COOKIE TROUBLESHOOTING · UPDATED 1 OCTOBER 2026
Cookies after Reject?
If a visitor rejects optional cookies, the website should respect that choice. The important question is what each cookie does—not whether the cookie list is completely empty.
What should stop?
Advertising tracking that needs consent should not start when someone rejects it. However, a site may still need a login cookie, shopping basket or a small record of the refusal. Those are different from tracking a visitor for advertising. An unfamiliar cookie name is a reason to investigate, not enough evidence to declare a breach.
Test a fresh visit first
Open a private browser window with extensions disabled and visit your homepage. Do not click the banner yet. Record which cookies and storage entries appear and when. Then choose Reject optional cookies and reload. Repeat on a page containing video, a booking tool or advertising integrations. A homepage-only test can miss tracking added by a specific template.
- Use a separate fresh session to test Accept, so old cookies cannot confuse the result.
- Record the page, time, choice and cookie name.
- Check whether the cookie was newly written, merely read, or left over from a previous consent.
Common causes on WordPress
A tracking plugin may load a pixel directly while the cookie plugin controls only tags in a tag manager. A theme can contain a second copy of the same analytics code. Caching can serve an old version of the banner. Embedded services may start as soon as their iframe loads. Fixing the banner design alone will not change any of those loading paths.
Give your developer a clear fix request
Ask them to identify every source of the affected script and make consent-required tracking wait for permission. The rejection state should survive a reload. Visitors also need a way to reopen their choice. After changing the configuration, clear relevant caches and retest both Reject and Accept; a fix that breaks checkout or prevents accepted analytics from working is incomplete.
Check your website
The free GDPRFix scan tests up to five public pages and records observed behaviour before a choice, after Reject and after reload. It highlights supported findings and marks uncertain activity for review. A blocked or incomplete test is not a pass.