Consent Theater: What "Reject All" Actually Stops

We loaded 47 of the most-visited news and media websites three times each — once without touching anything, once clicking Reject All, once clicking Accept All — and measured exactly what each site did in every case. The short version is more interesting than "the cookie banner is a lie."

Rejecting does work, in one narrow sense: across the websites where a real refusal was possible, choosing reject left us with roughly a tenth of the tracking that accepting did. The button is connected to something. But three findings sit underneath that, and they are the story.

Key Takeaways

• The question is geo-gated, not the tracking: 78% of EU-based sites asked permission. 14% of US and global ones did. The sites that skip the question track more, not less.
• Reject doesn't mean off: 12 of 13 sites kept contacting tracking companies after a genuine Reject All. One reached zero.
• Reject is roughly equivalent to doing nothing, or worse: Compared with never touching the banner: lower on 1 site, identical on 7, higher on 5.
• Reject still beats accept: Median tracking after rejecting was 9.9% of what accepting produced. The button is wired to something real.
• The paths are asymmetric by design: Accept took one click on 13 of 13 sites. Reject took a median of two, and was absent from the first screen on 6 of 20 sites.
• Refusal is becoming a paid product: 8 websites ran consent-or-pay. On two of them, the only refusal offered leads to a payment page.

Finding 1: Most Sites Never Ask, and Those Track Hardest

Of 36 analyzable sites, only 20 presented any consent notice at all. Among EU-based publishers, 18 of 22 asked. Among US and global sites, 2 of 14 did. It would be reasonable to conclude that sites which don't ask are the ones with nothing to ask about. The data says the opposite.

The 16 sites that presented no notice contacted a median of 98 tracking companies and set a median of 306 cookies on a plain, untouched page load.

independent.co.uk, mirror.co.uk, and standard.co.uk are British publishers. Visited from a US address, they asked nothing and went straight to work: 139, 114, and 105 tracking companies, respectively.

The consent interface isn't a property of the publisher. It's a property of where the publisher thinks you're sitting.

Finding 2: Rejecting Doesn't Mean Stopping

Across the 13 sites where a genuine Reject All was possible, 12 continued contacting tracking companies after we refused. One site, heise.de, went to zero. The Guardian's 74, 72, and 79 are three measurements of the same thing rather than a reduction. Here are the 13 sites where a genuine Reject All was possible.

Read the middle two columns against each other, and the finding is unavoidable. Compared with never touching the banner, clicking Reject All produced fewer tracking companies on 1 site, the same on 7, and more on 5.

Read the last two columns instead, and a different truth appears. Against accepting, rejecting is dramatically better on all 13, at a median of 9.9% of the tracking that acceptance unleashes. bild.de goes from 75 companies to 1; heise.de from 61 to 0; lefigaro.fr from 91 to 9.

Both things are true at once. The reject button is real, but it's a brake on what acceptance would have added rather than a switch that turns tracking off. For a visitor who was never going to press accept, it changes almost nothing.

Finding 3: On Five Sites, Refusing Produced More Tracking

zeit.de

Untouched, the page contacted 2 tracking companies and set 20 cookies. 

After a two-click Reject All through Sourcepoint's interface — the German label reads "Zustimmung widerrufen", and the control carries Sourcepoint's own sp_choice_type_REJECT_ALL attribute, so there’s no ambiguity about what we clicked — the page had contacted 9 tracking companies and set 28 cookies. 

Seven appeared only after the refusal: Adnami, DT, ID5, Microsoft, Relevent, SiriusXM, and ZetaGlobal. Accepting produced 41.

focus.de

Untouched: 1 tracking company and 6 cookies. 

After a two-click Reject All: 7 companies and 15 cookies, the new arrivals being Confiant, Criteo, OpenX, PubMatic, Publicis Groupe, and RTBHouse. Accepting produced 51.

These are real-time bidding exchanges and ad-verification vendors. They’re not the infrastructure of the consent tool itself, which is the obvious alternative explanation and one we checked for. The other three sites in this group — lefigaro.fr (7→9), lemonde.fr (3→4) and marca.com (11→12) — moved by margins we would not defend as meaningful on their own.

We are careful about the mechanism. Because a two-click rejection requires opening a settings panel, the post-click measurement window covers that interaction as well as the refusal itself. What we can state with confidence is the observable outcome: on these sites, a visitor who goes through the act of refusing ends up with more tracking companies contacted than a visitor who ignores the banner completely.

Finding 4: Geography Decides Which Question You're Asked

theguardian.com is the clearest single illustration in the study, and it's not a story about a company behaving badly. It is a story about what geography does to a right.

Visited from a US address, the Guardian doesn’t present a GDPR consent banner. It presents a California-style notice whose only control reads "Do not sell or share my personal information." There’s no "accept all," and there’s no "reject all." There’s one lever, and it governs sale and sharing — not collection.

Using the only privacy control on offer left the visitor with 91.1% of the tracking companies that dismissing it did. In the window after the click, 46 tracking companies were still active — among them Google, Criteo, Magnite, PubMatic, The Trade Desk, LiveRamp, TransUnion, Adobe, Amazon and Quantcast.

