Finding reference

Non-essential tracking continued after reject

Retained evidence showed a confirmed refusal-state transition followed by classified non-essential request or storage activity that began after confirmation, within the observed scan scope. Review the evidence context, methodology, common causes, and reviewer questions for this CertScore.ai finding.

Selected finding

Non-essential tracking continued after reject

HighGood evidenceDirect observationConsentSeen on ~1% of scanned top sites

Benchmark frequency is directional market context only. It is not a compliance benchmark, legal conclusion, or severity score. Rare findings may be top-ranked only when retained evidence is strong; common findings may remain medium when evidence is automated or context-dependent. Rarity is not severity, and prevalence is not compliance risk.

Observed

Retained evidence showed a confirmed refusal-state transition followed by classified non-essential request or storage activity that began after confirmation, within the observed scan scope.

Why this matters

This observation can help reviewers decide whether the site behavior deserves deeper privacy, accessibility, consent, or consumer-protection review in context.

Detection methodology

CertScore.ai records consent interaction events, verified consent-state transitions, runtime requests, cookie/storage activity, vendor classification, and coverage context. This finding is surfaced only when retained evidence confirms a refusal-state transition and anchors classified non-essential request or storage activity after that confirmation. Activity already in flight at confirmation is excluded. CertScore.ai treats post-refusal activity as a review signal and does not determine legal status, consent validity, vendor responsibility, or compliance status. Reviewers should consider necessity, purpose, timing, CMP propagation, consent mode, tag-manager rules, vendor configuration, and the bounded scan context.

Confidence semantics: Good when retained runtime evidence includes a confirmed refusal-state transition, post-confirmation timing, a classified non-essential request or storage artifact, a stable runtime anchor, and usable coverage; stronger when retained evidence also includes a pre/post comparison, vendor attribution, repeated examples, and enough detail for manual verification. Manual review is still needed for queued beacons, purpose, necessity, CMP configuration, and remediation quality.

Top-finding calibrationWhat must be retained to surface, top-rank, demote, or suppress this finding.

Minimum to surface

Confirmed refusal-state transition plus classified non-essential request or storage activity anchored after confirmation.

High confidence requires

Verified refusal state, pre/post sequence, temporal anchor, and artifact classification.

Top ranking requires

Post-reject advertising, replay, identifier sync, or repeated post-reject artifacts.

Demote or suppress when

Reject button present but not clicked.
Refusal-state transition unconfirmed.
Unknown essentiality.
Activity already in flight when refusal was confirmed.

These rules describe ranking calibration for already-projected findings. They do not create findings from raw signals.

Example evidence

Post-reject runtime artifact

artifact=req_002
role=finding_supporting_artifact
url=https://example.com/
reject_action_timestamp_ms=2600
reject_action_observed=true
reject_interaction_status=observed [manual_review_recommended]
post_reject_request_timestamp_ms=4120
request_origin=https://analytics.example
request_path=/collect [query_redacted=true]
vendor_category=analytics
essentiality=non_essential
review_caveat=manual review should confirm reject success, queued-beacon timing, purpose, necessity, and CMP/vendor configuration

Review context

pre_reject_activity_observed=true
post_reject_activity_observed=true
consent_state_transition=manual_review_recommended
possible_source=cmp_to_tag_manager_propagation
coverage_status=usable
manual_review_needed=true

What should not count by itself

reject_button_present=true [insufficient_without_interaction]
vendor=Example Analytics [insufficient_without_post_reject_artifact]
post_reject_request_unknown_purpose [audit_only_until_classified]
tracking_before_reject_only [insufficient_for_persistence]

View redacted sample JSON

Redacted sample JSON

{
  "findingId": "reject_tracking_persists_after_reject",
  "label": "Non-essential tracking continued after reject",
  "category": "Consent",
  "criticality": "high",
  "evidenceConfidence": "good",
  "directVsInferred": "direct_observation",
  "evidence": {
    "summary": "Retained evidence showed a confirmed refusal-state transition followed by classified non-essential request or storage activity that began after confirmation, within the observed scan scope.",
    "examples": [
      {
        "title": "Post-reject runtime artifact",
        "lines": [
          "artifact=req_002",
          "role=finding_supporting_artifact",
          "url=https://example.com/",
          "reject_action_timestamp_ms=2600",
          "reject_action_observed=true",
          "reject_interaction_status=observed [manual_review_recommended]",
          "post_reject_request_timestamp_ms=4120",
          "request_origin=https://analytics.example",
          "request_path=/collect [query_redacted=true]",
          "vendor_category=analytics",
          "essentiality=non_essential",
          "review_caveat=manual review should confirm reject success, queued-beacon timing, purpose, necessity, and CMP/vendor configuration"
        ]
      },
      {
        "title": "Review context",
        "lines": [
          "pre_reject_activity_observed=true",
          "post_reject_activity_observed=true",
          "consent_state_transition=manual_review_recommended",
          "possible_source=cmp_to_tag_manager_propagation",
          "coverage_status=usable",
          "manual_review_needed=true"
        ]
      },
      {
        "title": "What should not count by itself",
        "lines": [
          "reject_button_present=true [insufficient_without_interaction]",
          "vendor=Example Analytics [insufficient_without_post_reject_artifact]",
          "post_reject_request_unknown_purpose [audit_only_until_classified]",
          "tracking_before_reject_only [insufficient_for_persistence]"
        ]
      }
    ]
  }
}

Regulatory review context

Consent effect: tracking persisted after reject

Retained runtime evidence showed post-reject request or storage signals that may be relevant to consent enforcement, cookie/tracker, storage/access, transparency, and vendor-governance review. Applicability depends on reject success, timing, purpose, consent state, necessity, exemptions, jurisdiction, and manual review.

ePrivacy cookie/storage refusal effect reviewGDPR consent effect and withdrawal reviewEU GDPR/ePrivacy post-reject tracking reviewUK PECR / ICO post-reject cookie review

View applicability notes

Legal and regulatory frameworks

ePrivacy cookie/storage refusal effect reviewRetained evidence suggests non-essential cookies, storage, or similar technologies may remain active after a refusal or reject action.
GDPR consent effect and withdrawal reviewConsent-effect review may be relevant where consent is used for personal-data processing and a refusal or withdrawal should affect downstream processing.

