Does the Reject button on your cookie banner actually stop tracking?
Most cookie banners on online stores look right. The questions regulators and plaintiffs’ firms ask are about what happens around the banner: what loads before anyone clicks, and what keeps running after a shopper presses Reject.
Facts checked: 13 Oct 2026
Watch the explainer
The script
You clicked Reject. So what happens next?
On a lot of online stores, the answer is: not much. Here’s how to see it for yourself.
Moment one: the page loads. Before you’ve touched the banner, tools can already be running: an ad pixel, analytics, a session recorder.
Moment two: the choice. Is Reject as easy to find and press as Accept?
Moment three: after you say no. Watch what keeps sending. On many stores the banner switches off new cookies, but tags that already loaded keep going.
Why does this happen? Usually nobody meant it. Tags get added by different people, and the consent tool was set up once and never revisited.
Regulators look at this. California’s actions against Sephora, Honda and Healthline each turned on what happened around the banner, not how it looked.
And some shoppers never click at all. Their browser sends a signal that says don’t sell or share my data. From 2027, California has browsers offer it to everyone.
Tolbrook checks the whole of it, broad and deep. See our sector reviews at tolbrook.com/reports.
The three moments that matter
A banner is one moment in a visit. What the tools on the page do is spread across three:
- Before the choice: what starts running the moment the page loads, before the shopper has touched the banner.
- At the choice: whether Reject is as easy to find and press as Accept.
- After the choice: what keeps running, and who keeps receiving data, once the shopper has said no.
Common ways a Reject button doesn’t stop tracking
These are the patterns that come up again and again in the public cases:
- Advertising and analytics tags are loaded straight into the page, outside the consent tool, so the banner has nothing to switch off.
- The consent tool blocks new cookies after Reject, but tags that already loaded keep sending data.
- Reject applies to cookies only, while pixels keep sending page views and purchases.
- A tag was added later by an app, a plugin or an agency, and never connected to the consent tool.
- Reject is hidden behind a “Manage settings” screen while Accept is one click.
Why it is usually nobody’s fault
On most stores the banner and the tags are run by different people. The marketing team adds a pixel, an app installs its own tag, and the consent tool was set up once and never revisited. Buying a consent platform does not move responsibility for how it is set up: in one public case, a retailer’s consent tool was set up wrongly and opt-out requests went unprocessed for 40 days.
How to look at it on your own site
Open your site in a private window with your browser’s developer tools on the network tab. Before touching the banner, note which outside companies receive requests. Press Reject, then click through two or three pages and note them again. Anything still sending to an advertising or analytics company after Reject is worth asking your team about.
Repeat it on a phone-sized window: some sites show a different banner, or none, on a phone.
Public cases about consent banners
Healthline settles claims that its opt-outs and consent banners did not work
A consent banner is judged by what the trackers do after a click, not by how the banner looks.
Read the summaryHonda ordered to make declining as easy as accepting
‘Accept’ and ‘decline’ must be equally easy to find and use.
Read the summaryRetailer Todd Snyder ordered to pay after a misconfigured consent tool left opt-outs waiting 40 days
Buying a consent management platform does not move responsibility for how it is set up.
Read the summaryFrench regulator sanctions Vanity Fair’s publisher over cookies placed before any choice
Calling an ad cookie ‘strictly necessary’ is tested against what the cookie actually does.
Read the summary
Each case is summarised on our news page and linked there to the regulator’s or court’s own announcement. Allegations are the regulator’s own, and a settlement usually comes without any admission.
Common questions
- Is a banner that only offers Accept a problem?
- In the Honda case, California’s privacy agency said accepting was made easier than declining. Public cases have focused on whether declining is as easy as accepting.
- What does “strictly necessary” cover?
- In the Condé Nast case in France, the regulator tested cookies labelled strictly necessary against what they actually did. A label in the banner is checked against the code behind it.
- We use a well-known consent platform. Isn’t that enough?
- The platform is a tool. What counts in the public cases is how it was set up and which tags it actually controls.
Read the sector reviews
The digital compliance problems behind actions like these are the ones we look for. Our sector reviews show which risks we find across a whole niche, ranked by how serious each one is.
Order a reportSources
This guide describes the market and public cases. It is not legal advice, and it says nothing about any particular website. Which rules reach your business is a question for your own counsel.