What does a Shopify store still send after a shopper clicks Reject?

Short answer

Reject reached checkout on Store X and not on Store J. On Store J the banner recorded the choice, but Shopify's own consent state stayed empty, and checkout pixels follow Shopify's state. Empty, on this US visit, left marketing, analytics, and sale allowed.

With GPC on, Meta, TikTok, and Pinterest sent nothing at checkout on all three stores. On Store Y, Meta was already absent from checkout without GPC. TikTok there went from 2 to 0, and Pinterest from 4 to 0. Google requests continued with restricted-processing flags.

On page load after Reject, chat apps sent no POSTs. Review pixels, an SMS popup, and session replay kept sending.

After Reject, up to four third-party hosts still received the test fbclid on a product page, and six received the chatgpt.com referrer.

The banner: what happens before anyone clicks

This is Store X in our Meta Pixel test. Store Y has no banner.

Store J's TikTok pixel sent events before any click, while the CMP's own stored state had marketing off. Shopify's consent fields were empty.

On Store X, we ignored the banner and opened a product page. The banner closed, and the stored choice had every category on. We did not run an Accept pass. The no-click pass is only an approximate comparison. Meta, TikTok, Pinterest, and Bing started sending on that page.

Add to cart sent Meta 1, TikTok 1, and Pinterest 1, plus Google Ads 5 and GA4 1. Shopify's four consent fields were still no. Some product-page Google requests carried gcs=G111 and some carried gcs=G100. Checkout on that run carried gcs=G100.

Test the ignore-it path too.

GPC, including checkout and its frames

Checkout runs on the store's own domain. Payment and Shop Pay frames come from other hosts; on Store Y, a chat sync frame did too. See the Shopify GPC honor test, the GPC checker, and ad requests before the CMP records GPC.

Every request carried Sec-GPC: 1, and navigator.globalPrivacyControl was true in every frame. The browser adds that header, so receiving it proves nothing about what the frame sent next.

Several US state privacy laws treat GPC as an opt-out request. Not legal advice.

Store Y has no US banner. With GPC on, Meta PageView and ViewContent stayed at 1 and 2, and Bing at 3 and 5. Pinterest and TikTok went to 0. Email and popup tags still sent. Of 9 checkout Ads requests, 8 carried gcs=G111 and rdp=1, and 1 had no gcs value. Meta checkout was already 0 with GPC off.

On Store J the CMP recorded GPC. Marketing stayed empty and allowed. TikTok, against the no-click run, went from 2, 2, and 1 to 0. With GPC off the 10 Ads requests carried gcs=G111, npa=0, and rdp=0. With GPC on, all 10 carried rdp=1 (8 with npa=0, 2 with npa=1), and all 3 GA4 requests carried npa=1. _fbp, _ttp, _clck, and _clsk were gone. _ga and _gcl_au stayed.

Store X was already no on four fields. Replay sent 0 with GPC, against 5 before the click and 8 on the no-click product page. SMS still sent 3, and reviews still sent 5. Checkout Google requests carried gcs=G100 and npa=1. Only _fbp remained.

Store Y still had _fbp, _ga, _gcl_au, and _uetvid. _pin_unauth and _ttp were gone.

Checkout: does Reject carry over?

Store J after Reject sent 2 Meta events (PageView and InitiateCheckout), 2 TikTok events, 10 Google Ads requests carrying gcs=G111, and 5 session replay requests. The no-click run showed the same counts.

gcs is the parameter Google uses to report consent state. Google does not publish a bit-by-bit definition of it. Read the common way, G111 means ad and analytics storage were both granted, and G100 means both were denied.

Those 10 Ads requests also carried npa=0 and rdp=0 on both runs. The 3 GA4 requests carried gcs=G111 and npa=0. Shopify's consent state after Reject stayed empty, so marketing, analytics, and sale stayed allowed.

