What happens when you reject all cookies on a website

When you reject all cookies on a website, the site should still work: you can read pages, sign in and use your basket, because strictly necessary cookies are still allowed. What stops are the optional ones. Analytics tools no longer track your visit, advertising cookies are not set, so you are not added to retargeting lists, and preferences such as your language may not be remembered next time. You can still see ads, but they are not tailored to your browsing. The "Reject all" button tells the site to set only the cookies it needs to work, and the site stores that choice so it does not ask again on every page.

What you notice as a visitor

From the visitor's side, surprisingly little changes. Pages load, links work and checkouts still go through.

Some conveniences go. Language preferences can revert to the site default on your next visit. Theme or layout choices are forgotten. "Recently viewed" product carousels may stay empty, and personalisation that relied on remembering past behaviour stops.

Embedded content can change too. YouTube videos, maps, social media widgets and live chat tools often set their own cookies, so a well-configured site replaces them with a placeholder that explains the content needs consent and lets you load it with a click. Kukie.io's iframe placeholder works this way.

A site should not lock you out for refusing. The EDPB's Guidelines 05/2020 on consent say that consent is not freely given when access to content depends on accepting cookies, so most EU regulators treat cookie walls as unlawful. Models that offer a paid alternative to accepting are judged case by case.

Which cookies stay and which are blocked

Not every cookie disappears when you reject consent. Under Article 5(3) of the ePrivacy Directive, strictly necessary cookies for a service you explicitly requested are exempt from consent. A session cookie that keeps a shopping basket alive, an authentication token that keeps you signed in, or a load-balancer cookie that routes traffic to the right server keep working.

Everything else stops. Analytics cookies like _ga from Google Analytics, marketing cookies such as _fbp from the Meta Pixel and _gcl_au from Google Ads, and functional cookies storing language or currency preferences must all be withheld in the EU when a visitor says no.

The UK differs slightly since 5 February 2026. Under Schedule A1 to PECR, preference and first-party statistics storage can be set without consent if visitors are told and can object. A click on "Reject all" is an objection, so the practical result is the same: those cookies should not be set.

What site owners lose in analytics

For site owners, the most immediate effect is missing data. When a visitor rejects analytics cookies, tools like Google Analytics 4 cannot link page views to a persistent identifier. Ten page views can look like ten separate anonymous events instead of one person browsing five pages twice.

How much data goes missing depends on how many visitors refuse, which varies by audience, country and banner. The gap distorts bounce rates, session durations, conversion funnels and audience figures, so decisions based on the remaining data describe the visitors who accepted, not everyone.

Google Consent Mode as a partial fix

Google Consent Mode v2 narrows the gap for sites that use it. In its advanced setup, Google tags still load when a visitor rejects cookies, but they do not write cookies. Instead they send cookieless pings without a cookie identifier.

GA4 can then use behavioural modelling to estimate what non-consenting visitors did, from the patterns of visitors who consented. Google's documentation on behavioural modelling sets thresholds: at least 1,000 events per day with analytics_storage denied for at least 7 days, and at least 1,000 daily users with it granted on at least 7 of the previous 28 days. Modelled figures appear only in the Blended reporting identity, and smaller sites may never qualify.

In the basic setup, Google tags do not load until consent is given, so there is no data and no modelling for visitors who reject.

What site owners lose in advertising

Rejected cookies shrink remarketing lists. Without a _fbp cookie, the Meta Pixel cannot add that visitor to a retargeting audience. Without _gcl_au, Google Ads loses conversion attribution for that session. A visitor who browsed five product pages and left will not see a follow-up ad based on that visit.

Reported conversions fall, so return on ad spend looks lower than it is. For publishers running programmatic ads, rejected consent usually means contextual, non-personalised placements, which tend to earn less.

What the law expects when visitors say no

A rejection has to be honoured. Under the ePrivacy Directive and the GDPR's consent conditions (Article 7), no non-essential cookies may be set once a visitor withholds consent. The site must not make its service worse as a punishment for refusing, because that would undermine the "freely given" requirement of valid consent.

Regulators enforce this. On 1 September 2025 the CNIL fined SHEIN EUR 150 million. According to the CNIL's decision summary, when visitors clicked "Refuse all", new cookies were still placed and cookies already present were still read, and advertising cookies were placed before any choice. The fine was imposed even though SHEIN had changed its site during the proceedings.

Outside the EU, the rules differ but point the same way. Under the CCPA and CPRA, California does not require opt-in consent for most cookies, but it requires a "Do Not Sell or Share My Personal Information" link and honouring Global Privacy Control signals. Brazil's LGPD relies on consent for most tracking, and South Africa's POPIA requires a justification for collecting personal information.

What your site should do technically

Handling rejection properly is as much engineering as law. The core requirement: no non-essential script runs until consent is explicitly granted.

Tag managers like Google Tag Manager support consent checks that look at the visitor's consent state before a tag fires. A consent management platform blocks scripts until consent, stores the visitor's choice so the banner does not reappear on every page, and can record the rejection in a consent log with a timestamp.

For features that break without cookies, build fallbacks. Read the browser's Accept-Language header instead of a language cookie. Keep carousels in session memory only. The goal is a site that works for everyone, not only for visitors who accepted.

Server-side alternatives

Server-side tagging moves data collection from the browser to your own server. It gives you more control over what is collected, but it does not remove the consent requirement: if a visitor rejects tracking, the server must honour that. Privacy-focused analytics tools like Plausible and Fathom avoid cookies by collecting aggregate figures, at the cost of less detail.

Designing a banner that respects the choice

The banner itself matters. A dark pattern that hides the reject option behind extra clicks, or puts a bright Accept button next to a faint grey Reject link, steers visitors and draws regulators' attention. On 1 September 2025 the CNIL also fined Google EUR 325 million, partly because people creating a Google account were encouraged to choose cookies for personalised ads over generic ones, according to the CNIL's announcement of the two fines.

A banner that follows regulators' guidance places "Accept all" and "Reject all" on the same layer with equal visual weight. Category-level choices give visitors finer control, and a link or button that stays on the page lets them change their choice at any time.

Questions about rejecting all cookies

Let visitors say no and keep your site working

A refusal should leave a working site behind it. Kukie.io blocks known trackers until visitors choose, keeps refused categories blocked, shows placeholders for embeds and records each choice in the Consent Log.

Start free