We clicked Reject on 47 European stores. Eighteen went quiet. Five carried on tracking.

Press Reject and you’ve told the store no. What the store then does with that is invisible to you unless you open the network tab, and almost nobody does. So we did it, on a lot of stores, and we read the traffic.

We picked well-known online retailers in ten European countries before measuring anything: 60 in a first list, and 83 more in a second when 36 of the first turned us away. It isn’t a random sample. For each store we opened a clean browser profile, recorded every request, clicked the refusal, reloaded, and opened a second page. Then we did the same in a fresh profile with Accept, as a control. Without that, silence can just mean the store never had that tag. We checked the clicks against screenshots and measured the clicked stores on up to three passes on October 31, 2026. The outcome stayed the same on every pass but one, which changed only because we’d improved how we detect a Google endpoint.

That’s 47 stores, so read these as counts and don’t convert them to a European rate. The sample is chosen, and an interval on it would still be wide. For 16 of 47, for instance, it runs from about 22% to 48%.

Reject mostly does something

Before getting to the problems, here’s what deserves credit. The comparison below covers the 42 stores where both clicks worked.

The last two rows look bad until you read the requests. Most of those Analytics hits carry a consent state of G100, meaning both storage types were denied. Microsoft’s page-load requests after Reject mostly carry asc=D, its denied signal. [11] This is the system working as its vendors built it. Google’s Advanced Consent Mode is designed to keep sending after a refusal, without cookies, and its Basic mode sends nothing, “not even the consent status.” [10]

So “something still leaves the browser” isn’t a finding. With Advanced mode it’s guaranteed. The finding is that the same click led to very different outcomes, and the shopper sees an identical result: a banner that goes away.

Three products behind one button

Quiet. In 18 stores we saw no hit to any ad or analytics endpoint on our list, on the reload or the second page. Nine of them still loaded a tag library, which sent no event. Accept also worked on 14 of those, and on 10 it lit up trackers, so the silence there is real. For the other eight we can’t tell, since those stores either showed nothing under Accept or our Accept click failed. Server-side forwarding wouldn’t show up here at all.

A signal that says no. In 16 stores, what continued was the documented denied form: Google requests with G100, some going to Google’s cookie-free host [8], and Microsoft’s asc=D. In 15 of them we saw no ad or analytics cookies, and the other kept a _uetsid cookie, which can be Microsoft’s empty placeholder. Google calls these pings “anonymized and non-identifiable” [21] and says they carry coarse dimensions. Its help page also says that fields such as user_id and custom dimensions “will be sent normally” if a site sets them. [9] A lab study found the client ID random on each page under refusal, which is what Google describes, along with the page URL, screen resolution, and language. [12] We didn’t inspect those values store by store.

Vendors defend this, and researchers and some lawyers challenge it. [12][20] The EDPB’s guidelines say JavaScript that instructs a browser to send information can count as gaining access, though they add that this “does not systematically mean” consent is needed. [1] We found no regulator or court naming Consent Mode. That may only reflect the limits of our search, so treat it as an open question and don’t let a vendor tell you it’s settled in either direction. Microsoft’s own FAQ shows the tension in one place: it says UET must load before the user interacts with the banner, and also that you must obtain consent before activating the tag. [11]

Analytics carrying on. In eight stores, analytics kept running with storage on. Seven Google Analytics setups showed G101, ads denied and analytics granted, and a _ga cookie was there afterward. Some of this may rest on a national exemption for audience measurement. CNIL’s version requires anonymous statistics for the publisher alone, with no reuse by the vendor. [7] Whether a given setup qualifies is beyond what a network log can show.

Trackers firing. In five stores, requests after Reject included hits to ad platforms or a consent state of G111, both granted. Two of them, on the same retail platform, looked much like their own Accept runs: TikTok, Pinterest, Criteo, Google Ads, and cookies such as IDE, _ttp, and _gcl_au. We saw this on every pass. Both also put a delivery-country popup in front of our connection from Poland, so a local visitor’s experience may differ. It could be a broken integration or something the store doesn’t know about, and we can’t tell which from outside. That’s the outcome regulators have acted on: CNIL’s €150 million fine against SHEIN involved new cookies placed and others read after Refuse All, documented in recorded network files, which is roughly the method we used. [2][22] Condé Nast and American Express followed. [5][4] Those decisions apply French law to their own facts, and we aren’t saying any store here is in the same position.

There’s also the moment before you choose. Six of the 47 were already sending ad-tracker hits or G111 signals before any click. One of them went quiet after Reject, but cookies like _gcl_au and _fbp were already on the device by then. Germany’s data protection conference says scripts that may access the device shouldn’t run while the banner shows, where consent is needed. [17] In Rasaii and colleagues’ measurement, Reject changed nothing at the moment of the click, and about a quarter of already-set tracking cookies stopped being sent after a reload. [14]

The stores we couldn’t test

The largest number in this study is the one that doesn’t appear in the chart. Of 143 stores, 71 answered our browser with an error such as a 403, and three more showed a CAPTCHA. We didn’t try to get around any of them, and three others failed to load. Chrome ran headless with its own settings. A 2026 study of general homepages found headless browsers soft-blocked on 15.2% of sites [16], so retail is clearly far stricter. That cuts two ways. It makes our 47 a skewed sample, and it means automated audits of this kind, including a regulator’s or a researcher’s, can’t see half of these stores this way. It’s the same wall we met when we tested shopping agents.

