Yotpo reviews disappear after Reject All on Shopify

Not legal advice

This page records two browser passes on Store I, a Shopify store with a OneTrust banner, on 2026-10-13. Times below are UTC+8. It is not legal advice, not a ruling on any store or on Yotpo, and not a statement that a request broke a law. Observation is not counsel permission.

The Accept pass has no separate click mark, so the whole Accept session is counted. The Reject click in the main log is 09:39:31. Cookie names come from a later raw-bytes follow-up, not from that strip log. The strip log removes Set-Cookie lines.

What Accept and Reject showed

Accept All left the reviews widget on the product page. Reject All removed that section, and the page went straight to the footer.

Yotpo hosts before and after Reject

The Accept capture runs 09:36:35 to 09:37:37 and has 1,222 requests. The Reject log after the 09:39:31 click has 754 requests and continues to 09:48:47, mostly idle. Accept opened several product pages. Reject opened one product page, the home page, and the cart. Treat the host counts as what those two logs contain, not as a matched page-for-page rate.

After Reject, the loader and the points widget (widget-product-points) still loaded from cdn-widgetsrepository.yotpo.com. The star-rating widget, the main reviews widget, and the yotpo-pixel bundle did not. The reviews bottomline API and the rich snippets API did not return. p.yotpoapi.com dropped from 10 events to 1, and the remaining event was product-points-widget loaded.

The points widget kept loading

cdn-loyalty.yotpo.com and storefront.yotpo.com each sent 2 requests in the Accept session and 2 after Reject. The reviews calls on api-cdn.yotpo.com went to 0. The same Yotpo loader stayed. Reviews stopped. Points did not.

Cookies written before the click

The yotpo_pixel, _sp_id.*, and _sp_ses.* cookies were written before Reject All, still present after Reject All. After Reject, Yotpo domains set no new cookies.

Those names are from a raw-bytes follow-up. Reject in that pass was 09:59:58 UTC+8. The banner was still untouched when the cookies were written. Reject All did not delete them, and later requests still carried them. No Yotpo response after that click sent a Set-Cookie. api-cdn.yotpo.com stayed at 0 in the follow-up, and the points widget still loaded.

The 09:39:31 strip log cannot show this. Strip-private mode removes Set-Cookie and cookie events, so cookie names for that pass are not in the log.

Other tags after the next page

From 09:39:33 UTC+8, the next page sent no Facebook, TikTok, DoubleClick, Google Analytics, Bing, or Clarity requests. LinkedIn and StackAdapt were also absent. Klaviyo was absent in both passes.

These hosts still sent requests on that next page: Google Tag Manager 3, Hightouch 4 (us-east-1.hightouch-events.com), and Attentive 12. The Attentive 12 are 5 to cdn.attn.tv, 5 to events.attentivemobile.com, and 2 to the store's Attentive host. A first-party subdomain sent 2, and shop.app sent 1.

At 09:39:31 to 09:39:32, on the click itself, TikTok sent 3 requests, Meta 1, and Bing 2. Clarity, Heap, Quantserve, and Automizely sent 1 each in that same second. This page treats those as the old page unloading or as requests already in flight. They are not evidence that those tags kept firing on the next page.

What the official docs say to configure

Steps are from official documentation; we have not verified each one.

A merchant who wants the reviews widget to stay up after Reject has to change how Yotpo and the CMP classify that script. The steps below are the documented path. This capture did not apply them on Store I.

1. Contact Yotpo support and ask them to turn off cookie collection and pixel tracking for Reviews Widgets. There is no self-serve switch. After it is off, cookie collection stops for every Yotpo component, and interaction data such as the Conversion Dashboard stops showing. Turning it back on also goes through Yotpo. How to disable cookie collection for Yotpo Reviews Widgets (updated 2025-08-18, accessed 2026-10-13).
2. One option to discuss with counsel: after Yotpo turns off cookies and the pixel on the reviews widget, ask whether that script is still marketing or analytics. If counsel says it is not, a functional category in the CMP can leave the reviews widget up after Reject. Whether that holds depends on the jurisdiction and the privacy policy. This page does not decide that.
3. The Yotpo loader in theme.liquid is cdn-widgetsrepository.yotpo.com/v1/loader/{app_key}. To load it only on product pages, move that tag to product.liquid. Adding the reviews widget to Shopify (accessed 2026-10-13).
4. Yotpo's cookie article names pixel, _sp_id*, _sp_ses*, and _yotpo-api-1_session for the reviews widget. Older widgets use that page as the list. Yotpo cookies (accessed 2026-10-13).
5. The OneTrust Shopify app maps OneTrust categories to the Shopify Customer Privacy API under Consent Mapping, so the app can read the visitor's choice. OneTrust ecommerce docs (accessed 2026-10-13).

Check Reject in DevTools

This is the method used for the captures above. It is not an official Yotpo step. On Store I the first-layer button was Reject All.

1. Open a fresh Guest or Incognito window. Open DevTools before the URL. Turn on Keep log (Preserve log in older Chrome) and Disable cache.
2. Load a product page. Do not click the banner. In Network, filter for yotpo.
3. Note whether the reviews widget, the star rating, and the points widget are on the page.
4. Click Reject All. Write down the time.
5. Open the product page again. Filter yotpo. Keep api-cdn.yotpo.com separate from the loader and from the points widget.
6. In Application, look for yotpo_pixel, _sp_id, and _sp_ses. Record whether they were set before the click and whether Reject removed them.
7. On Yotpo responses after the click, check for Set-Cookie. A strip log that drops cookie headers cannot answer this.

Check the browser half

Run a fresh visit and the Reject control the banner shows. ConsentProbe records cookies and request hosts from that visit. It does not replace Yotpo admin, and it does not install a CMP. A free US-baseline scan is not an EU or California legal conclusion.

FAQ

Limits of this page

One store, labeled Store I, on 2026-10-13. Visitor region was not recorded. The Accept log has no click mark and covers about a minute across several product pages. The Reject log covers about nine minutes, mostly idle, on one product page, the home page, and the cart. Cookie names are from the raw-bytes follow-up at 09:59:58 UTC+8, because the strip log has no Set-Cookie lines. We see what left the browser, not what Yotpo stored. Requests in the click second are treated as unload or in-flight. Configuration steps come from the official docs and were not checked one by one here. These notes do not describe Shopify stores in general. It is not legal advice. Observation is not counsel permission. A free US-baseline scan is not an EU or California legal conclusion. ConsentProbe does not install a CMP.

Related guides

Judge.me, Attentive, Omnisend, Klaviyo, Clarity, and TikTok are the other Shopify app captures. The Reject All hub is the method page for the banner control.

• Hightouch Events after Reject All
• Judge.me after Decline
• Attentive after Reject All
• Omnisend after Decline
• Klaviyo after Reject All
• Clarity after Reject All
• TikTok after opt-out
• Shopify Reject All still tracking
• Shopify Customer Events vs the Customer Privacy API
• Cookie consent testing hub
• Cookie audit