Articles
Cookie and pixel audit articles
Comparisons of runtime audits, consent banners, Consent Mode, and GPC for Shopify and DTC teams. Each article says what one visit records and cannot prove.
These articles compare methods and product scope. The product page is a browser check before Accept. Open the audit checklists
9 min read
Cookie audit hub: which consent test should you run first?
Cookie audit hub for the first consent test: before Accept, Reject versus Accept, EU three-way, or GPC. A free US scan is not an EU or California result.
8 min read
How to run a cookie audit before Accept
A cookie audit before Accept records cookies, storage, and network requests on a clean first load, then compares isolated reject, accept, and GPC sessions.
7 min read
Pre-consent audit checklist: what to verify before Accept
Check what the browser does before Accept: a clean load, storage, Reject All plus one navigation, an accept baseline, and a labeled evidence pack. Technical record only, not a legal verdict.
8 min read
Reject All Still Tracking: What to Check After You Say No
Prove whether Reject All actually blocks non-essential cookies and pixels: clean profiles, fresh versus reject versus accept, and scenario-labeled evidence for Shopify and DTC storefronts.
8 min read
Do essential / strictly necessary cookies need consent?
Essential or strictly necessary is a label. Check Fresh and Reject runtime against that badge. This page is testing guidance, not legal advice.
8 min read
CMP claims vs runtime evidence: how do you prove the banner actually works?
Compare a CMP honor, reject, or GPC claim with cookies and requests from isolated storefront visits. Banner copy needs a labeled browser evidence pack.
7 min read
Does Searchspring tracking stop after Reject All on Shopify?
On a Shopify store with OneTrust, Searchspring's pixel sent a product view after Reject All and wrote its visitor ID cookie. Shopify's docs explain why.
16 min read
How do you test a Shopify cookie banner's Reject All button?
Test Shopify Reject All in a clean profile: compare fresh, reject, and accept cookies and pixels. The Privacy API records consent and does not block scripts.
6 min read
Does impact.com tracking stop after Reject All on Shopify?
On a Shopify store with OneTrust, impact.com kept sending PageLoad after Reject All, keyed to Shopify's client ID. Impact's docs say why. Check yours.
9 min read
TCF v2.4 TC String Decoder and CMP Checker
Free TCF v2.4 CMP checker. Decode a TC String in your browser, read its policy and vendor list versions, and check it before October 23. Not legal advice.
7 min read
Does Rebuy stop sending events after Reject All on Shopify?
Store J ran Shopify with a OneTrust banner. After Reject All, Rebuy kept posting analytics events with the same visitor ID, and TikTok kept sending too.
9 min read
Hightouch Events after Reject All: what a Shopify store still sent
On Store I with OneTrust, Hightouch still sent page and consent_updated after Reject All, with the same visitor ID. view_item stopped. Not legal advice.
11 min read
Yotpo reviews disappear after Reject All on Shopify
On Store I, Reject All stopped Yotpo review and star requests. The points widget still loaded. Earlier yotpo_pixel and _sp cookies stayed. Not legal advice.
9 min read
Free cookie scanners compared: after Reject All, who still sees the request?
Four free cookie scanners on one Shopify store: Cookiebot, CookieYes, CookieScript, Termly. None showed which hosts still sent requests after Reject All.
11 min read
Does Meta CAPI still fire after Reject All?
Reject All left a store's Meta Pixel quiet. _fbp stayed and was still sent to a first-party server endpoint. The browser cannot see CAPI. Not legal advice.
8 min read
Consent Mode cookieless ping vs real tracking after Reject All
After Reject All, a Google collect row can be a cookieless Consent Mode ping or a cookie-bearing hit. Label the row before escalating. Not legal advice.
7 min read
Does a cookie audit catch tracking pixels?
A cookie audit catches tracking pixels when it records Network and storage, not cookie names alone. Run it fresh and after Reject All. Not legal advice.
9 min read
After Decline on Shopify's own banner, six third parties still got requests
One Shopify store with Shopify's cookie banner. After Decline, consent read no. GA4, Clarity, LiveIntent and three more still got requests. Not legal advice.
12 min read
Does Attentive keep running on Shopify after Reject All?
On a Shopify store with OneTrust, Attentive kept loading after Reject All and sent the same visitor ID on the next two pages. Not legal advice.
10 min read
Does the Judge.me Shopify app send behavioral data after Decline?
On bouncecurl.com, tested 2026-10-09, store configuration at the time, Judge.me sent no track_bulk_events before or after Decline. Not legal advice.
8 min read
Does Attentive tracking fire before Accept?
Check Attentive browser SDK and on-site identity before Accept. A gated SDK does not prove SMS APIs stayed off. Not an Attentive setup guide.
8 min read
Does SB 690 end all CIPA website lawsuits?
No. SB 690, signed September 30, 2026, moves private website pen-register claims to the Attorney General from January 1, 2027. Wiretap claims remain. Not legal advice.
9 min read
What is the difference between CIPA pen-register and wiretap theories for website tracking?
Plain-English map of CIPA pen-register and wiretap website theories, what SB 690 covers, and which storefront checks to keep. Not legal advice.
8 min read
What does California SB 690 change for website tracking lawsuits?
What SB 690 (Chapter 976, Statutes of 2026) changes for website and app tracking suits from January 1, 2027, what it leaves alone, and which storefront checks to keep.
Free US-baseline
Save a US-baseline technical record
After a DIY check, run a free US-baseline audit: one browser visit outside California, with cookies, requests, and screenshots stored as evidence. That visit does not run EU reject/accept or California GPC. EU, California, and Global 2 audits can be purchased from Billing after sign-in.