California’s privacy law is being broken at industrial scale and regulators are watching – Startup Fortune
Publish Date: 2026-04-25 22:25:00
Source Domain: startupfortune.com
A new audit from webXray has found that Google, Microsoft, and thousands of other websites are systematically ignoring California’s privacy opt-out law, exposing the industry to billions in potential fines as regulators accelerate enforcement.
The findings are stark. Researchers from webXray, led by a former Google privacy engineer, visited more than 7,000 popular websites from a California internet address while broadcasting a privacy control signal under the California Consumer Privacy Act. The law is clear: businesses must honor that signal and stop tracking. Most didn’t. Google continued tracking users in 86% of cases. Microsoft failed to honor the signal in 50% of instances. Third-party ad tools sold as CCPA-compliant ignored opt-out requests more than 90% of the time. As The Markup reported on April 21, the audit suggests major companies are simply not trying to comply.
The timing matters. California entered 2026 with updated CCPA regulations that took effect January 1, including mandatory privacy risk assessments for companies using automated decision-making technology, expanded consumer access rights, and a more aggressive enforcement posture from the California Privacy Protection Agency. That posture is not theoretical. February’s $2.75 million settlement with Disney and ABC, the largest CCPA penalty to date, established that opt-out failures cascading across devices and services will be treated as distinct violations. PlayOn Sports paid $1.1 million in March for forcing users to accept tracking before accessing purchased tickets. Honda paid $632,500 in January. Combined 2026 enforcement penalties already exceed $4.2 million in the first quarter alone.
WebXray estimates that fining every non-compliant website it identified would produce penalties in the billions. That number is academic for now, but it signals the exposure sitting quietly on the books of thousands of companies that have treated CCPA compliance as a…
