Rejecting cookies on 292 Spanish online stores: what happens next, measured and hand-validated

Between 13% and 32% of the Spanish online stores I could test keep sending data to trackers after the visitor clicks “Reject”. That is an estimate over 150 stores, hand-validated on 81, with a wide interval I explain below. My first figure was 34%, and you shouldn’t trust it: less than half of what the robot flagged held up when I checked it by hand.

What I found

• After rejecting: the estimate is 22.3% on strict evidence (interval 12.8–31.8) and 32.0% if I also count ambiguous cases (22.6–41.4).
• Before choosing: 45.7% of stores with a banner already have tracking cookies before the visitor has decided anything. That is more common than what happens after rejecting.
• The banner itself: almost one in four (23.5%) of the stores with a custom banner don’t offer “Reject” at the first level.
• An extreme case: on one site in the sample, the “Reject” button grants consent.

How I measured it

• Sample: 300 .es stores (Shopify, WooCommerce, PrestaShop and Magento) drawn at random from a public domain list, after excluding the ones I used to test the method. 292 were fully scanned.
• Robot: an identified automated browser that respects robots.txt, visits only the home page, once per site and at a low rate. This page explains who it is and how to ask it not to visit a website.
• Two independent detectors of “keeps sending data after rejecting”: one with its own signals (consent, cookies, Google requests) and one based on a public tracker list.
• I fixed the main measure before drawing the final sample, so I couldn’t choose it by looking at the results.
• Blind validation: I hand-checked 81 sites, the 51 flagged by either detector and 30 of the unflagged ones, picked at random. Without knowing which group each came from, in a regular browser: I wait 6 seconds, click “Reject” and observe for 9 more.

The main result

The interval is wide on purpose. With 81 validated sites you can’t say anything finer, and I prefer an honest range to a figure that looks more certain than it is.

Why you shouldn’t keep the 34%

The automatic method flagged 51 of 150 sites. Checked by hand:

• Only 38.8% of the flagged sites are confirmed on strict evidence (19 of 49). Counting ambiguous ones it rises to 67.3%.
• 13.8% of the unflagged sites did send (4 of 29). The method misses real cases.

An “ambiguous” site is one with Google’s consent explicitly denied where the only thing going out after the click is a ping from Clarity or Bing without cookies, or from Klaviyo. Those services have a “no consent” mode that can’t be told apart from sending data from the outside.

That is why the figure I quote is the validated estimate, not the automatic flag.

What happens before choosing

The most repeated pattern happens before anyone has chosen anything, not after clicking “Reject”.

What kept being sent after rejecting (exploratory reading)

I defined this table after seeing the data; it is not part of the fixed measure. I include it because it changes how the figure should be read. It classifies the 49 sites flagged by the tracker-list detector by what they were sending:

Social and marketing pixels (TikTok, Meta, HubSpot) are the ones confirmed most often: Google’s Consent Mode doesn’t govern them, so they depend on someone tying them to the banner by hand. Flags from Klaviyo alone were never confirmed, and with Clarity most end up ambiguous.

A “Reject” button that grants consent

On one site, the “Reject” button fired the same event as “Accept”: consent switched to granted and analytics and session-recording cookies appeared that weren’t there before. I checked it twice, the second time with clean storage. I won’t say which one: it is a configuration mistake and not the point of the study, and I don’t name any site.

Limits

• It is not a legal audit. It measures observable technical behaviour, not compliance.
• It doesn’t represent all Spanish stores. These are .es sites ranked in a public list with a platform detectable on the home page.
• One visit per site with an automated browser, and a 9-second window after the click. Behaviour can vary with location, history and timing.
• The reject test was completed on 54.1% of the sites with tracking (140 of 259). The main figure refers to those 150 and is not extrapolated to the rest.
• One reviewer and 81 sites. Hence the wide intervals.
• Some trackers aren’t visible, such as those that use websockets (Hotjar, for example), and some ambiguous cases can’t be resolved from the outside.
• The breakdown by tracker type is exploratory: I defined it after seeing the data.

If you run a store: five checks

1. Reject in incognito and watch Network for 30 seconds. It’s the test I describe in Consent Mode v2: Basic vs Advanced.
2. Don’t rely on Google’s Consent Mode alone. TikTok, Meta, HubSpot, Clarity, Hotjar and others have their own mechanism: each has to be tied to the banner one by one.
3. Look at what exists before choosing. With the banner on screen and nothing clicked, open Application, Cookies. If analytics or advertising is already there, that’s the gap.
4. “Reject” should be at the first level and do what it says. Click it and check which event fires, not just what you see.
5. Declare the consent default. Without a declared default, Google’s tags behave as if consent were granted until someone changes it, and if “Reject” doesn’t send an explicit update, nothing changes.

Data, ethics and credits

The robot identifies itself, respects robots.txt and has a public page explaining how to ask it not to visit your website. Only technical results are stored, no personal data, and they are published in aggregate, without naming companies or sites. Per-site results are private. The tracker list is the public Disconnect list, used only for this study and not redistributed.

If you want me to check what happens on your store when someone clicks “Reject”, here’s how I work.