An audit has found Google, Microsoft, and Meta have ignored privacy opt-out signals on most California websites, setting ad cookies despite legal mandates.