Be the First to Know.

Top US class action law firms and Fortune 100 in-house compliance teams use webXray to find actionable privacy violations first.

Request a Demo

Our Mission

The privacy industry sells a fantasy: all it takes to meet data protection law is a cookie banner, a few checkboxes, and a reassuring statement that "we value your privacy." In courtrooms across the US and Europe, that fantasy is collapsing, and the costs of noncompliance are adding up.

Measured with Real Browsers. Validated in Real Courtrooms

Sites with a cookie banner set ad cookies before consent

73%

US hospitals that set advertising cookies at page load

46%

Websites about religion and spiritual beliefs that leak data to Meta

1 in 3

Sites directed at children that expose IP addresses to Google

93%

Case Study: California CCPA Privacy Audit

Google-approved CMPs don't block Google's own cookies

We proved that CMPs pass the buck on CCPA compliance to website operators. We scanned the web from California with Global Privacy Control enabled, and we found an industry in crisis. We've made our dataset searchable, check your site for free.

View Case Study

One platform engineered to elevate your entire team. Navigate every legal challenge with purpose-built tools.

Litigation: Make Your Case Bulletproof

Litigation: Make Your Case Bulletproof

We pioneered pixel tracking research and supported a decade of privacy lawsuits. Stop racing headlines - find violations first. Search 1.2M sites for specific trackers. Forensic website preservation. Consent bypass analysis. Expert assistance & testimony.

Adtech & CMP: See Legal Risk Clearly

Adtech & CMP: See Legal Risk Clearly

California's 2026 audit found 194 adtech services ignoring opt-out signals and every CMP evaluated failing somewhere. webXray helps vendors prove disclosures, isolate broken integrations, and remediate risk before it compounds.

Enterprise: Be the First to Know

Enterprise: Be the First to Know

Your CMPs don't work, vibe-coded violations ship faster than you can audit, and new laws drop every quarter. We make compliance manageable. Full site scans via sitemap or URL list. Distributed scanning from real locations. Built-in privacy search engine. Forensic data export & integration.

Defense: Don't Get Left Behind

Defense: Don't Get Left Behind

Plaintiff firms are using our technology. You should know what they know. Impartial facts, without fear or favor. Scan client properties instantly. Privacy tool validation. Fact-check complaints in minutes. Evidence export for counsel.

The World's Largest Cookie Audit

The founder of webXray spent two years as cookie compliance lead at Google, conducting the world's largest-ever enterprise cookie audit. According to Google's Data Protection Officer:

Dr. Libert...drafted Google's internal cookie guidelines in 2021 and early 2022, which applies to all cookies or cookies-like objects, and outlines processes on managing cookies, storing cookies, logging data associated with cookies, server protocols, policies on data collection, and data linkage. In developing the cookie and web storage policy, Dr. Libert also led an audit of each Google-owned cookie to determine whether any did not comply with the policy.

Kristie Chon Flynn

Google Data Protection Officer

Evidence Produced Since 2012

2.4M+

Pages Scanned

900+

Peer-Reviewed Citations

20+

Major Press Outlets

Dr. Timothy Libert, Founder & CEO

Tim built webXray in 2012 as an academic research tool, then spent the next decade proving what it could do. He conducted the first million-site study of third-party tracking on the web, published the first peer-reviewed research on pixel tracking on medical websites - work that opened the door to hundreds of millions of dollars in settlements - and was the first to systematically compare what privacy policies say to what the code on a website actually does. That research was cited in Supreme Court briefs, featured on Good Morning America and All Things Considered, and covered by the New York Times, the BBC, the Financial Times, Wired, and dozens of other outlets. Over 900 peer-reviewed studies now cite his work.

His academic path ran through a PhD at the University of Pennsylvania, a postdoctoral fellowship at the University of Oxford, fellowships at the Alexander von Humboldt Institute and Central European University, and a faculty appointment at Carnegie Mellon's School of Computer Science, where he taught in the Privacy Engineering program and conducted research at CyLab. He then joined Google as a Staff Privacy Engineer, where he wrote the company's internal cookie and web storage policy, built compliance architectures at Google scale, and led an audit of every Google-owned cookie - the largest enterprise cookie audit ever conducted.

