Checklist
AppLovin AXON pixel on Shopify after Reject: three stores tested
We tested 3 Shopify stores with the AXON pixel. After Reject, it sent nothing on the next page, but pre-click events and the Reject click still went out.
In brief
Before Reject, the first page on Store O and Store Q had already sent page_viewed, and in the same pass there were 10 requests to b.applovin.com/v1/gcm/match and 11 requests to cm.g.doubleclick.net/pixel?google_nid=aplv. The Reject click itself was also logged as a clicked event. Store P used GPC instead of Reject, and that pass sent 0 AXON requests. Not legal advice.
What did AXON send before the visitor chose anything?
We captured this on 2026-10-26 from a direct US connection in Virginia. The browser was headless Chrome, with a new profile per pass. We did not log in, add a product to the cart, or check out. Store O and Store Q had Fresh, Reject, and Accept passes. Store P had a Fresh pass and a GPC pass.
Store O uses OneTrust. A US visitor sees a banner with an OK button, and Reject All is on the Privacy Choices page. Store Q uses Cookiebot. The first layer has Customize and Allow all, and Deny is inside Customize. Store P shows no banner to a US visitor.
Seven of the eight passes sent 10 requests to b.applovin.com/v1/gcm/match and 11 to cm.g.doubleclick.net/pixel?google_nid=aplv, all on the first page and all before the click mark. Store P GPC sent none. Clicking Reject cannot recall requests that already left. The path name suggests cookie matching; we did not confirm it.
| Pass | Start page | Before the click | At 0.0 seconds | Product page |
|---|---|---|---|---|
| O Fresh | Home | page_viewed (-4.1) | No click | page_viewed, product_viewed, page_session |
| O Reject | Privacy Choices | page_viewed (-5.2). 2 clicked events (-3.5, -3.2). We did not make those clicks, and we did not check the source. | 1 clicked event, the Reject All click | None |
| O Accept | Home | page_viewed (-5.4) | 1 clicked event | page_viewed, product_viewed, page_session |
| P Fresh | Privacy Choices | page_viewed (-3.9) | No click | page_viewed, product_viewed, page_session |
| P GPC | Privacy Choices | None | No click | None |
| Q Fresh | Home | page_viewed (-4.1), about 2.2 seconds after the page opened | No click | None |
| Q Reject | Home | page_viewed (-8.2). 5 clicked events from -3.8 seconds to -0.7 seconds, our clicks in the panel. | 1 clicked event, the Deny click | None |
| Q Accept | Home | page_viewed (-5.0) | 1 clicked event | page_viewed, product_viewed, page_session |
| Pass | config | gcm/match | doubleclick (aplv) | app-embed.js |
|---|---|---|---|---|
| O Fresh | 2 | 10 | 11 | 2 |
| O Reject | 1 | 10 | 11 | 2 |
| O Accept | 2 | 10 | 11 | 2 |
| P Fresh | 2 | 10 | 11 | 0 (Store P has no embed) |
| P GPC | 0 | 0 | 0 | 0 |
| Q Fresh | 1 | 10 | 11 | 4 |
| Q Reject | 1 | 10 | 11 | 4 |
| Q Accept | 2 | 10 | 11 | 3 |
None of these passes sent a POST to /cart/update.js carrying _axon_event_id, and none sent a request to b.applovin.com/v1/log.
Does clicking Reject stop AXON on the next page?
On Store O Reject and Store Q Reject, the product page sent no AXON pixel events. Store O Fresh, Store O Accept, Store P Fresh, and Store Q Accept sent page_viewed, product_viewed, and page_session on the product page. Store Q Fresh sent no AXON pixel event on the product page. Store P GPC sent no AXON pixel events on that pass.
| Pass | Shopify consent | CMP record |
|---|---|---|
| O Fresh | marketing, analytics, preferences, and sale_of_data yes | OneTrust active groups include C0004, C0005, and SSPD_BG |
| O Reject | marketing no, sale_of_data no, analytics yes, preferences yes | OneTrust left with C0001, C0002, and C0003 |
| O Accept | marketing, analytics, preferences, and sale_of_data yes | All OneTrust groups |
| P Fresh | Four empty strings. The visitor made no choice. marketingAllowed() returned true. | No CMP |
| P GPC | sale_of_data no. marketing, analytics, and preferences were empty strings. | No CMP |
| Q Fresh | marketing, analytics, preferences, and sale_of_data no. No button was clicked. | Cookiebot: neither consented nor declined |
| Q Reject | marketing, analytics, preferences, and sale_of_data no | Cookiebot: declined |
| Q Accept | marketing, analytics, preferences, and sale_of_data yes | Cookiebot: consented. Marketing and statistics were true. |
On Store Q Fresh, page_viewed left about 2.2 seconds after the page opened. We did not read the consent value at that moment. We read it at 6.3 seconds, and the four values were no. These two reads can't show whether consent was set before or after the event.