Jurisdictional contexts

EU GDPR/ePrivacy post-reject tracking reviewEU/EEA users and cookies, tracking, analytics, advertising, or profiling may be in scope depending on purpose, consent state, jurisdictional context, and manual review.
UK PECR / ICO post-reject cookie reviewUK users and non-essential cookies or similar technologies may be in scope depending on purpose, consent state, jurisdictional context, and manual review.

This finding does not determine legal status, consent validity, vendor responsibility, necessity, exemption status, or compliance status. Review the retained interaction evidence, post-reject runtime anchors, vendor purpose, queued-beacon timing, consent-state propagation, regional configuration, and applicable exemptions.

Evidence standard

Strong

Retained evidence includes an independently confirmed refusal-state transition with timestamp and interaction-state context.
Retained evidence includes a classified non-essential request or storage artifact anchored after confirmation.
Evidence includes stable runtime anchors such as URL origin and path with query redacted, cookie or storage key with value redacted, resource type, vendor or category, and timestamp.
Evidence excludes activity already in flight when the refusal was confirmed.
Coverage context indicates the interaction and post-reject observation were not materially blocked or unreliable.

Good

Retained evidence confirms the refusal and retains a post-refusal non-essential artifact, but the wider pre/post comparison is less complete.
The retained example is enough for a reviewer to inspect timing, vendor or category, and artifact details manually.
The evidence is likely relevant to reject-enforcement review, but queued beacons, strictly necessary activity, purpose, and CMP propagation require manual review.

Audit-only

Reject control was present but not clicked, or no confirmed refusal-state transition was retained.
Post-reject request exists but essentiality, purpose, or timing relative to reject is unclear.
Vendor name, CMP configuration, or policy text suggests possible persistence, but no retained post-reject runtime artifact supports it.

Insufficient

Reject button exists but was not interacted with.
Failed or ambiguous reject interaction without post-interaction runtime evidence.
Tracking observed only before reject.
Vendor name alone.
Snapshot boolean without post-interaction timeline and retained runtime anchors.
Post-reject request with unknown essentiality and no purpose classification.
Claims about legal status, compliance status, consent validity, vendor responsibility, or tracking lawfulness based only on automated evidence.

Evidence levels explain how CertScore.ai treats retained review artifacts. They are not legal conclusions.

Common causes

Reject event is not propagated from CMP to tag manager or vendor scripts.
Previously loaded scripts continue sending queued or delayed beacons after reject.
Consent mode is configured after vendor tags initialize.
Cookies or storage are not cleared, suppressed, or scoped after rejection.
Region, language, returning-user state, or CMP configuration changes reject behavior.

Limitations and cautions

This finding is an automated reject-enforcement review signal, not a legal conclusion, certification, compliance determination, or determination of consent validity.
A confirmed refusal-state transition establishes the observation anchor, but automated evidence may not determine vendor responsibility or every purpose and exemption.
Some post-reject activity may be strictly necessary, security-related, fraud-prevention, load-balancing, or otherwise context-dependent.
Consent state can vary by region, browser state, prior choices, A/B tests, CMP configuration, login state, and page path.
Automated evidence may miss server-side behavior, later user-triggered behavior, blocked resources, or vendor behavior outside the scan scope.
Manual review is needed to confirm reject success, purpose, necessity, consent-state propagation, vendor configuration, and remediation quality.
CertScore.ai redacts or avoids retaining full query strings, cookie values, identifiers, and sensitive payloads while preserving stable anchors needed for review.
Automated findings may contain errors and should be reviewed with the retained evidence.
Not detected means not observed in the scan scope; it is not proof of absence.
Findings are runtime evidence and public-surface observations for human and agentic review, not legal conclusions.

Reference notes

CertScore.ai uses findings, evidence, signals, and observations consistently: signals are raw runtime or page-surface events, evidence is retained support, observations are interpreted evidence context, and findings are promoted review items.
Findings are runtime evidence and public-surface observations for human and agentic review. Observed signals may surface possible concerns, but review is recommended before operational or legal reliance.
Finding reference content is reviewed periodically and updated when material guidance changes. CertScore.ai monitors guidance families such as EDPB consent and ePrivacy materials, ICO cookie guidance, CNIL tracker recommendations, FTC privacy and dark-pattern materials, and relevant accessibility guidance where applicable.
EDPB consent guidance is relevant to consent quality and affirmative indication where consent is relied upon.
EU ePrivacy cookie/tracker principles are relevant to storing information or gaining access to information on user terminal equipment.
ICO cookie and similar technologies guidance is relevant to active consent, clear explanation, and essential-cookie exceptions.
CNIL cookie/tracker and analytics guidance is relevant to tracker consent and limited analytics exemptions.
FTC dark-pattern and commercial-surveillance materials may be relevant to hidden tracking or unclear user-choice review, but this finding does not determine deception, unfairness, or legal status.
Prevalence labels use the Tranco top 1-2500 calibration set, an approximately 2,505-scan directional calibration set.

Non-essential tracking continued after reject