Technical guide
Reject All vs Accept vs GPC: A Scenario Matrix for Shopify Stores
A comparison matrix for isolated Shopify storefront sessions: untouched first load, Reject All, Accept All, and California-facing Global Privacy Control.
In brief
Run four isolated Shopify sessions when the market mix requires them: untouched first load, verified Reject All, Accept All, and a California-facing GPC pair. Compare cookies, storage, and network requests with screenshots. Pre-consent means the banner is still untouched. GPC is a sale-or-share opt-out signal, not a CMP replacement. A US-baseline run is not a regional legal result.
Hard boundary
Keep every scenario in a new browser profile. A US-baseline visit does not support EU or California conclusions. GPC needs a California-facing path plus a verified Sec-GPC header and navigator.globalPrivacyControl value when you claim that region. This matrix is a technical checklist. It is not legal advice and does not declare a store lawful or approved.
Why isolation comes first
Reusing one profile carries cookies and storage into the next choice. Close extra private windows. Skip admin previews. If you claim an EU or California result, use a real regional network path. Browser locale is not that path.
Pre-consent observation is the first load before any banner click. Reject All is only useful after an observable preference or banner-state change. Accept All is the inventory baseline for this URL and browser. GPC is an extra California-facing pair, not a substitute for Reject All.
Scenario matrix
Use the table as a behavior checklist. Necessary cookies may still be set on the fresh load. Cookieless requests can still be sent. Matching hostnames across rows need a closer look at purpose and payload.
| Scenario | Setup | Expect to record | Review further |
|---|---|---|---|
| Fresh, no click | Clean profile, public URL, banner untouched | Necessary cookies; first-party functional storage; banner screenshot | Analytics, ads, or pixel identifiers set or sent before any choice |
| Reject All | New profile; verified reject control; reload once | Preference or banner-state change; non-essential marketing staying off | Click with no state change, or the same non-essential traffic as Accept |
| Accept All | New profile; accept control; reload once | Chosen vendors, cookies, and requests that appear only after accept | Chosen tags never load: consent conditions, blockers, or a load failure |
| GPC on, California-facing | Matched GPC-off and GPC-on sessions; verify header and JS property | Sale-or-share-style advertising requests reduced versus the matched off run | GPC never verified, or pixels sent before any layer can read the signal |
How to run the four rows
Keep the storefront URL, wait time, and evidence fields stable. Change only the consent action or the GPC signal.
- Run the fresh visit and label cookies, Network, and screenshots as fresh.
- In a new profile, complete Reject All, confirm an observable change, then recapture.
- In a new profile, complete Accept All and mark post-consent inventory.
- If you claim California, add a GPC-off and GPC-on pair with IP evidence and verified
Sec-GPCplusnavigator.globalPrivacyControl. - Sanitize query values and secrets before sharing the pack.
Where ConsentProbe sits
The free path is one US-baseline session with cookies, requests, CMP actions, and screenshots attached to findings. EU fresh, reject, and accept, and California baseline versus GPC, are listed on pricing. The sample report shows the evidence layout used after a saved run.
Related guides
Use the first-load checklist for the fresh row, the reject-all guide for verified clicks, and the GPC guide for the California pair.
- Pre-Consent Cookie Audit: A Storefront Checklist
- Testing “Reject All” on a Cookie Banner
- Testing Global Privacy Control on a California Storefront
- Consent Mode vs Raw Pixel Requests: A Storefront Checklist
- Runtime Audit vs CMP: What Each One Measures
- ConsentProbe methodology
- Sample report
- Pricing and listed regional products
Sources
These links cover the platform and regulatory context used in this guide. Applicability still depends on the organization and jurisdiction.
保存一次美国基线技术记录
完成自行检查后，可以跑一次免费美国基线审计：在加州以外做一次浏览器访问，把 Cookie、请求和截图存成证据。这次访问不会跑欧盟拒绝/接受，也不会跑加州 GPC。欧盟、加州和 Global 2 可在登录后的账单页购买。