CookieHawk › Guides › What actually happens when someone clicks “Reject all”?

What actually happens when someone clicks “Reject all”?

A consent banner can look entirely correct and still stop nothing. The interface says no while the page code carries on as before. Here is how to find out what actually happens on your own website after a visitor declines.

Updated 2 September 2026 · 5 minute read

The gap between the button and the code

A consent banner does two things. It asks the visitor, and it is supposed to make sure the answer has consequences. The first part is easy to see. The second is easy to believe without checking.

In practice there are three places it breaks, and none of them have anything to do with how the banner looks:

Scripts that already started. If a tracking code sits directly in the page code, a banner loading afterwards cannot stop it. The request was sent before the banner even existed.
Tags without consent requirements. In Google Tag Manager, a tag without a consent setting fires regardless of what the visitor chose.
Cookies that are already set. A no stops further tracking, but does not necessarily remove what is already stored.

This is not a claim that your banner is wrong. It is a claim that you do not know until you have measured it — and that the measurement takes ten minutes.

The test, step by step

You need no tools beyond your browser.

Open a private window. This matters: if you have visited the site before, your choice is already stored, and you would be testing the wrong state.
Open developer tools before loading the page. In Chrome and Firefox: right-click, Inspect, and pick the Network tab.
Go to your website. Do not click the banner yet.
Look at the list of requests. Filter on the word collect, or on hostnames like google-analytics.com, doubleclick.net, facebook.com and tiktok.com. Everything listed here happened before the visitor got to choose anything.
Click “Reject all”.
Clear the list in the Network tab and reload without changing the choice.
Look at the list again. This is the answer: what your website does to a visitor who said no.

How to interpret what you see

Not everything that appears is a problem. There is a difference in what the requests do.

Fine: your own domain, fonts and images from your own server, and services strictly necessary for the site to work.
Worth a closer look: maps, video embeds and chat. Often functional, but they tend to set cookies and contact third parties.
Should not be there after a no: measurement tools and ad networks. If you see google-analytics.com, doubleclick.net, facebook.com/tr or similar after declining, data the visitor refused is being sent.

Note that a request to googletagmanager.com does not in itself mean anything is being measured. GTM can load without firing the tags — the point is what happens next.

Check the storage as well

The Network tab shows what is sent. The storage tab shows what is left behind.

Go to the Application tab in Chrome, or Storage in Firefox.
Look under Cookies and select your domain.
After a no, you should mainly see cookies necessary for operation, plus the consent choice itself.

If you see names like _ga, _fbp, _gcl_au or _ttp after declining, they were set by Google Analytics, Meta, Google Ads and TikTok respectively. They do not belong there without a yes.

A cookie can be set on your own domain and still belong to a tracking tool. That the domain looks like yours says nothing about its purpose. The name is what gives it away.

If you find something

The order that resolves most cases:

Work out where the script comes from: the theme, a plugin, or Google Tag Manager?
If it is in GTM, set a consent requirement on the tag and publish the container.
If it sits directly in the page code, it must either move into GTM or be blocked by the consent solution before it loads.
Run the test again. That is the only way to know the fix worked.

Common questions

Why is it not enough that the banner says “rejected”?

Because the banner shows its own state, not the website's. A banner can store the choice correctly and still have no way to stop a script that loaded before it did. The Network tab shows what was actually sent.

I see requests to googletagmanager.com after a no. Is that wrong?

Not necessarily. GTM can load without the tags firing. Look at what happens next: if requests go to measurement or advertising domains, the tags fired anyway.

Do old cookies have to be deleted when someone declines?

A no should at minimum stop further tracking. Clearing what is already set is good practice and makes the picture cleaner for the visitor, but the important thing is that no new tracking occurs.

How often should I test this?

After every change that can affect the page code: a new plugin, an updated theme, a new campaign snippet from an agency. In practice it is updates, not the original setup, that bring tracking back.

Want the answer without doing it by hand?

The free check performs exactly this test automatically: it loads your front page in a clean browser, declines, and shows which hostnames were still contacted. No account needed.

Check your website free