真实店铺抓包，已匿名，美国连接，抓包日期 2026-10-15。付费审计另跑欧盟和加州场景。

After Reject All, TikTok, Rebuy, and Impact requests were still observed on Store J.

可跳过封面

CPConsentProbe

Private technical report

ConsentProbe · Report V3.1

Runtime audit, Store J, 2026-10-15

What happened on your site, and what you can change.

In one sentence

After Reject All, TikTok, Rebuy, and Impact requests were still observed on Store J.

Observed Audited target
https://store-j.example/

Report ID: CP-SAMPLE-STORE-J-20261015
Generated: 2026-10-15, date only
Framework: United States capture, before click, Reject All, and Accept All
Scope: FULL · single_region

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Look at these first

Start here

Look at these first

One sentence on what we saw, then the three things to change first.

The first pages are for you. The appendix is for a developer who needs the raw detail. You can skip it.

Derived In one sentence

After Reject All, TikTok, Rebuy, and Impact requests were still observed on Store J.

Anonymized Shopify store Store J, captured 2026-10-15 from a US connection. After Reject All, analytics.tiktok.com sent 8 requests (4 POST /api/v2/shopify_pixel), Rebuy analytics/event/bulk sent 6 requests and 6 events, and trkapi.impact.com sent 4 requests after Reject All (Accept also 4). TikTok anonymous_id equaled _ttp and external_id equaled shopify_client_id. Rebuy uuid and rsid were unchanged. Meta, Google, Klaviyo, and Clarity totaled 177 requests after Accept and 7 after Reject. Shopify monorail consent fields were all true after Reject, and _tracking_consent was not seen. The logs did not show the OneTrust choice reaching Shopify.

Critical: 0
High: 4
Sufficiency: Complete (3/3)
Owner: Engineering

Look at these three first

high analytics.tiktok.com sent 8 requests after Reject All Reject run 1 and the Accept run each sent 8 requests to analytics.tiktok.com after the click, including 4 POST /api/v2/shopify_pixel.
high Rebuy analytics/event/bulk sent 6 requests and 6 events after Reject All Reject run 1 sent 6 POST requests and 6 events. The Accept run sent 4 POST requests and 6 events. uuid and rsid were unchanged across the Reject click. rsid equaled _rsession.
high trkapi.impact.com sent 4 requests after Reject All (Accept also 4) Accept and Reject run 1 each sent 4 requests to trkapi.impact.com after the click.

Evidence sufficiency

Reject run 1 and the Accept run were separate captures on 2026-10-15 from a US connection. Host counts on this page are after the click.

What you can do now

1. Compare analytics.tiktok.com on a later capture, then run RT-TT. Reject run 1 showed 8 requests after Reject All, including 4 POST /api/v2/shopify_pixel.
2. Compare rebuyengine.com/api/v2/analytics/event/bulk, then run RT-REBUY. Reject run 1 showed 6 requests and 6 events after Reject All.
3. Compare trkapi.impact.com, then run RT-IMPACT. Reject run 1 showed 4 requests after Reject All (Accept also 4).

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015What to change

Your list

Do these next

If you can tap a setting, do that. If you cannot, paste the whole item to your developer.

1high

trkapi.impact.com sent 4 requests after Reject All (Accept also 4)

What we saw: trkapi.impact.com was 4 requests after Accept and 4 after Reject run 1.
Why it matters: trkapi.impact.com still received 4 requests after Reject All, the same count as Accept.
What you can do: Engineering: On a later capture, count trkapi.impact.com after Reject All.
How to check it: The later capture records the trkapi.impact.com request count.

It showed up on: Impact (trkapi.impact.com) during US after Reject All, after action, recorded as Browser Signal; Impact (trkapi.impact.com) during US after Accept All, after action, recorded as Browser Signal.

2high

Rebuy analytics/event/bulk sent 6 requests and 6 events after Reject All

What we saw: rebuyengine.com/api/v2/analytics/event/bulk after the click: Accept 4 requests and 6 events, Reject run 1 6 requests and 6 events. Event types were one viewed product, one viewed collection, and the rest viewed widget. Recommendations and widget config (/api/v1/products/recommended, /api/v1/custom/id/..., theme and static product calls) were 16 on Accept ...
Why it matters: uuid and rsid on the Rebuy events were the same before and after the Reject click.
What you can do: Engineering: On a later capture, count analytics/event/bulk after Reject All and compare uuid and rsid with the values from before the click.
How to check it: The later capture records the request count, the event count, and whether uuid and rsid changed.

