Does Rebuy stop sending events after Reject All on Shopify?

What we ran

• Store J: Shopify, OneTrust banner with Accept All, Reject All and Cookie Settings on the first layer. Store letters are labels for this page only; the same letter on another page can be a different store.
• Chrome Guest window, recorded with chrome://net-export in raw-bytes mode from before the first page load. The first page request in each run had no cookies.
• Before any click, OneTrust stored C0001:1, C0002:0, C0003:0, C0004:0. Accept All set all four to 1. Reject All kept C0002, C0003 and C0004 at 0.
• Accept and Reject run 1 clicked on the home page, then opened one product page and one collection page.
• Reject run 2 clicked on the home page, reloaded it, opened the product page, went home again, then opened a different collection page.

Run 2 loaded more pages, so compare which hosts appear before comparing totals.

Rebuy after Reject All

Rebuy's recommendation and widget calls fill the "You may also like" carousel. Its analytics endpoint receives events about what the visitor saw.

The event types matched across all three runs: one viewed product, one viewed collection, and the rest viewed widget.

Every analytics event after Reject carried these fields (names only):

The recommendation calls also put uuid and the cart token in their query strings.

Gorgias only loaded config and static assets; chat was not opened; behavior after a chat starts was not tested.

The rest of the page after the same click

The TikTok app pixel sent the same events after Reject that it sent after Accept: Pageview and ViewContent on the product page, Pageview and collection_viewed on the collection page. Run 2 also sent a Pageview from the reloaded home page. ViewContent carried the product ID, name, price and currency. In both Reject runs, context.user.anonymous_id equaled the _ttp cookie and did not change across the click, and external_id equaled Shopify's shopify_client_id cookie.

This differs from our TikTok Shopify app opt-out capture. On that page's Store B, Shopify's consent read "no" after the opt-out and TikTok requests stopped.

The Impact requests are broken down in impact.com after Reject All.

The Searchspring and Tolstoy requests are broken down in Searchspring after Reject All.

Cookies that stayed (names only)

We saw no request that deleted a cookie after Reject.

Why this can happen

Shopify's own analytics requests report a consent state. On Store J they post to /.well-known/shopify/monorail/unstable/produce_batch on the store's domain. The first one after Reject in each run had these raw fields in storefront_customer_tracking/4.30 and web_pixels_manager_load/3.3:

The Cookie header on that same request held OptanonConsent with groups=C0003:0,C0001:1,C0004:0,C0002:0 and interactionCount=1, plus OptanonAlertBoxClosed. No _tracking_consent cookie appeared in any run. In run 1 the request came after the browser had loaded the product page. In run 2 it came after a full reload of the home page. Neither run sent one of these payloads between the click and the next page load, so each value was read on a fresh page. Every Shopify payload after Reject that carried these fields read true: 8 in run 1, 11 in run 2. The Accept run showed the same values.

The log does not show the OneTrust choice reaching Shopify. We did not run Shopify.customerPrivacy.currentVisitorConsent() in the console, so this rests on the request bodies. How Shopify reads that state is covered in Shopify Customer Events vs the Customer Privacy API.

What the vendors' docs say to configure

Steps are from the vendors' official documentation; we have not verified each one.

1. OneTrust's Shopify app has a Consent Mapping step that maps OneTrust category IDs to Shopify's categories, and OneTrust says it then updates Shopify's Privacy API values. Its headless example maps analytics to C0002, marketing to C0004, preferences to C0003 and sale_of_data to C0004. Its documented opted-out response from currentVisitorConsent() is no for all four.
2. Shopify's app pixel guide says a third-party consent tool must sync consent to Shopify through the Customer Privacy API. Settings > Customer events lists each app pixel, and View customer privacy shows its privacy settings.
3. Rebuy's developer docs say its event tracking uses Shopify's consent tracking API and that Rebuy tracks events anonymously when a customer has declined. Its help center says Rebuy sends a logged-in shopper's Shopify customer ID only when analytics and marketing tracking are allowed. Our visitor was not logged in, so we did not test the customer ID.
4. TikTok's data-sharing article lists three levels for its Shopify app. Standard uses the pixel. Enhanced and Maximum add Events API and Advanced Matching, which run server-side and do not show in DevTools.

Check your own store (5 minutes)

1. Open a Guest or Incognito window. Open DevTools, tick Preserve log, then load the store.
2. Click Reject All. Reload the page once.
3. In the console, run Shopify.customerPrivacy.currentVisitorConsent(). In Application > Cookies, read the groups in OptanonConsent. Write both down.
4. Filter Network for analytics/event/bulk. Open a request, then Payload. Compare rsid with the _rsession cookie, and note whether uuid matches the events sent before the click.
5. Filter for shopify_pixel. Note the event names and compare context.user.anonymous_id with the _ttp cookie.

The Reject All still tracking check shows the host and request rows an after-Reject record holds. Our cookie audit tool records one fresh load before any click. For results from other stores, see the Shopify Reject All guide.

FAQ

Limits

One store on one day: one Accept run and two Reject runs, from a US connection where OneTrust started with C0002 to C0004 off. Page paths differ between runs. We did not log in, add to cart, open chat, or call the Shopify consent API in the console. We see what left the browser. We cannot see what Rebuy, TikTok or Shopify stored on their servers. Not legal advice.