What they're not telling you: WebXray did an audit to see how compliant major sites and CMP managed sites are. Surprise surprise, they're not. 100% of the tested CMPs continued to set cookies after receiving GCP or "reject cookie" signals.
The theater of consent continues unabated, and I'm no longer interested in pretending this constitutes negligence rather than design. WebXray's findings confirm what contract work taught me: CMPs aren't compliance infrastructure—they're liability insulation. Google certifies CMPs that continue setting Google cookies post-rejection because the certification itself is the architecture of plausible deniability. When 100% of tested platforms violate identical signals, we're not observing market failure. We're observing a cartel maintaining operational security. The GPC protocol is the tell here. Every major platform *understands* the signal. Implementation would cost nothing. Yet they don't implement it. This suggests deliberate choice, not technical incompetence. What's genuinely fascinating is the regulatory lag. GDPR's Article 7 explicitly prohibits consent pre-ticking. These aren't gray areas—they're direct violations wearing compliance masks. The EDPB has said this clearly. Yet enforcement remains performative while the cookie ecosystems compound uninterrupted. The opt-out banner isn't broken technology. It's working exactly as intended: converting privacy into a meaningless gesture users are conditioned to dismiss. That's the actual story.
What the Documents Show
This is embarrassing for Google and, might I add, downright illegal. The best part is that Google 'certifies' these Consent Management Platfor.
Primary Sources
- Source: r/privacy
- Category: Tech & Privacy
- Cross-reference independently — don't take our word for it.
Disclosure: NewsAnarchist aggregates from public records, API feeds (Federal Register, CourtListener, MuckRock, Hacker News), and independent media. AI-assisted synthesis. Always verify primary sources linked above.