Of the 66 that did load, ten showed no banner on screen within about ten seconds, and two put a country or language chooser in front of it, so we excluded those. In the remaining 54, 41 offered a refusal on the first screen and six inside settings. Seven had no button labeled as a refusal that we could find, four of them Polish. Some of those offer toggles and a save button a layer down, so they aren’t necessarily impossible to refuse, only harder. CNIL asks for a refuse option as easy as accepting. [6] Germany’s conference says a first-layer reject isn’t generally required. [17] And the EU Council’s October mandate would require one-click refusal, though that’s a negotiating text and not law. [19]

What this can’t show

• Anything server-side, such as the Conversions API or a tag gateway. Quiet in the browser isn’t quiet.
• Meta. Its pixel fired in only 2 of 42 stores under Accept, far fewer than other vendors, so our setup probably misses it. We can’t speak to Meta’s behavior here.
• What vendors do on receipt: logging, joining, modeling.
• Returning visitors, carts, and checkout, which is where conversion tags fire. A store can be quiet on two pages and loud on the third.
• Visits from an ad click, since we arrived with clean URLs.
• Anything about law. We connected from one network in Poland, and consent setups can vary by region.

Bouhoula and colleagues found analytics or ad cookies after refusal on 65.4% of 16,231 sites with a reject button, using a model to classify cookies. [13] Papadogiannakis and colleagues reported first-party ID leaks on 56% of CMP sites after Reject in 2020. [15] Neither number compares with ours: they counted different things on different sites, and a cookieless ping scores zero in the first. Ours is a slice of large retail that nobody seems to have isolated.

One disclosure: the author of this piece builds Kehai, a cookieless analytics product whose script also sends device data without a cookie. So we have a stake in where this argument lands, and the “no cookie doesn’t settle it” point above applies to us as well.

Run it on your own site

You don’t need any of our tooling, and it takes about ten minutes. It’s also the check most likely to surprise you, because tag managers and agencies change things without telling anyone.

• Open a private window, open the network tab, and turn on Preserve log
• Load your site and record what fires before you touch the banner
• Click your refusal, reload, and open a second page
• Filter for collect, /tr, action, and pixel, and include your own domain, since tag gateways live there
• Read gcs: G100 is both denied, G101 means analytics stayed on, and G111 means your refusal didn’t reach Google
• Check cookies for _ga, _gcl_au, _fbp, IDE, and _uetvid
• Repeat in a new window with Accept, so you know what each tag looks like when it’s on
• Go on to a product page and the checkout, which we couldn’t reach

Those gcs readings come from practitioners and one lab study, since Google publishes no table and warns that the values can change. [18][12][8] They held up in our control: all 35 Analytics setups showed G111 after Accept, and two also sent G100. Then decide what you actually want this button to do, because your Consent Mode wiring has already made that choice for your customers, whether or not anyone in the company did.

Sources

1. European Data Protection Board · Guidelines 2/2023 on the technical scope of Article 5(3)version 2.0, adopted October 7, 2024
2. CNIL · Cookies placed without consent: SHEIN fined 150 million euros (September 2025)
3. CNIL · Cookies and mobile application: 7 million euros fine against Fnac DartyOctober 22, 2026, a mobile app rather than the website
4. CNIL · Cookies: American Express fined €1.5 million (November 2025)
5. CNIL · Cookies placed without consent: the company that publishes vanityfair.fr fined 750,000 euros (November 2025)
6. CNIL · Questions-réponses sur les lignes directrices modificatives et la recommandationin French, on refusing as easily as accepting
7. CNIL · Cookies : solutions pour les outils de mesure d’audiencein French, the conditions for exempt audience measurement
8. Google for Developers · Consent mode overviewwhat is sent when consent is denied, and the different domain
9. Google Analytics Help · Consent mode on websites and mobile appscoarse dimensions, and fields sent normally
10. Google Ads Help · About consent modethe difference between Basic and Advanced
11. Microsoft Advertising · FAQ: UET and user consentthe asc parameter, and when the tag should load
12. Mertens, Bielova, Roca, and Santos · You can’t trust your tag neither: privacy leaks and potential legal violations within the Google Tag Managerone lab page inspected parameter by parameter, March 2024
13. Bouhoula and colleagues · Automated large-scale analysis of cookie notice complianceUSENIX Security 2024, model-classified cookies with a recall of 62.8%
14. Rasaii and colleagues · Intractable cookie crumbs: unveiling the nexus of stateful banner interaction and tracking cookiesJuly 2024 crawl, Firefox with Total Cookie Protection disabled
15. Papadogiannakis and colleagues · User tracking in the post-cookie eraWWW 2021, 27,180 CMP sites, crawled in 2020
16. Gundelach, Mühlhauser, and Herrmann · Detecting bot detection: prevalence, techniques, and implications for web measurement research10,000 homepages, June 2026
17. Datenschutzkonferenz · Orientierungshilfe Digitale Dienstein German, version 1.2, November 2024
18. Simo Ahava · Consent Mode V2 for Google tagspractitioner reading of gcs and gcd, 2024
19. Council of the European Union · Digital Omnibus mandate, document 14756/26a negotiating text from October 22, 2026, not law
20. IT-Recht Kanzlei · Google Consent Mode: Tracking-Revolution oder rechtliches Risiko?in German, a law firm’s argument that pings need their own consent, March 2025
21. Google Ads Help · Consent mode referencethe wording that cookieless pings are anonymized and non-identifiable
22. CNIL · SHEIN deliberation, courtesy translationthe refusal scenario and the recorded HAR files

MS

Editor-in-chief

Mikołaj Salecki

Writes about media, tech, and AI business for people who actually run digital. Former agency lead. Skeptic of frameworks that read better than they perform.

LinkedIn ↗Facebook ↗salecki.digital ↗

More articles →