What must apply after “Reject”
Anyone who rejects in the banner must not be tracked afterwards, on any page of the website. The choice has to be saved so the banner does not ask again on every click.
How it works
A rejection is the opposite of consent: without consent, no tracking cookies may be set and no statistics or advertising services called (the ePrivacy rules, in Germany § 25 TDDDG, and Article 6 GDPR). That applies not only on the page where the visitor clicked, but on every page that follows.
Technically, the consent tool has to pass the choice on to every script. A tag in the tag manager without a consent condition, or a snippet hard-coded in the template, keeps running despite the rejection.
bytereport clicks “Reject” in the banner and then loads all checked pages. Every tracking cookie that appears after the click and every request to a tracking service counts. Cookies that were already there before are covered by the check before consent.
What matters
- No tracking after rejection. Neither new tracking cookies nor requests to statistics or advertising services, on subpages neither. This is the most serious failure in this area.
- Cover every route. Tag manager, hard-coded snippets, plugins with their own tracking and pixels in embedded content: each of them has to know about the rejection.
- A consent signal is not enough. If the page reports “denied” through Consent Mode or TCF but the requests carry on, everything depends on how the services treat the signal (see consent signals).
- Save the rejection. If the banner comes back on the next page after “Reject”, the choice is not being saved. Someone asked over and over will eventually click “Accept”, and consent obtained that way is hardly freely given. Storing the choice itself needs no consent; it is strictly necessary.
How to set it up
In the consent tool, assign every service to a category and let its script load only with consent. In Google Tag Manager, each tag has “Consent Settings” where you can require additional consent; set it for every tag that tracks, or use triggers that only fire after consent. Remove hard-coded snippets from the theme and plugins. If the banner does not remember the rejection, the cause is often the consent cookie being set for the wrong domain or path, for example only for www; whoever looks after the website fixes that in the consent tool.
Check it yourself in a private window: click “Reject”, move through a few pages and look for requests to tracking services in the network tab.
This is not legal advice; your data protection officer or a lawyer decides the individual case.