That report is concerning, but it is important to separate the article’s claims from what can be confirmed directly.
What the claim means
If a site or third-party ad service continues setting tracking cookies after receiving a valid Global Privacy Control signal, that could indicate one of several things:
- The signal is being ignored
- The site is misconfigured
- The third-party service is not honoring the request properly
- The cookies being set are being classified differently than the user expects
That said, I cannot verify the audit methodology or every vendor-specific allegation from the article alone, so I would be careful about treating every named company as conclusively proven guilty without reviewing the original audit and any responses from the companies involved.
Why GPC matters
GPC is meant to communicate a user’s opt-out preference automatically. In jurisdictions where it is recognized, it can carry legal significance, so if the audit is accurate, the issue is not just technical but potentially regulatory as well.
Practical takeaway for users
Even if privacy signals are enabled, users should not assume they fully stop web tracking.
- Use a browser or extension that supports GPC
- Block third-party cookies where possible
- Use reputable content blockers
- Review site permissions and browser privacy settings regularly
- Treat opt-out mechanisms as helpful, but not foolproof
Bottom line
The article highlights a real privacy concern, but the strongest conclusion at this stage is that browser privacy signals alone may not be enough. Independent verification, regulatory follow-up, and vendor responses are what will determine how serious and widespread the non-compliance actually is.