Reject is respected

If marketing or analytics still fire after "Reject", that is the single most common GDPR finding at supervisory authorities.

What we check

Checks whether marketing/analytics requests or non-essential cookies still appear after "Reject".

Why it matters

If marketing or analytics still fire after "Reject", that is the single most common GDPR finding at supervisory authorities.

Common causes

The tags were never tied to the consent status in the tag manager, the banner is effectively decoration.
A pixel added after the CMP setup was never categorised and runs straight past the tag-blocking.
Hardcoded tracking snippets in the theme or template fire outside the tag manager.
The CMP stores the rejection correctly, but scripts already loaded simply keep running for the session.

The fix

Enforce CMP tag-blocking: load tags only after opt-in, the reject state must produce no marketing requests or cookies.

Matching template

CMP and GTM Consent QA Template

The repeatable test plan for default-denied, consent update and reject, across all four signals.

Get the QA template →

Check it yourself first

The Tracking Check tests this point along with all the others, in seconds.

Start the Tracking Check →

Asked often

What does a failing "Reject is respected" check mean?

If marketing or analytics still fire after "Reject", that is the single most common GDPR finding at supervisory authorities. Enforce CMP tag-blocking: load tags only after opt-in, the reject state must produce no marketing requests or cookies.

How do you fix a failing "Reject is respected" check?

Enforce CMP tag-blocking: load tags only after opt-in, the reject state must produce no marketing requests or cookies.

The fix, delivered

Wired up in days, not sprints.

Findings from the Tracking Check go into a ranked sequence with effort estimates in the Audit Sprint, every module with an acceptance criterion.

To the service Request an Audit Sprint