Half the opt-outs are ignored. That is a measurement problem, not just a privacy one.

An audit of roughly 7,600 California websites found that the major advertising platforms ignore browser-level opt-out signals a striking share of the time. Global Privacy Control — the “do not sell or share my data” signal a browser can send on a user’s behalf — was disregarded around 87% of the time by Google, 69% by Meta, and 50% by Microsoft. The coverage filed the finding under privacy, and as a privacy failure it is exactly that. But there is a second reading, and from where an operator sits it is the one nobody is talking about.

Two readings of the same number

The privacy reading is straightforward. Users asked not to be tracked, and they were tracked anyway, most of the time. That is damning on its own terms and does not need my help.

The operator reading is this. Your targeting and your conversion counts ride on the same consent-and-signal layer the audit just showed is unreliable somewhere between half and nine times out of ten. If a “consented” audience is not actually consented, and a user who opted out is still sitting in the pool you are measuring, then the numbers you are optimizing against do not mean what the platform’s documentation claims they mean. The measurement error and the privacy harm are the same defect viewed from two angles.

What it looks like from the account side

I have watched the mirror image of this from the operator’s seat. When you run one measurement stack across many accounts, a platform’s policy change is not an isolated incident — it is a fleet event. A single platform will quietly start blocking the same event parameters across a whole set of accounts at once. A naming collision in how signals are defined will break audience pushes across accounts on the same template. The instinct is to treat each one as a per-client bug and fix it client by client. The truth is that the signal layer you built on is controlled by someone else, changes without your say-so, and does not behave the way the compliance documentation promises.

The GPC audit is the consumer-side version of the same lesson. The consent state you are treating as ground truth is neither stable nor accurate, and you did not get a say in that.

Consent integrity is measurement integrity

The operator’s core discipline has always been the same: name which number is which, and never accept a channel’s self-report as the verdict. The audit is that discipline pointed at the consent layer itself. If opt-outs are honored somewhere between half and one-in-eight of the time, then your suppression is leaky in one direction and your measured audience is polluted in the other, and both of those quietly corrupt every read you take off the platform’s own dashboard.

You cannot optimize on a consent state you cannot trust. That is not a compliance sentence. It is a measurement sentence that happens to also be a compliance one.

What to actually do

Treat platform consent and audience state the way you treat any network grading its own homework: as one claim among several, not as the answer. Own the signal you can — the more of your measurement that is first-party, defined and instrumented by you, the less exposed you are when a platform silently narrows or mishandles the signal you were effectively renting. Audit the shared shape rather than the instance: when a platform changes a policy, assume it hit every account on the same template at once, and check the pattern instead of patching one client and moving on. And assume degradation is the baseline, not the exception, because on the evidence the platforms you depend on for signal are quietly narrowing and mishandling it, and building as if that is permanent is just accurate.

The takeaway

Half to nine-tenths of opt-outs ignored is a compliance story, and the compliance people are right to be alarmed. But do not let it stay only a compliance story. It is also proof that the consent-and-signal layer underneath your targeting and your reporting does not do what it says it does — and an operator who optimizes on a number without asking whether the number is real will keep being wrong in ways the dashboard will never surface. Consent integrity and measurement integrity turned out to be the same problem. You cannot buy either one back from the platform. You have to instrument it yourself.