Websites break California privacy law at ‘industrial scale,’ survey finds
Websites break California privacy law at ‘industrial scale,’ survey finds
Publish Date: 2026-04-29 11:54:00
Source Domain: www.daylightsandiego.org
Tech companies like Google, Facebook and Microsoft are ignoring data controls mandated under California law, researchers say.
Written by Colin Lecher, CalMatters
This story was originally published by CalMatters. Sign up for their newsletters.
A new audit has found that websites across the internet may be failing to abide by California privacy law, ignoring a requirement to not track visitors who set a privacy control.
The report, from researchers at webXray, a firm headed by a former Google privacy engineer, said the findings suggest major companies may be simply ignoring the law, and could point to “industrial-scale noncompliance with California requirements.”
The stakes are potentially high. WebXray estimates that if the California Privacy Protection Agency fined all of the websites it found failing to comply with the law, it could result in billions of dollars in penalties.
“While we don’t have comment on the finding of this specific report,” Tom Kemp, executive director of the privacy protection agency, said in a statement, “we do appreciate that the report brings visibility to the importance of opt out rights.”
Under California law, businesses are required to respect a signal called the Global Privacy Control. If users navigate the web with the control turned on — either through a setting in the browser or a third-party tool — it tells websites not to sell or share their personal information.
The California Consumer Privacy Act requires businesses to acknowledge the control and to not track people who use it. The state privacy agency has fined companies millions for failing to honor the control, among other violations.
To understand whether the law is truly being respected, the researchers visited more than 7,000 popular websites from a California internet address. According to the report, major tech companies continued to track users, even with the signal turned on.
Google continued to track users in 86% of cases…