It showed up on: Rebuy (rebuyengine.com) during US after Reject All, after action, recorded as Network; Rebuy (rebuyengine.com) during US after Accept All, after action, recorded as Network; uncatalogued host (uncatalogued host) during US after Reject All, after action, recorded as Browser Signal.

3high

Shopify monorail consent fields were true after Reject All

What we saw: POST /.well-known/shopify/monorail/unstable/produce_batch on Reject run 1 carried those fields. 8 payloads after Reject carried them, and none of those fields was false. The same request's OptanonConsent groups were C0003:0, C0001:1, C0004:0, C0002:0. The logs did not show the OneTrust choice reaching Shopify.
Why it matters: The logged Shopify payloads after Reject All still had all four consent fields set to true.
What you can do: Engineering: On a later capture, read the same monorail fields after Reject All and record whether _tracking_consent is present.
How to check it: The later capture records the four field values and whether _tracking_consent was seen.

It showed up on: uncatalogued host (uncatalogued host) during US after Reject All, after action, recorded as Browser Signal; uncatalogued host (uncatalogued host) during US after Accept All, after action, recorded as Browser Signal.

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015What to change

Your list

Do these next

If you can tap a setting, do that. If you cannot, paste the whole item to your developer.

4high

analytics.tiktok.com sent 8 requests after Reject All

What we saw: After Reject All, analytics.tiktok.com received 8 requests, of which 4 were POST /api/v2/shopify_pixel. The product page sent Pageview and ViewContent. The collection page sent Pageview and collection_viewed. context.user.anonymous_id equaled the _ttp cookie and did not change across the click. external_id equaled shopify_client_id.
Why it matters: The same anonymous_id was on the TikTok requests after Reject All.
What you can do: Engineering: On a later capture, count analytics.tiktok.com requests after Reject All and compare anonymous_id with the _ttp cookie name.
How to check it: The later capture records the request count and whether anonymous_id equals the _ttp cookie name.

It showed up on: TikTok (analytics.tiktok.com) during US after Reject All, after action, recorded as Network; TikTok (analytics.tiktok.com) during US after Accept All, after action, recorded as Network; uncatalogued host (uncatalogued host) during US after Reject All, after action, recorded as Browser Signal.

5medium

Meta, Google, Klaviyo, and Clarity were 177 requests after Accept and 7 after Reject

What we saw: Accept / Reject run 1: Meta (connect.facebook.net and www.facebook.com) 9/0. Google (Google Tag Manager, GA4, Google Ads, DoubleClick, Merchant Center) 49/0. Klaviyo 88/4, and the 4 are klaviyo.js only. Clarity 31/3, and the 3 are tag 2 and /collect 1.
Why it matters: Meta and Google had no requests after Reject All. Klaviyo and Clarity account for the 7 requests after Reject run 1.
What you can do: Engineering: On a later capture, recount Meta, Google, Klaviyo, and Clarity after Accept All and after Reject All.
How to check it: The later pair of runs records a count for Meta, Google, Klaviyo, and Clarity.

It showed up on: Meta (connect.facebook.net) during US after Accept All, after action, recorded as Browser Signal; Google (Google Tag Manager) during US after Accept All, after action, recorded as Browser Signal; uncatalogued host (uncatalogued host) during US after Accept All, after action, recorded as Browser Signal.

