Skip to content
Cookie Rocks

Does clicking “Reject” change anything?

It should. Here is what a cookie banner must do when a visitor refuses, what can go wrong behind a banner that looks fine, and how to check your own site in a few minutes.

What should happen

  • Nothing that needs consent loads: no analytics, no advertising pixel, no embedded video or map that tracks, until the visitor consents.
  • Nothing is stored for these tools: no new cookie, and no key in the browser’s storage.
  • The choice is remembered, so the banner does not come back on every page, and the visitor can reopen it at any time.
  • With Google Consent Mode, Google tags may still load and send signals without cookies, depending on the mode chosen. Some countries accept it, others ask for more: your country page says which.

What can go wrong

  • The banner shows, but the trackers behind it load anyway. Blocking is often a setting of its own, sometimes the last step of a setup wizard, and it is easy to miss.
  • Most trackers wait, except the ones added another way: a Google Tag Manager container, a tag pasted in the theme, a plugin that loads its own script.
  • Reject hides the banner, while cookies already set before the choice stay in the browser.
  • The choice is kept longer than the visitor’s country allows, or the banner never asks again.

What our tests show

This is not an impression. In October 2026, we tried seven popular free consent tools, six plugins from WordPress.org and one open-source library, one at a time, on a fresh WordPress, and loaded the same page with five common tools: a YouTube video, a Google map, Google Analytics, reCAPTCHA and hCaptcha. None of the seven held any of the five tools before the visitor chose.

Real sites show the same thing. On 7 November 2026, we visited 120 WordPress sites each in France, Germany and Canada, from each country, with a new browser and no click. Among sites with a clear cookie banner, a tracking cookie was set before any choice on 36 of 57 in France (63%), 21 of 53 in Germany (40%) and 17 of 19 in Canada, but Canada does not use the same consent rule as the European Union. A Reject button showed on the first screen on 42 of 57, 32 of 53 and 12 of 19.

How we measured this
  • Sites: WordPress sites of the national domain, from the same point in the ranking. Read: France 107, Germany 114, Canada 104 of 120 each.
  • Banner: cookie or consent text with a choice button, or a known banner tool. Doubtful cases set apart: France 3, Germany 9, Canada 6.
  • Cookie: the home page, 6 seconds, no click. We count names of marketing and statistics services in our catalogue, as on our country pages.
  • Reject: found by the words on the buttons, so a rare wording can be missed.
  • Limits: the sample is small, so read these as an order of magnitude, not as a national rate. This describes what we saw, not a legal finding.

Look closer, and the same faults come back again and again:

  • A banner that blocks nothing until it is set up. Blocking is often a setting of its own, or the last step of a setup wizard that many people never finish.
  • One year for everyone. Many of the most widespread banners set a choice duration of 365 days by default, the same for consent and refusal, whatever the visitor’s country. Some countries expect a shorter time, or a different one after a refusal: see how long a choice lasts, country by country.
  • A cookie list that looks complete, but is not right. On one live site we looked at, the list shown to visitors gave every cookie the same 365 days, filed everything under marketing, and said that Google Analytics shares nothing with third parties.
  • A banner that is not there. Some banners stay switched off after installation, and some hide themselves from automated checks, so a quick test sees nothing wrong.
  • Tools that slip through. A Tag Manager container, a tag pasted in the theme, or a plugin that loads its own script, such as a Meta Pixel, often keeps running behind a banner that otherwise works.

Most of these plugins can do better once they are carefully set up. But a banner that lets things through looks exactly like one that works, and few site owners check. With the same page and its settings out of the box, Cookie Rocks held all five tools until the visitor accepted, then started them on the same page. It keeps each choice for as long as the visitor’s country allows, and builds its cookie list from what your pages really load.

Authorities do check

These are not small print. Data protection authorities fine companies for trackers that run without a valid yes, big and small, and courts follow. One case per country, from public decisions:

Every decision we follow is on the page of its country, under “Recent decisions”.

Check it yourself

  1. Open your site in a private window, so your browser starts with no cookies.
  2. Open the developer tools (F12, or right-click and Inspect), then the Network tab, and reload the page.
  3. Before clicking anything, look for requests to google-analytics.com, googletagmanager.com, facebook.net or doubleclick.net, and for cookies such as _ga or _fbp (Application or Storage tab, then Cookies).
  4. Click Reject, then reload the page and browse to a second one. Nothing from these addresses should load, and no such cookie should appear.

Or let the free Audit do it

The Cookie Rocks Audit is our free plugin. It installs next to the cookie plugin you already have, looks at your pages as a new visitor would, before the choice and after Reject, and reads the settings of your plugin. Then it tells you, point by point, what is held, what is not, and what your visitors’ countries ask for. It changes nothing on your site.

If something needs fixing, Cookie Rocks Pro takes over the banner: every recognised tracker waits for consent, and stays blocked after Reject.

Get the free Audit
Try Pro free for 30 days

Using a well-known cookie plugin? See what we know about it.