Reject all cookies: tracking that carries on anyway

The rule

This check looks at whether a page keeps the promise its banner makes when the visitor says no. The legal base is the one in EU-01: Article 5(3) of the ePrivacy Directive allows storing or reading information on a visitor’s device only with consent, and that consent is the GDPR’s. This check covers the other half, the right to refuse and to take consent back.

The EDPB’s wording is about withdrawal. The CNIL applies the same logic to a refusal at the first visit.

For the ePrivacy side, each Member State sets its own penalties. In France the CNIL applies Article 82 of the Informatique et Libertés law, which is the basis it named in the SHEIN, American Express and Condé Nast decisions. In Spain the AEPD applies Article 22.2 of the LSSI and, in PS/00051/2023, noted that a “light” infringement of it can carry a fine of up to EUR 30,000.

The decisions below show three patterns: refusal ignored from the first click (SHEIN, American Express), withdrawal that does not stop what was already running (SEAT, American Express, Condé Nast), and, in the AEPD’s Grupo Massimo Dutti decision, a settings link that existed but did not take back what an earlier accept had allowed.

What PeekWell checks and how

EU-02 asks one question: after the visitor clicked Reject all, did anything non-essential still run? The scan answers it by comparing two visits.

In the first visit the scan opens a public page in a fresh browser context and clicks the Reject all button. It finds the button using common consent-tool selectors and label heuristics, then records every network request and cookie that follows. In the second visit, with a clean context again, it clicks Accept all and records the same things. The two sets are compared. A tracker from the maintained signature list that appears in the reject visit becomes a finding, and the exact requests are logged as the evidence.

Code makes the decision from that evidence. A language model may help read an unusual button label or write the explanation, but it never decides that a tracker fired.

The capture is the same as in EU-01, but the question differs. EU-01 asks what loaded before anyone touched the banner. EU-02 asks what loaded after the visitor said no.

The scan has limits, and the report says so. It sees the public pages it visited and nothing behind a sign-in. It does not submit forms, test passwords or open addresses nobody linked to. The button is found with common consent-tool selectors and label heuristics, so an unusual banner may not be recognised. It does not run the sequence in several of the Spanish decisions, where a visitor accepts first and then withdraws through the settings panel, so a site that stops tracking on a first refusal but not after a later withdrawal is outside what a scan can say. Collection that happens on a server or inside an app is also outside a browser visit. A Passed means the expected behaviour was observed on the pages scanned. It does not say the site complies.

Why it matters for a company

The CNIL and the AEPD both record their findings from their own visits to the sites. The SHEIN decision, from the CNIL on 1 September 2025, records that new cookies were still placed after Refuse all and that others already present continued to be read. The fine was EUR 150 million.

The CNIL’s later decisions follow the same line. On 20 November 2025 it fined the publisher of vanityfair.fr EUR 750,000 after finding that new cookies were still placed, and existing ones read, once a visitor had refused or withdrawn. A week later it fined American Express Carte France EUR 1.5 million for advertising trackers placed despite a refusal and for trackers still read after a withdrawal. The company had corrected its setup during the procedure, which the CNIL noted.

Spain shows the same pattern with smaller amounts. In the SEAT procedure the AEPD recorded that after the visitor chose to reject through the settings panel, the Google cookies set at the earlier acceptance were still present and were still being sent in later requests. SEAT paid EUR 12,000 and the procedure ended. In the Massimo Dutti decision the AEPD found that after a visitor had accepted, clicking Reject all, or switching each group to off, left the third-party cookies in use, and fined EUR 5,000.

For a company the consequences are practical. The facts are visible from outside. And the evidence is the requests themselves, which the authorities captured in their own browsers.

Smaller companies and larger companies

The rule has no size threshold, and none of the decisions above turns on the size of the company.

In a small company the banner usually comes from a plugin or a hosted site builder. Someone sets the plugin up, sees the banner appear and moves on. The plugin hides the choice but does not control the tags, because the analytics script was pasted into the theme years ago and the chat widget loads from the page footer. Nobody tests the Reject button. A Spanish limited company, Local Verticals, S.L., ended its procedure PS/00040/2024 by paying EUR 6,000 after the AEPD recorded that clicking Rechazar todo left YouTube and DoubleClick cookies in use. The AEPD’s decision does not say how big the company is, so it is not listed as a smaller-company case here.

In a larger company the problem is spread out. A tag manager holds many tags owned by different teams, the consent tool is configured once and then changed by a release, and a consent state saved on one domain may not reach another. Withdrawal is the harder half, because cookies set at the earlier acceptance have to be cleared and the vendors told. The SEAT and American Express decisions are both about that second half.

How to fix it

1. Reproduce it. Open your site in a private window with the network tab open. Click Reject all and reload a couple of pages. Write down every third-party request and cookie that appears after the click.
2. Find what is outside the banner tool. A script in the theme, a plugin that adds its own tracking, an embedded video or a chat widget will each ignore the banner. Move them behind the consent tool’s categories or remove them.
3. Fire tags only from the accept event. In the tag manager, trigger each non-essential tag on the consent tool’s accept event, and make sure a reject leaves them without a trigger. Check that a saved Reject is still honoured on the next page.
4. Make withdrawal work. Add a permanent Cookie settings link or icon in the footer. When a visitor switches categories off, stop the tags, delete the cookies you set, and where a vendor offers it, tell the vendor.
5. Re-scan. Clear cookies and storage, click Reject all, and run a scan again. Then accept, withdraw through the settings link, and check by hand that the requests stop, since a scan does not cover that sequence.

Consent mode and similar settings change what a vendor’s tag does, not whether the tag runs. Whether a given setup satisfies an authority is a question for your legal adviser, and Peeky reports only what it sees.