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Scope and method

Scope

What we checked, and what we did not

We opened your site in a real browser to look at tracking behavior. This is not a legal opinion. (1/2)

What we checked

- United States
- US before click
- US after Reject All
- US after Accept All

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Scope and method

Scope

What we checked, and what we did not

We opened your site in a real browser to look at tracking behavior. This is not a legal opinion. (2/2)

What we did not check

- Legal advice or a legal determination
- Input values, authenticated-journey selectors, values, session secrets and raw browser errors, authenticated-page screenshots, Cookie values, raw Set-Cookie headers, cookie partition-key site strings and raw cookie-write stacks, form field names, labels, placeholders, selectors, option text, action paths and action queries, discovered link text, link-decoration values, fragments and full links, fingerprint arguments, results, rendered output, device values and raw stacks, public-notice page text, purpose descriptions, unmatched notice terms, sensitive-data inspected values and hashes, request bodies, request headers, query values, advanced-persistence file contents and metadata, bucket configuration, Shared Storage keys, values, worklet data, URL candidates, arguments and results, browser and network-endpoint IP addresses, IP hashes, raw CDP events, complete initiator call stacks, and raw runtime responses
- Unobserved offline, back-office, identity-verification, or deletion workflows
- Tracking behavior outside the recorded capture interval
- Each scenario opens the URL you submit. A same-origin scan may also open a linked product, cart, privacy, or cookie page within the page and time limit. Checkout can stay out of scope when it uses another host or needs a filled cart.
- Theme, app embed, and web pixel behavior is recorded from requests the browser can see. This audit is not a Shopify app and does not modify the store. This is a technical record, not legal advice.

How we checked

We opened your site from the regions you picked and followed fixed rules for requests and cookies. Cookie values, request bodies, and raw IP addresses are not in this report.

Reject run 1 and the Accept run were separate captures on 2026-10-15 from a US connection. Host counts on this page are after the click.

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015United States slice

United States

What the US visits recorded

US before click · US after Reject All · US after Accept All

What we saw

analytics.tiktok.com sent 8 requests after Reject All: After Reject All, analytics.tiktok.com received 8 requests, of which 4 were POST /api/v2/shopify_pixel. The product page sent Pageview and ViewContent. The collection page sent Pageview and collection_viewed. context.user.anonymous_id equaled the _ttp cookie and did not change across the click. external_id equaled shopify_client_id.
Rebuy analytics/event/bulk sent 6 requests and 6 events after Reject All: rebuyengine.com/api/v2/analytics/event/bulk after the click: Accept 4 requests and 6 events, Reject run 1 6 requests and 6 events. Event types were one viewed product, one viewed collection, and the rest viewed widget. Recommendations and widget config (/api/v1/products/recommended, /api/v1/custom/id/..., theme and static product calls) were 16 on Accept ...
trkapi.impact.com sent 4 requests after Reject All (Accept also 4): trkapi.impact.com was 4 requests after Accept and 4 after Reject run 1.

Why it matters

The same anonymous_id was on the TikTok requests after Reject All.

uuid and rsid on the Rebuy events were the same before and after the Reject click.

What you can do

On a later capture, count analytics.tiktok.com requests after Reject All and compare anonymous_id with the _ttp cookie name.
On a later capture, count analytics/event/bulk after Reject All and compare uuid and rsid with the values from before the click.
On a later capture, count trkapi.impact.com after Reject All.
On a later capture, recount Meta, Google, Klaviyo, and Clarity after Accept All and after Reject All.

How to check it

The later capture records the request count and whether anonymous_id equals the _ttp cookie name.

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Vendor behavior by consent state

Consent-state comparison

Which vendors appeared in each controlled visit

Page 1 of 1. Showing 7 prioritized vendor(s) from 7 frozen behavior row(s).

Vendor	Category	US after Reject All	US after Accept All
TikTok Derived Linked to a technical finding	advertising	observed 8 signal(s), 8 request(s)	observed 8 signal(s), 8 request(s)
Impact Derived Linked to a technical finding	advertising	observed 4 signal(s), 4 request(s)	observed 4 signal(s), 4 request(s)
Microsoft Clarity Derived Linked to a technical finding	session_replay	observed 3 signal(s), 3 request(s)	observed 31 signal(s), 31 request(s)
Rebuy Derived Linked to a technical finding	analytics	observed 6 signal(s), 6 request(s)	observed 4 signal(s), 4 request(s)
Klaviyo Derived Linked to a technical finding	marketing	observed 4 signal(s), 4 request(s)	observed 88 signal(s), 88 request(s)
Google Derived Linked to a technical finding	advertising	not observed	observed 49 signal(s), 49 request(s)
Meta Derived Linked to a technical finding	advertising	not observed	observed 9 signal(s), 9 request(s)

How to read this matrix

Observed means requests for that vendor were recorded after the click. Not observed means that completed visit recorded none. Per-vendor counts before the click are not in this page, so that column is omitted.

