How to test tracking after Reject: an evidence walkthrough

Record the exact URL, region, scan time, and the consent configuration under review. Begin the baseline without a stored choice. Start the Reject test in a separate fresh session; do not first accept and then reuse that state.

CertScore performs eligible Accept and Reject observations independently. Its bounded automated test uses an eligible first-layer control. Deeper preference-center paths, unavailable controls, blocked pages, and changed targets can leave coverage limited.

Read the control observation, click outcome, and semantic registration separately. A visible Reject label proves visibility only. A completed click proves activation only. A hidden banner or changed cookie does not by itself confirm refusal.

Confirmed refusal requires evidence of a denied decision. If registration is unverified, preserve that status in the review. Do not rewrite it as successful refusal because the interface disappeared.

Inspect the retained request timing and ancestry. A request or redirect chain that began before the click is not proof that new tracking started afterward. Review the vendor classification and distinguish analytics, advertising, or session replay from essential or CMP traffic.

When refusal is unverified, a completed authorized Reject click can still support a review finding only if the report has verified qualifying tracking that started after the click and complete bounded capture. The registration status remains unverified. Missing timing, dropped activity, or incomplete capture cannot establish that result.

An unchanged cookie can remain after Reject without being read or transmitted. Compare exact cookie name, domain, path and partition, or storage origin, type and key, within the same action session. A different value is not unchanged persistence.

Storage presence alone is a factual review aid, not proof of active tracking. Give greater attention to directly observed eligible requests or writes and retained contradictions. Do not publish raw storage values in a ticket or report excerpt.

Control unavailable or capture incomplete: record limited coverage and investigate manually if needed. No eligible activity observed in a completed window: state that bounded observation; do not claim the website never tracks.

Completed Reject click with unverified refusal: keep the decision unverified and inspect any separately supported tracking review finding. Confirmed refusal with qualifying later activity: review the finding and its retained evidence with the responsible implementation team.

Record the exact URL, date, region, report reference, baseline coverage, control clicked, action time, refusal status, request-chain start, classified vendor, evidence references, and capture limitations. Add the implementation owner and the expected tag behavior.

After a configuration change, retest under matching conditions in a fresh session and compare the affected evidence. Check important regions and page templates separately. Avoid combining unrelated sessions into a single before-and-after proof.

This walkthrough documents CertScore’s existing evidence distinctions: control visibility, completed action, semantic registration, bounded capture, request ancestry, and exact storage identity. It introduces no new scan results or population-wide statistics.

Use the sample report for the report format and the downloadable audit worksheet for a review record. Findings remain automated risk signals for review, not legal determinations.

Primary sources:Download the blank audit worksheetCertScore methodologyAccept and Reject observation scope