Store X after Reject sent no Meta, TikTok, or Pinterest request. Google requests carried gcs=G100 and npa=1. Only _fbp remained, and this run had no Meta event request. Check Shopify.customerPrivacy.currentVisitorConsent() after Reject. If it is still empty, the banner and Shopify disagree. See Shopify Customer Events versus the Privacy API.

Store X's no-click checkout carried gcs=G100 and npa=1. Cookie names then were _fbp, _ga, _gcl_au, _ttp, _pin_unauth, _uetvid, _clck, and _clsk. Store J ended both runs with _fbp, _ga, _gcl_au, _ttp, _clck, and _clsk.

Loyalty requests at checkout were 4 on Store J and 5 on Store X, on Reject, no-click, and GPC. Every checkout we counted, including Store Y, sent one Shop Pay collect request.

Chat, reviews, and other widgets

On page load after Reject, the chat app fetched its settings and sent no POSTs. It also loaded a sync frame from another host on each page. We did not open the chat.

Only Store Y loaded it at checkout, once, with or without GPC.

The reviews pixel kept sending after Reject. Its query string has field names for a device ID, a field named fp, screen resolution, and browser features.

On Store X the SMS events were an impression, a creative interaction, and an unrendered creative. That body names cookies and utmParams. Store J sent none.

At add to cart and checkout, Store X sent replay 2 and 3 and wrote no _clck. Store J sent 1 and 5 and wrote _clck and _clsk.

Loyalty sent 1 on the homepage, then 5 at Store X checkout and 4 at Store J checkout. On Store Y's fresh and no-click homepages, the popup sent 5 POSTs and the email tag sent 2.

First visits from social ads and AI answers

We landed with a test fbclid and UTM tags, then with a chatgpt.com referrer, and clicked Reject on Store X and Store J. Store Y has no banner, so those landings were not a Reject test. The product page URL had no parameters.

Meta and TikTok received none of that test fbclid after Reject. Only the no-banner store wrote _fbc, and only on the fbclid landing.

On Store X, the hosts that still received the test values on the product page after Reject were GA4 (carrying gcs=G100), session replay, the SMS app, a site-performance script, and a cause-marketing widget. On Store J an affiliate tracker received the fbclid with the UTM tags, and an upsell app received the UTM tags.

First-layer buttons matched the direct visits: two on Store X, three on Store J, and none on Store Y.

We did not test TikTok's ttclid.

How we tested

Captured 2026-10-30, between 01:00 and 01:12 UTC. Ashburn, Virginia. Headed Chrome, new profile, Los Angeles clock. Six passes: fresh, Reject, no click, GPC, social, AI. Reject: 15 seconds, click, 15 seconds, product for 15 seconds, add to cart, then 25 seconds after checkout loaded.

We stopped at the checkout page load. We entered no email, address or card. We recorded cookie names, not values. Store Y's Reject pass found no button. That pass is a repeat no-click run, not Reject evidence.

For background, DataTrue's Consent Gap 2026 scanned 242 large US sites on October 12 and 13, 2026. Of 24 sites with a visible Reject button and ad tracking, 20 still connected to an ad party and 16 still wrote an ad cookie. Retail was 7 of 8. That is not a rate for all 242 sites.

Run it on your store before Black Friday

Six runs, same path: fresh, Reject, no click, GPC, social, and AI. Stop at checkout page load. For each run, record event requests per page, the cookie names at the end, and Shopify's consent state.

Want this run on your store? Start an audit. A one-time evidence pack is $49 (see pricing).

FAQ

Limits

Three stores, US visitors only, no Accept pass. We stopped at checkout page load and did not test the payment, thank-you or order status pages, or open the chat. Server-side events are not visible in a browser.

Related guides

More Reject captures.

• Shopify Reject All test
• Yotpo after Reject All
• Judge.me after Decline
• Attentive after Reject All
• Clarity after Reject All
• Impact after Reject All

Not legal advice

Not legal advice.