Cookie banners: what reject all actually does

Reject all is supposed to mean one thing: nothing gets stored on or read from your device except what the site genuinely needs to work. On a compliant site that is exactly what happens, and the tracking cookies are never set. On a careless or deliberately sloppy site, several things go wrong. Some cookies were set before you were asked, some categories are mislabeled as necessary, and some data was never held in a cookie in the first place, so refusing cookies never touched it. The button is real and it is worth clicking. It is also narrower than most people assume, and it does nothing at all for the tracking that happens on servers.

Why the banner exists at all

The banner is not a GDPR invention, though the two are tangled together. European privacy rules for electronic communications, often nicknamed the cookie law, require consent before a site stores or reads information on your device unless that storage is strictly necessary to deliver the service you asked for. The UK keeps an equivalent rule. GDPR then supplied the definition of consent that makes the requirement bite: it has to be freely given, specific, informed, an active choice, and as easy to withdraw as it was to give.

The United States works the other way around. There is no general federal rule requiring permission before a cookie is set, and state privacy laws are built on opting out rather than opting in. That is why an American visitor typically sees a Your Privacy Choices link instead of a wall, and why the same site can behave very differently depending on where you appear to be. Both systems give you rights after the fact as well as before, and what you can ask a company to do with your data is often the more powerful lever.

The four categories, and what each one does

Almost every banner sorts cookies into the same four buckets, sometimes under different names.

Only the first row is exempt, and the exemption is narrow: necessary means necessary for you, not necessary for the business. A cookie that remembers your basket qualifies. A cookie that measures how many people saw a promotion does not, however much the site would like it to. The last row is where the money is, and what those cookies feed into is described in the mechanics of cross site tracking.

What reject all actually does

On a site that has done the work, clicking reject prevents every non essential script from loading, so no tracking cookie is created and no third party is contacted. Your choice is stored in a small cookie of its own, which is legitimate, and it should be remembered for months rather than asked again tomorrow.

The common failures are worth recognizing, because each one has a tell.

• Cookies set before you answer. Open the storage view in your browser tools before touching the banner and you can sometimes see them already sitting there.
• Categories misfiled. Analytics and even ad measurement described as strictly necessary, with no toggle offered.
• Your choice forgotten. If the same banner appears on every page or every visit, the site is either broken or hoping you give up.
• Things that are not cookies. Local storage, session storage and fingerprinting are all covered by the same consent requirement in the EU and UK, and are routinely left running anyway.
• Data already sent. Anything the site collected on its own servers, including your address and the pages you requested, is outside the banner completely.

It is also worth separating two ideas that look similar in the address bar. The padlock is about the connection, not the company, and what HTTPS actually proves stops at delivery. A site can be perfectly encrypted and still hand everything you do to thirty partners.

The dark patterns worth naming

Regulators in the EU and UK have said clearly that rejecting should be as easy as accepting. Plenty of banners still make it harder, and the techniques are repetitive enough to spot in a second.

Accept is a bright button and reject is grey text, or is not on the first screen at all and hides behind manage options. Accepting takes one click and refusing takes four. Pre ticked boxes appear in the detailed view, which is not valid consent in the EU. A cookie wall blocks the content entirely until you agree. The banner reappears on every page until fatigue wins. Some sites still claim that continuing to scroll counts as agreement, which it does not.

Consent strings, legitimate interest and pay or consent

Behind most European banners sits a shared framework. Your choices are encoded into a consent string, a compact record of which purposes you allowed and which vendors you allowed them for, and that string is passed to every partner in the chain. It is why a single banner can list hundreds of companies: they are all reading the same record. It also means your choice is only as good as each partner's willingness to honor it, which regulators have found is uneven.

Legitimate interest is the loophole to understand. Consent is one lawful basis for processing data, and legitimate interest is another, which does not require permission but does require the company to balance its interests against yours and to let you object. Some banners use it to keep processing after you refuse everything on the main tab. Regulators have pushed back hard on using it for targeted ads, and the direction of travel is against it, but you will still meet it today.

Pay or consent is the newer pattern: accept tracking or buy a subscription for the tracking free version. Whether that counts as freely given consent is genuinely contested in Europe and has not settled. If you take the paid option, note that it is a recurring charge like any other and easy to forget you are paying for.

Settings that outlast every banner

Banner by banner clicking is the least durable way to manage this. Four changes do more, and you make them once.

1. Turn on strict tracking protection in your browser, or switch to one where it is the default. Blocking third party cookies at the browser level means the ad cookies never get set whichever button you click.
2. Set your browser to clear cookies when it closes, with exceptions for the handful of sites you want to stay signed into. This caps how long any profile can build.
3. Turn on the Global Privacy Control signal if your browser offers it. It is an automatic opt out sent to every site, and in California and several other US states honoring it is legally required rather than optional.
4. Consider one extension that answers banners for you, and only one. It saves real time, though it needs permission to read every page you open, which is exactly the trade off explained in what a browser extension can see.

Two closing honesties. None of this affects server side collection by the site itself, and neither does routing your connection through a VPN, which changes your network address and nothing about consent. And this is general information about how the rules work rather than advice on a specific situation: if a company has ignored your choice and you want to act on it, the regulator in your country is the place that can actually do something about it.