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Appendix A · Evidence inventory

Evidence exhibits

Evidence linked to priority findings

Sanitized visual and typed evidence exhibits 1 of 1. Each board identifies its distinct request, script, signal, or viewport basis.

EX-TT · TikTok requests after Reject All Derived

evidence chain · US after Reject All

EV-TT-REJECTNetwork8 requests to analytics.tiktok.com after Reject All, including 4 POST /api/v2/shopify_pixel. Product page: Pageview and ViewContent. Collection page: Pageview and collection_vie...https://analytics.tiktok.com/api/v2/shopify_pixel

EV-TT-IDBrowser Signalcontext.user.anonymous_id equaled the _ttp cookie and did not change across the click. external_id equaled shopify_client_id.

EV-COOKIE-TTPCookie_ttp cookie name observed; value excluded. TikTok anonymous_id equaled this cookie on Reject run 1.

8 analytics.tiktok.com requests, including 4 POST /api/v2/shopify_pixel, with anonymous_id equal to the _ttp cookie.

EV-TT-REJECT: 8 requests to analytics.tiktok.com after Reject All, including 4 POST /api/v2/shopify_pixel. Product page: Pageview and ViewContent. Collection page: Pageview and collection_viewed. EV-TT-ID: context.user.anonymous_id equaled the _ttp cookie and did not change across the click. external_id equaled shopify_client_id. EV-COOKIE-TTP: _ttp cookie name observed; value excluded. TikTok anonymous_id equaled this cookie on Reject run 1.

Finding refs: FND-TT-001

EX-REBUY · Rebuy events after Reject All Derived

evidence chain · US after Reject All

EV-REBUY-REJECTNetwork6 POST requests and 6 events. Recommendations and widget config 9. cached.rebuyengine.com widget settings 7.https://rebuyengine.com/api/v2/analytics/event/bulk

EV-REBUY-IDBrowser Signaluuid was the same before and after the click. rsid equaled the _rsession cookie. shopify_cart_token was present on the events.

EV-COOKIE-RSESSIONCookie_rsession cookie name observed; value excluded. Rebuy rsid equaled this cookie on Reject run 1.

6 analytics/event/bulk requests and 6 events. uuid and rsid were unchanged across the click.

EV-REBUY-REJECT: 6 POST requests and 6 events. Recommendations and widget config 9. cached.rebuyengine.com widget settings 7. EV-REBUY-ID: uuid was the same before and after the click. rsid equaled the _rsession cookie. shopify_cart_token was present on the events. EV-COOKIE-RSESSION: _rsession cookie name observed; value excluded. Rebuy rsid equaled this cookie on Reject run 1.

Finding refs: FND-REBUY-001

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Appendix A · Evidence inventory

Runtime inventory

Vendors and minimized browser state

Inventory page 1 of 6. Printed 18 deterministic representative row(s) from 23 minimized collected row(s): 18 of 23 cookie row(s) and 0 of 0 storage-key row(s). The full inventory remains frozen in the report model; values remain excluded. Vendor roles require owner confirmation.

Detected vendors and pixels

Vendor	Category	Domain / signal	Scenarios	First seen
TikTok Derived	advertising	analytics.tiktok.com	US after Reject All, US after Accept All	Timing unavailable
Rebuy Derived	analytics	rebuyengine.comcached.rebuyengine.com	US after Reject All, US after Accept All	Timing unavailable
Impact Derived	advertising	trkapi.impact.com	US after Reject All, US after Accept All	Timing unavailable
Meta Derived	advertising	connect.facebook.netwww.facebook.com	US after Accept All	Timing unavailable

Cookie and storage names

Type	Attributes / lifetime	Domain, path, or origin	Scenario / stage
_rsession Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US before click, US after Reject All before action, after action
__kla_id Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US after Accept All after action
OptanonConsent Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US before click, US after Reject All, US after Accept All before action, after action

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Appendix A · Evidence inventory

Runtime inventory

Vendors and minimized browser state

Inventory page 2 of 6. Printed 18 deterministic representative row(s) from 23 minimized collected row(s): 18 of 23 cookie row(s) and 0 of 0 storage-key row(s). The full inventory remains frozen in the report model; values remain excluded. Vendor roles require owner confirmation.