Given the run-to-run variance we measured, 74 versus 72 versus 79 isn’t a reduction. It’s three measurements of the same thing. The control isn’t broken; it’s answering a much narrower question than the visitor thinks they are being asked. A European reader of the same publication is offered a different question entirely.

Finding 5: Accepting Is Always One Click. Refusing Usually Isn't

Looking more broadly at all 20 websites that showed a notice, 17 offered an accept control on the first screen. Only 12 offered a reject control there. Six sites presented an agreement button with no refusal beside it, requiring the visitor to go looking.

Then there's the newest pattern, which appeared on 8 sites: consent-or-pay.

bild.de's first screen offers "Alle akzeptieren," "Einstellungen," and a €3.99 per month subscription. Refusal exists, two clicks deep.

On corriere.it and elmundo.es, it doesn't exist at all in free form. The only refusal offered is "Rifiuta e abbonati," reject and subscribe, which navigates to a payment page. For a visitor unwilling to pay, these sites offer consent or departure.

Two more sites, vg.no and aftonbladet.se, route refusal through an off-site Schibsted account portal, which means refusing requires leaving the site and, in practice, having an account.

What This Means for You

If you click "Reject All" and assume you have switched tracking off, you have not. On 12 of the 13 websites where we could refuse properly, companies kept being contacted afterwards. On 5 of them, more were contacted than if you had simply scrolled past the banner.

That’s not a reason to start clicking "Accept." Acceptance was worse on all 13 sites, by roughly a factor of ten. The reject button is worth pressing. It’s just not worth trusting.

The deeper point is that the banner is a negotiation about a decision that has largely already been made by the time you see it. Most of the sites in this study never opened the negotiation at all — and those were the ones running 98 tracking companies before the page finished loading.

Summary

If you click Reject All and assume you've switched tracking off, you haven't. On 12 of the 13 sites where we could refuse properly, companies kept being contacted afterward. On 5 of them, more were contacted than if you had simply scrolled past the banner.

That isn't a reason to start clicking Accept. Acceptance was worse on all 13 sites, by roughly a factor of ten. The reject button is worth pressing. It just isn't worth trusting.

The deeper point is that the banner is a negotiation about a decision that has largely already been made by the time you see it. Most of the sites in this study never opened the negotiation at all, and those were the ones running 98 tracking companies before the page finished loading.

Methodology

We built a Chromium-based crawler driven through the Chrome DevTools Protocol, so every network request, its transfer size, and every cookie could be recorded exactly rather than inferred. 

Tracking companies were attributed using a 4,951-domain, 1,928-entity database compiled from Disconnect's tracking-protection list and DuckDuckGo's Tracker Radar, matched on registrable domain. 

Only tracking categories were counted; CDN and embedded-content matches were recorded separately, so a site is never accused of tracking for loading a font.

Three passes, each in a fresh browser:

• Baseline: Load, wait 12 seconds, measure. No interaction whatsoever.
• Reject: Load, wait 12 seconds, locate and click the refusal control, wait 10 more seconds, measure again.
• Accept: Load, wait 12 seconds, locate and click the agreement control, wait 10 more seconds, measure again.

The three passes are time-matched: each measures the same total dwell, so the baseline is directly comparable and no pass gets extra seconds in which to load more advertising. This is the single most important design decision in the study — without it, "more tracking after rejecting" would be an artefact of the reject pass simply running longer.

Finding the refusal control is the hard part of this work. The crawler first tries vendor-specific selectors for the major consent platforms — OneTrust, Cookiebot, Sourcepoint, Quantcast, Didomi, Usercentrics, CookieYes, Complianz, Osano, Klaro, Google Funding Choices — then scans every visible button, link, and role="button" for refusal wording in nine languages. 

It searches inside iframes, because most consent platforms render there. When no refusal exists on the first screen, it opens the settings layer and looks again, recording how many clicks the journey took.

Cohort, Vantage and Classification

47 sites: 32 EU-based publishers and 15 US/global sites, crawled from a single US vantage point — a Google Cloud egress in Columbus, Ohio. This is a data center IP, not a residential one, which raises bot-blocking relative to a real user. EU publishers are bound by their own jurisdiction and generally serve a consent interface to everyone, which is what makes a US-based measurement of European consent behaviour possible at all.

A site is blocked only if the crawler never obtained the page. Anti-bot markup on a page that loaded normally is not "blocked" — forbes.com carries DataDome markup but served 168 requests and a real page, so it stays in the analysis. Seven sites were blocked; four failed for unrelated reasons. 36 sites were analysable.

We excluded from the rejection analysis, and report separately: saving a panel of pre-ticked defaults (nbcnews.com), controls that send the visitor to an off-site account portal (vg.no, aftonbladet.se), and "refusals" that lead to a payment page (corriere.it, elmundo.es). That leaves 13 sites where a real Reject All was clicked and measured.

Variance was measured, not assumed. On consent-gated sites it's negligible — four sites repeated three times each varied by 0 to 1 tracking company. On ungated, ad-heavy sites it's large: cnet.com ranged from 81 to 102 across five loads. We therefore treat differences under roughly 20 companies on ungated sites as noise.