Opt-out banners, rejecting cookies, GPC signals all ignored by Google, Meta, and Microsoft. Google certified CMPs continuing to allow Google cookies to be set? Not suspicious at all

The Take

Marcus Webb · Surveillance & Tech Privacy

The theater of consent continues unabated, and I'm no longer interested in pretending this constitutes negligence rather than design. WebXray's findings confirm what contract work taught me: CMPs aren't compliance infrastructure—they're liability insulation. Google certifies CMPs that continue setting Google cookies post-rejection because the certification itself is the architecture of plausible deniability. When 100% of tested platforms violate identical signals, we're not observing market failure. We're observing a cartel maintaining operational security. The GPC protocol is the tell here. Every major platform *understands* the signal. Implementation would cost nothing. Yet they don't implement it. This suggests deliberate choice, not technical incompetence. What's genuinely fascinating is the regulatory lag. GDPR's Article 7 explicitly prohibits consent pre-ticking. These aren't gray areas—they're direct violations wearing compliance masks. The EDPB has said this clearly. Yet enforcement remains performative while the cookie ecosystems compound uninterrupted. The opt-out banner isn't broken technology. It's working exactly as intended: converting privacy into a meaningless gesture users are conditioned to dismiss. That's the actual story.