How do you test a Shopify cookie banner's Reject All button?

Not legal advice

This page is a Shopify storefront test for Reject All, Decline, or Essential only. It is not legal advice, not a GDPR or CCPA certificate, and not a verdict that a banner meets a statute. Pass and fail below mean the network and cookie jar changed, or did not. Counsel still owns the legal reading.

Short answer

Use a clean browser profile, open the shop, click Reject All (or Decline, or Essential only), then reload or navigate once. Record cookies, storage, and third-party ad and analytics requests. Compare that run with a fresh visit and with Accept All on the same URL.

If marketing pixels or analytics after Reject look like Accept, the banner UI is not gating the scripts that matter. On Shopify that often happens when a theme embed, an app pixel, or a customer event ignores the consent state. Shopify's Customer Privacy API records consent. It does not automatically block scripts. The API limits guide walks that split. Keep state-labeled screenshots and request lists.

When the banner exists and the pixels still fire

The failure mode is specific. The reject control is on the page. In Network you still see hosts such as connect.facebook.net, www.googletagmanager.com, or analytics.tiktok.com, or the same marketing cookies you saw after Accept. Those host names are examples of what to look for. They are not a measurement of a named shop.

Typical causes sit outside the banner widget. A script in theme.liquid or a Liquid snippet loads on every page. An app embed injects a tag the banner does not know about. A customer event or a web pixel subscribes without reading the consent state. A pixel was installed in a channel the CMP does not control. The server sets a cookie on the document response before any client script can wait.

One sentence on the API: a recorded consent state is not a firewall. Tags still have to read that state and skip their own loads. Read the Customer Privacy API limits guide before you spend a day inside the banner admin.

Prep

Write down the exact button text you will click. Reject All, Decline, and Essential only are not interchangeable if the banner wires them differently. Note the theme and the apps you expect to load. Verify current Shopify admin labels in Shopify's own docs when you follow a menu. This page describes capabilities, not a click path that will rot when the admin is renamed.

If you need to claim an EU result, run the test in an EU context or use ConsentProbe paid EU scenarios. A free US-baseline visit is one non-California technical record. It is not an EU reject conclusion. The free versus paid guide states that scope. The EU fresh, reject, and accept guide is the three-state comparison when the region is the EU.

Three runs

Change only the consent action. Keep the URL and the wait time stable. Start runs B and C from clean profiles so an earlier Accept does not leak into Reject.

How to read the diff

Build a short vendor list from the three runs. Mark each host or cookie present or absent.

Vendors present in B and in C mean Reject was ignored for those vendors. B cleaner than C means partial wiring: some tags waited, some did not. Write which hosts stayed. A quiet analytics cookie does not clear a marketing pixel that still fired.

If A is already full of marketing pixels, you have a pre-consent problem as well as a reject problem. The Shopify pre-consent checklist and the general pre-Accept guide cover that fresh load. This page stays on the reject run. The general Reject All guide covers the same failure on non-Shopify stacks. Use it when the shop is not the only property in scope.

Shopify checks after the diff

The Shopify pre-consent checklist is the longer storefront list. These rows are the reject-specific slice. Confirm current behavior in Shopify's pixel and customer privacy docs before you file a bug against a menu name.

• Customer events and pixels: do they wait until marketing is allowed, or do they load on the first page view?
• App embeds: which ones inject a tracker the banner never names?
• Theme files: is a script hard-coded in theme.liquid or a snippet that renders on every template?
• Banner and API: does the banner write the Customer Privacy API, and do the tags read that state before they fire?
• Other storefronts: password page, landing pages, and checkout-adjacent pages if they are in scope and you are allowed to test them.

Evidence pack

Label the files Fresh, Reject, and Accept. Include cookie tables, key request URLs (the pixel domains, not only the banner vendor), CMP or banner screenshots, timestamps, the shop URL, and theme or app notes.

Send engineering the pixel domains that survived Reject, circled on the request list. A screenshot of the green reject toast without the Network panel does not show the bug.

ConsentProbe maps findings to a request, a cookie, or a screenshot. Paste the shop URL when you want that labeled pack without keeping three DevTools sessions straight.

DIY versus ConsentProbe

DIY is the right way to learn one shop. A stored pack is the right handoff when someone who was not in the browser has to read the result.

FAQ

Related guides

The general Reject All guide is the non-Shopify diagnosis. The Shopify pre-consent checklist and the platform-agnostic checklist cover the fresh load. The API limits guide explains why a recorded consent state still leaves scripts running.

• Reject All Still Tracking: What to Check After You Say No
• Shopify pre-consent checklist: what to check before Accept
• Pre-consent audit checklist: what to verify before Accept
• Shopify Customer Privacy API does not block scripts
• Pre-Consent Cookie Audit: A Storefront Checklist
• CMP claims vs runtime evidence: how do you prove the banner actually works?
• What does a free US-baseline cookie audit prove vs paid EU or California scans?
• How do you audit cookies across EU fresh, reject, and accept visits?
• Testing Shopify Pixels Before Consent
• ConsentProbe methodology
• Pricing and listed regional products