the same ones that routinely ignore privacy signals. The overlap is not a coincidence.

Google ignores your opt-out 86% of the time

Google had the worst compliance rate of the three. The audit found an 86% failure rate - meaning that on 86% of the websites where Google's advertising infrastructure was present, the sec-gpc: 1 header was completely ignored.

The specific mechanism is documented by Google. Google's advertising servers deploy a persistent cookie called 'IDE' to show Google ads on non-Google sites, and Google gives its lifetime as 13 months in the EEA, Switzerland and the UK, and 24 months everywhere else. When a browser sends the GPC signal requesting no tracking, the audit found those servers set the IDE cookie anyway. Cross-site tracking that can run for up to two years, triggered by a single page visit, in direct contradiction of the user's stated preference.

Google disputed the findings. A spokesperson said the audit was based on a 'fundamental misunderstanding' of how Google processes GPC signals. That's a familiar response - Google has used similar language to push back on privacy research before. The auditors responded that the methodology was straightforward: send the signal, check whether tracking cookies appear. They do.

This matters beyond web browsing. Google Photos, Google Drive, and Google's advertising network all share infrastructure. If Google's ad servers refuse to respect a simple HTTP header, the question of how seriously Google takes privacy signals across its entire ecosystem becomes harder to ignore.

Meta's tracking code has no off switch

Meta came in at a 69% failure rate. But the nature of Meta's non-compliance is arguably worse than Google's.

The auditors examined the source code of Meta's tracking pixel - the JavaScript snippet that millions of websites embed to send visitor data back to Facebook's ad network. They found that the pixel contains no code to check for the GPC signal at all. It's not that Meta's code detects the signal and ignores it. The code was never written to look for it in the first place.

That means every website running the Meta pixel - and there are millions of them - fires tracking requests unconditionally, regardless of any privacy signal the browser sends. If you visit a news site, an e-commerce store, or a recipe blog that has the Facebook pixel installed, Meta gets your data. Your browser's privacy preference is irrelevant because Meta's code doesn't read it.

This is the same company that was recently hit with a confirmed policy of training AI on user photos from Facebook and Instagram. The pattern is consistent: Meta collects data first and deals with regulatory consequences later.

Microsoft fails half the time

Microsoft's 50% failure rate is better than Google and Meta in relative terms, but it still means that on half of the websites using Microsoft's Bing advertising and analytics infrastructure, opt-out signals are ignored.

Microsoft has publicly positioned itself as more privacy-friendly than Google, especially with Edge browser's built-in tracking prevention features. The audit data suggests a gap between the marketing and the reality. When Microsoft's own ad tech is the thing doing the tracking, their privacy commitments get less consistent.

What this means for your photos

Does opting out of tracking actually work? Based on this audit, the direct answer is: not reliably. A 2026 study of 7,634 US websites found that 55% continue deploying advertising cookies after users send the Global Privacy Control opt-out signal. Google ignores the signal 86% of the time, Meta's tracking pixel has no code to detect the signal at all, and Microsoft fails to comply on 50% of sites. Browser-based opt-out mechanisms are not a dependable way to prevent tracking.

You might think tracking cookies are just about targeted ads. They're not. The same companies that ignore your opt-out signal for advertising also run the platforms where billions of people store their photos.

Google says more than 1.5 billion people use Google Photos each month, and Meta's chief executive has told investors there are hundreds of billions of publicly shared images on Facebook and Instagram. When these companies demonstrate - through audited data, not speculation - that they ignore explicit privacy signals, it raises a straightforward question: how seriously are they treating the privacy of your stored photos?

The audit didn't test photo platform behavior specifically. But the infrastructure is shared. Google's advertising cookies and Google Photos run on the same Google account system. Meta's tracking pixel and Instagram's photo storage are part of the same data ecosystem. If a company won't respect a simple HTTP header saying 'don't track me,' it's reasonable to question their commitment to photo privacy more broadly. For people who want to share photos without feeding data to these tracking systems, platforms that don't run advertising infrastructure are the cleanest option.

How to actually reduce tracking

GPC is still worth enabling. It creates a legal record of your preference, and some states - California, Colorado, Connecticut - treat it as a legally binding opt-out under their privacy laws. But the audit makes clear that the signal alone is not enough.

Here's what actually moves the needle, based on what the audit data shows and what security researchers consistently recommend:

• Enable GPC anyway. It's one header. Brave and Firefox enable it by default. In Chrome or Edge, you'll need an extension like Privacy Badger or DuckDuckGo Privacy Essentials. Having GPC active gives you legal standing if a company violates it.
• Use a content blocker. uBlock Origin blocks tracking scripts before they execute. This is more effective than GPC because it prevents the tracking code from running at all, rather than asking the code to respect a signal it ignores.
• Clear cookies regularly or use container tabs. Firefox's Multi-Account Containers let you isolate Google, Facebook, and other trackers into separate sandboxes so cookies can't follow you across sites.
• Switch to a privacy-focused browser for daily browsing. Brave blocks third-party cookies and trackers by default. Firefox with strict tracking protection is another solid choice.
• Separate photo sharing from tracked platforms. If you share photos through Google Photos or Facebook, those interactions feed the same tracking systems the audit flagged. Using a dedicated photo sharing platform that doesn't run ad tech removes that vector entirely.

The broader takeaway is simple: asking companies to stop tracking you doesn't work if those companies have a financial incentive to keep tracking you. The most reliable approach is to reduce your exposure to their infrastructure in the first place.

Advice that holds up regardless of this specific audit

Privacy audits come and go. Companies patch specific violations, new ones emerge, and the cycle repeats. But the underlying dynamics don't change: advertising-funded platforms will always have a structural incentive to collect as much data as possible. That's true whether the failure rate is 86% or 40%.

What consistently works is reducing your surface area. Fewer accounts on ad-supported platforms. Content blockers that prevent scripts from loading. Sharing photos through channels that aren't connected to advertising networks. These strategies don't depend on any single audit's findings - they're effective because they address the business model, not just the latest policy violation. For a deeper look at how Google Photos privacy settings actually work (and where they fall short), I covered that in a separate guide.

$5.8 billion in potential fines and what comes next

Per the California Consumer Privacy Act (Cal. Civ. Code § 1798.155), each intentional violation of a consumer's opt-out request can trigger civil penalties up to $7,500 per violation; non-intentional violations carry $2,500. The California Privacy Protection Agency has signaled that each individual cookie set in violation of GPC could constitute a separate violation, with estimated per-company penalties reaching $1.4 million per website. Across the scope of the audit's findings, researchers estimated potential aggregate liability at $5.8 billion.

Will those fines actually materialize? History suggests probably not at full scale. But the legal landscape is shifting. California's attorney general has already brought enforcement actions related to GPC compliance. Colorado's privacy law, which also recognizes GPC, took effect in 2024. Connecticut and other states have similar provisions.

The audit creates a public evidence base that regulators can reference. Even if Google successfully argues that the methodology has flaws, the raw data - cookies set, signals ignored, timestamps recorded - is hard to dismiss entirely. The next enforcement action doesn't need to prove intent. It just needs to show that the signal was sent and the tracking happened anyway.

For users, the regulatory trajectory is encouraging but slow. Meaningful enforcement takes years. In the meantime, the practical advice stays the same: don't rely on companies to voluntarily stop tracking you. Use tools and platforms that make tracking technically impossible, not just legally prohibited.

Frequently Asked Questions