Open navigation menu
How to test tracking after Reject: an evidence walkthrough
Check what remains after a visitor clicks Reject. Inspect non-essential cookies and services, identify the configuration to review, and give your developer or agency a reproducible fix-and-retest task.
By CertScore.ai · Updated
Website privacy scanner. See the evidence.
Review cookies, trackers, consent behavior and privacy disclosures. Give your DPO, agency or developer retained evidence for GDPR/ePrivacy and CCPA review.
Read the request timeline
Illustrative sequence, not a scan result. Use retained event times and document identity to place each observation; no example timing below is a measured duration.
- Before the click: record baseline requests and writes. A request already in flight belongs to this period even if its response arrives later.
- At the Reject click: retain action completion. A banner disappearing does not independently confirm refusal.
- After the click, decision unverified: retain directly observed activity as after-click facts. Review retained non-essential cookies and classified service requests alongside the completed action.
- After confirmed refusal: compare newly initiated eligible requests or writes against the refusal anchor. An unchanged cookie alone is not evidence of active use.
- At the end of observation: state whether capture completed and list limitations. An interrupted test is not a clean pass.
1. Compare independent sessions
Keep the untouched baseline and Reject test separate. Record the URL, region and time. Do not accept first and reuse that state for the Reject test.
2. Check the completed action
Confirm which eligible control was clicked and whether the observation completed. A completed click and a registered refusal are separate facts; a disappearing banner does not prove refusal was recorded.
3. Inspect what remained
After a completed authorized Reject path, retained non-essential cookies and classified service requests can support GDPR/ePrivacy review even when registration is unverified. Inspect the action, cookie snapshot and request evidence together.
Separate requests started before the click from later activity. Cookie presence can support review without proving that the cookie was read or transmitted. California collection review uses its own request, purpose and choice-scope evidence.
4. Assign a fix and retest
Share the report, affected page, vendor, timing, expected behavior and coverage limits. Ask the owner to inspect CMP mappings, tag triggers, duplicate tags and embedded services. Preserve the original report and compare a fresh scan after the change.
Keep incomplete checks open
Unavailable controls, blocked pages and partial observations need follow-up. No eligible activity observed in a completed window describes that window; it does not establish that the website never tracks.
Related CertScore.ai pages
Website privacy scanner. See the evidence.
Review cookies, trackers, consent behavior and privacy disclosures. Give your DPO, agency or developer retained evidence for GDPR/ePrivacy and CCPA review.