In 2023 he left Google to found webXray LLC, commercializing a decade of academic research and two years of Big Tech operations into a platform built for litigation, compliance, and enforcement. There is no one else in the industry who has published the foundational research, built the technology, written the compliance policy at the world's largest internet company, and then turned around to offer that expertise commercially. When courts, regulators, and Fortune 500 privacy teams need the final word on what a website is actually doing, they call Tim.

Jim Moffet, Co-founder & CTO

Jim brings a unique blend of high-growth startup engineering and federal privacy compliance expertise to his role as Co-founder and CTO. He was a founding engineer and product leader at Impactive, a Y Combinator-backed technology platform. Under his product leadership, the platform was white-labeled as the "Vote Joe" app in 2020, serving as the centerpiece of the Biden Campaign's $100 million remote organizing effort during the pandemic. During his tenure, the platform powered over 2,000 campaigns and NGOs, and Jim led the experimental design for the largest-ever randomized controlled trial on digital friend-to-friend voter mobilization. Impactive was acquired by ActBlue in 2025.

Following his startup tenure, Jim transitioned to public service as a principal R&D engineer at 10x, the federal government's public technology venture studio. In this role, he specialized in navigating complex regulatory environments to launch national-scale shared services. As the Director of AI Engineering for USAi.gov, he scaled the federal government's first enterprise AI platform from a prototype to the federal government's principal shared AI services platform in under a year. Jim led the rigorous privacy and cybersecurity compliance process for USAi.gov, securing a FISMA Moderate Authorization to Operate (ATO) for the GSA in less than three months.

Jim's deep expertise in privacy-enhancing technologies extends to the highest levels of national policy. Under the Biden administration, he sat for GSA on the President's Interagency Policy Council on Privacy within the Executive Office of the President, helping to coordinate PETs working group efforts alongside the NSF and NIST. He also served on the US Chief AI Officers' Council, where he co-authored the first Federal Generative AI Playbook.

Jim holds a graduate degree in Technology Design from Harvard University and an undergraduate degree in Computer Science from DePaul University. He was a Fulbright Fellow at Central European University and a Harvard Tech for Social Good Fellow. Jim has guest lectured on federated learning, data privacy, and civic tech at Carnegie Mellon University's School of Computer Science and the CyLab Security and Privacy Institute.

Dr. Simson Garfinkel, Senior Advisor

Simson Garfinkel is the Chief Scientist of BasisTech, LLC., a technology accelerator in Somerville, Massachusetts, and a Lecturer at Harvard University, where he teaches on Cybersecurity Policy at the Kennedy School of Government and an interdisciplinary course on AI, Internet of Things, and Cybersecurity at the Harvard Division of Continuing Education.

Dr. Garfinkel holds seven US patents and has published more than 80 research articles in computer security and digital forensics. He is a fellow of the American Association for the Advancement of Science (AAAS), the Association for Computing Machinery (ACM) and the Institute of Electrical and Electronics Engineers (IEEE), and a member of the National Association of Science Writers.

Garfinkel is the co-author of Law and Policy for the Quantum Age, which explores the technology, history, policy, and business implications of quantum information science. As a journalist, he has written about science, technology, and technology policy in the popular press since 1983, and has won several national journalism awards.

Garfinkel received three Bachelor of Science degrees from MIT in 1987, a Master of Science in Journalism from Columbia University in 1988, and a Ph.D. in Computer Science from MIT in 2005.

Our data has been scrutinized by

  • Ars Technica
  • Axios
  • BBC
  • Business Insider
  • Fast Company
  • Financial Times
  • Gizmodo
  • Mashable
  • NBC
  • New Scientist
  • NPR
  • The New York Times
  • The Guardian
  • The Next Web
  • The Register
  • The Verge
  • Vice
  • Vox
  • Wired

Don't Be the Last to Know