Does Your Reject Button Actually Stop Tracking? A 5-Minute Test

A cookie banner makes a promise. When it offers "Reject all" or "Necessary only," it tells the visitor that the site will not send their activity to advertising and analytics companies if they say no. This test checks whether your site keeps that promise. It takes about five minutes and needs only a desktop browser.

What you need

• Chrome, Edge, Firefox, or Safari on a computer.
• A private window (Incognito in Chrome), so no earlier choice is remembered.
• A short list of names to filter for: facebook, google, doubleclick, tiktok, linkedin, bing, clarity, hotjar, and any other vendor you know your site uses.

Step 1: Open the Network panel before the page loads

1. Open a new private window.
2. Open the browser's inspector: Cmd+Option+I on a Mac, Ctrl+Shift+I on Windows.
3. Click the Network tab.
4. Tick Preserve log, so requests stay listed when you move between pages, and tick Disable cache.

Step 2: Load your home page and touch nothing

Type your site's address and load it. Do not click the banner.

Type each vendor name into the Network filter box. Anything listed has already gone to that company, before the visitor made any choice. Write it down.

Step 3: Say no

Click Reject all, Necessary only, or whatever your banner offers to refuse. If the only way to refuse is inside a settings panel, turn every optional category off there and save.

Now clear the Network list (the round "clear" icon at the top left of the panel), so you see only what happens after the refusal.

Step 4: Browse like a visitor

Visit three or four pages that matter: a service or condition page, a doctor or location page, and the page where a visitor books, applies, or makes contact. Do not submit any form. Reload one page.

Filter for each vendor name again.

Step 5: Read the result

If nothing goes to those companies after the refusal, the banner is doing its job for the tags you tested.

If requests still go out, click one and open its Payload or Headers tab. Look for:

• The page address. dl in a Meta Pixel or Google Analytics request tells the company which page was open. Other vendors use their own names for it; look for your own page address in the request.
• The page title. dt in a Google Analytics request.
• The event. ev in a Meta Pixel request, en in a Google Analytics request.
• Identifiers. Cookie values such as _fbp or _ga that let the company connect the visit to others.

A request that carries the page address after the visitor said no tells that company which page the visitor read after refusing. That is the most serious finding a banner test can produce.

Also open the Application tab (Storage in Firefox) and look at Cookies. Advertising cookies such as _fbp, _gcl_au, or _ttp written after a refusal mean a tag ran anyway.

Why "Reject" often does not work

The same causes come up again and again:

• Hard-coded tags. A pixel pasted into the site's theme or header loads whatever the banner says, unless the consent platform is set up to block it.
• Tag manager triggers. Tags in Google Tag Manager fire on "All Pages" with no consent condition attached.
• The wrong consent model. The platform is set to an opt-out or implied-consent mode, so tags run until the visitor objects, and the objection is not applied to tags already loaded.
• Google consent mode, advanced setup. Google's own documentation says the advanced setup loads Google tags at once and sends measurements without cookies while consent is denied. See Google consent mode: basic versus advanced.
• Third-party widgets. Chat, scheduling, video, and review widgets load their own trackers from their own code.
• A server-side container. The browser sends events to a subdomain of your own site, and your server forwards them on. Filter for your own metrics. or sgtm. subdomain too. See Meta Conversions API and server-side tagging.

Record what you found

Take screenshots of the banner and of the Network list after the refusal, and note the date and time. If you fix something, run the test again and keep both results. Do not delete old tag manager versions or consent logs to make the history look cleaner; keep them.

What to do next

Fix the cause, then test again on a phone-sized window and in a second browser. Our remediation guide covers consent platforms and tag manager setup, and the compliance self-check covers the rest of the site.

Sources

Links checked on October 22, 2026.

• Chrome for Developers: Network features reference
• Google: Consent mode overview
• Meta Pixel developer documentation