Do websites keep tracking you after you click “Reject all”?

Cookie banners promise a choice. Click “Accept” and the ad industry gets to follow you; click “Reject” and it shouldn’t. We wanted to know how often that promise holds, so we checked. This is what the Browser Monster Index found on 138 popular UK websites, checked from London between 20 and 24 October 2026.

The numbers

Of the 138 sites, we could find and click a reject option on 94. The rest either had no banner, had no free way to say no on the first screen, or blocked our checker. On those 94, we refused, then watched every request the page made.

Which companies keep loading after you say no

These are the companies we saw most often on a page after we had clicked reject:

Google stands out because it is everywhere: we saw it on 83% of all sites in the Index, and on most of them before any choice was made. You can see every site where Alphabet’s services turned up, and when, in the “One collector’s reach” view.

The sites with the most tracking after “reject”

The most extreme case was cv-library.co.uk, a jobs board. After we clicked its “Essential Cookies Only” button, 16 tracking companies still made requests: 13 advertising companies, including ad exchanges such as Magnite, PubMatic and Index Exchange, plus three data brokers. Others near the top:

• trustedreviews.com: 11 companies after reject
• techradar.com: 7
• babycentre.co.uk: 6
• huffingtonpost.co.uk: 5
• rottentomatoes.com, toolstation.com and zoopla.co.uk: 4 each

By sector, news sites were the worst: 11 of the 12 news sites where we could click reject still loaded trackers afterwards. Sport, motoring and shopping sites followed. Money and supermarket sites were the best behaved; we saw nothing after reject on most of them.

Why does this happen?

There are a few common reasons, and only some of them are innocent:

• The banner and the tags aren’t wired together. A site installs a consent tool, but some ad or analytics tags are added elsewhere and ignore it.
• “Legitimate interest”. Many banners keep a second set of switches, already on, where companies claim they don’t need your consent. Clicking “reject” on the first screen doesn’t always turn those off.
• Loading before the choice. If a tracker loads as the page opens, it has already seen you, whatever you click next. That happened on 57% of sites.
• Necessary services. Fraud prevention, security, load balancing and performance monitoring can run without consent. Some of what we saw after reject will be this.

In our sample, the consent tool made a difference too. On sites using InMobi’s consent tool, we saw trackers after reject on all 10 we tested; on OneTrust sites it was 20 of 49. These are small numbers, so treat them as a pattern to watch rather than a verdict on any tool.

Is it legal?

In the UK, cookies and similar tracking are covered by PECR, the rules that sit alongside UK GDPR. Advertising and profiling need your consent. Since 5 February 2026, the Data (Use and Access) Act lets sites use some low-risk cookies, such as basic analytics, without asking, as long as they tell you and let you opt out. It also raised the maximum fine for breaking the cookie rules from £500,000 to £17.5 million or 4% of global turnover.

The Information Commissioner’s Office has been pushing on this. In November 2023 it wrote to many of the UK’s top 100 websites, saying people must be able to reject advertising cookies as easily as accept them. In January 2025 it said it would bring the UK’s top 1,000 websites into line, after raising concerns with 134 of the first 200 it reviewed.

What you can do

1. Check a site before you trust its banner. Look it up on Check a site to see what loads before and after “reject”.
2. Look past the first screen. If there’s a “legitimate interest” or “partners” tab, switch those off too.
3. Block third-party cookies in Chrome. Settings → Privacy and security → Third-party cookies. It won’t stop every tracker, but it limits cross-site cookies.
4. Watch it on your own browsing. The Browser Monster extension flags any tracker that loads after you said no, on every site you visit, and can reject banners for you.
5. Complain if it matters to you. You can report a website’s cookie practices to the ICO at ico.org.uk.

About this data

The Browser Monster Index opens each homepage three times in a fresh Chrome browser from London: once doing nothing, once clicking reject and once clicking accept. The full dataset is free to reuse under CC BY-NC 4.0. Download it or use the API from the licence and API page. If you quote these figures, please credit “Browser Monster Index” and link to this page.