Why was the Reject click itself sent to AXON?
Store O logged 1 clicked event at the Reject All click, at 0.0 seconds. Two clicked events on that pass, at -3.5 seconds and -3.2 seconds, were not clicks we made. We did not check their source. Store Q logged 5 clicked events from -3.8 seconds to -0.7 seconds while we clicked through the Cookiebot panel, and 1 clicked event at the Deny click. Those panel clicks left the browser as clicked events, the same event name the pixel used for other clicks on the page.
We infer the pixel was already running before the banner, from the Store Q Fresh page_viewed time in the table. We did not log a banner timestamp, and we recorded event names only.
Which AXON cookies stay after Reject?
We read cookies and storage at the end of the pass, and the table lists names only.
| Pass | AXON cookies | localStorage and sessionStorage |
|---|---|---|
| O Fresh, O Reject, and O Accept | _axwrt, ax_visitor, _ax_session_data, and _ax_last_event. After Reject, the browser still had them. | _applovin_pixel_version, _axwrt_backup, and _axsid |
| P Fresh | _axwrt, ax_visitor, _ax_session_data, and _ax_last_event | _applovin_pixel_version, _axwrt_backup, and _axsid |
| P GPC | None | None |
| Q Fresh and Q Accept | _axwrt, ax_visitor, _ax_session_data, and _ax_last_event | _applovin_pixel_version, _axwrt_backup, and _axsid |
| Q Reject | _axwrt and _ax_session_data | _axsid |
This store's Cookiebot declaration lists _axwrt under Necessary. After Deny, _axwrt was still in the browser, and no AXON event was sent from the next page.
What if the store shows no banner at all?
Store P shows no banner to a US visitor. Your Privacy Choices, linked from the footer, has an Opt out button. The click triggered hCaptcha. The headless browser did not clear that challenge, consent stayed unchanged, and there is no Reject pass. We ran a GPC pass in its place. GPC is a browser signal, not a click. Some US state opt-out rules point to a browser signal such as GPC. Not legal advice.
The GPC pass sent 0 requests to b.applovin.com/v1/gcm/match and 0 requests to cm.g.doubleclick.net/pixel?google_nid=aplv, and it wrote no AXON cookies. The Fresh pass sent page_viewed before the click mark, then page_viewed, product_viewed, and page_session on the product page. Store P has no Accept control for a US visitor, so this capture has no Accept pass.
What we didn't test
One visit per pass, from Virginia in the US. No login, no add to cart, and no checkout.
We did not test a visit with an ad click ID (aleid). None of the passes sent a POST to /cart/update.js carrying _axon_event_id, and none sent a request to b.applovin.com/v1/log. This capture has no data for the app embed path that writes a cart attribute.
Store O Reject started on the Privacy Choices page. Store O Fresh and Store O Accept started on the home page. Both Store P passes started on the Privacy Choices page.
Our capture logged every request under the main page, so we can't tell a Shopify pixel-sandbox request from a page-script request.
How to check your own store
Run the three passes yourself, in separate windows, and read the next page after Reject.
- Open DevTools, then the Network panel, and filter for applovin.
- Use a new private window for Fresh, another for Reject, and another for Accept.
- After Reject, open the next page and look for a POST to /shopify/v2/pixel.
Shopify documents the gate in the Pixels overview and the Customer Privacy API. AppLovin publishes Data Sharing Requirements for merchants who install the pixel.
Postscript is another Shopify app we measured after Reject: Postscript after Reject. Those store captures sit with the Shopify Reject All test.
Want Fresh, Reject, and Accept recorded on your store? See audit options ($49).
FAQ
Does AppLovin AXON respect Shopify cookie consent?
On Store O and Store Q, the next page after Reject sent no AXON pixel events. Events sent before the click, including page_viewed, had already gone out, and the Reject click itself was sent as a clicked event. Store P's GPC pass sent 0 AXON requests. Not legal advice.
What is the _axwrt cookie?
AppLovin's GTM documentation describes _axwrt as a first-party cookie set by the pixel (AppLovin GTM documentation). Store O Fresh, Store P Fresh, and Store Q Fresh all wrote _axwrt.
Does GPC stop AXON on Shopify?
On Store P, one GPC pass sent 0 AXON requests and set no AXON cookies. That is one store and one visit. GPC is a browser signal, not a click. Not legal advice.
Not legal advice
Not legal advice.
Sources
These links cover the platform and regulatory context used in this guide. Applicability still depends on the organization and jurisdiction.
Save a US-baseline technical record
After a DIY check, run a free US-baseline audit: one browser visit outside California, with cookies, requests, and screenshots stored as evidence. That visit does not run EU reject/accept or California GPC. EU, California, and Global 2 audits can be purchased from Billing after sign-in.