Detected vendors and pixels

Vendor	Category	Domain / signal	Scenarios	First seen
Google Derived	advertising	Google Tag ManagerGA4Google AdsDoubleClickMerchant Center	US after Accept All	Timing unavailable
Klaviyo Derived	marketing	klaviyo.js	US after Accept All, US after Reject All	Timing unavailable
Microsoft Clarity Derived	session_replay	tag/collect	US after Accept All, US after Reject All	Timing unavailable

Cookie and storage names

Type	Attributes / lifetime	Domain, path, or origin	Scenario / stage
_ruid Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US before click, US after Reject All before action, after action
ssSessionId Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US after Reject All, US after Accept All after action
_ttp Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US before click, US after Reject All before action, after action

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Appendix A · Evidence inventory

Runtime inventory

Vendors and minimized browser state

Inventory page 3 of 6. Printed 18 deterministic representative row(s) from 23 minimized collected row(s): 18 of 23 cookie row(s) and 0 of 0 storage-key row(s). The full inventory remains frozen in the report model; values remain excluded. Vendor roles require owner confirmation.

Detected vendors and pixels

No vendor classification was produced from the observed runtime signals.

Cookie and storage names

Type	Attributes / lifetime	Domain, path, or origin	Scenario / stage
shopify_client_id Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US before click, US after Reject All before action, after action
_clck Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US after Accept All after action
_clsk Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US after Accept All after action

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Appendix A · Evidence inventory

Runtime inventory

Vendors and minimized browser state

Inventory page 4 of 6. Printed 18 deterministic representative row(s) from 23 minimized collected row(s): 18 of 23 cookie row(s) and 0 of 0 storage-key row(s). The full inventory remains frozen in the report model; values remain excluded. Vendor roles require owner confirmation.

Detected vendors and pixels

No vendor classification was produced from the observed runtime signals.

Cookie and storage names

Type	Attributes / lifetime	Domain, path, or origin	Scenario / stage
_ga_* Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US after Accept All after action
_ga Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US after Accept All after action
_gcl_au Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US after Accept All after action

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Appendix A · Evidence inventory

Runtime inventory

Vendors and minimized browser state

Inventory page 5 of 6. Printed 18 deterministic representative row(s) from 23 minimized collected row(s): 18 of 23 cookie row(s) and 0 of 0 storage-key row(s). The full inventory remains frozen in the report model; values remain excluded. Vendor roles require owner confirmation.

Detected vendors and pixels

No vendor classification was produced from the observed runtime signals.

Cookie and storage names

Type	Attributes / lifetime	Domain, path, or origin	Scenario / stage
_fbp Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US after Accept All after action
_shd_y Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US before click, US after Reject All before action, after action
_shopify_analytics Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US before click, US after Reject All before action, after action

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Appendix A · Evidence inventory

Runtime inventory

Vendors and minimized browser state

Inventory page 6 of 6. Printed 18 deterministic representative row(s) from 23 minimized collected row(s): 18 of 23 cookie row(s) and 0 of 0 storage-key row(s). The full inventory remains frozen in the report model; values remain excluded. Vendor roles require owner confirmation.

Detected vendors and pixels

No vendor classification was produced from the observed runtime signals.

Cookie and storage names

Type	Attributes / lifetime	Domain, path, or origin	Scenario / stage
_shopify_marketing Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US before click, US after Reject All before action, after action
_sp_id.* Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US before click, US after Reject All before action, after action
_sp_ses.* Observed
browser Cookie	unknown; S=unavailable; H=unavailable; SS=unavailable; unavailable; P=unavailable; unavailableB/unavailable; via unavailable@unavailable; Value excluded	store-j.example/	US before click, US after Reject All before action, after action

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Appendix A · Evidence inventory

Request and sequence evidence

Network, script, and activation timeline

Evidence page 1 of 1. Printed 4 deterministic network or script representative(s) from 4 minimized collected record(s); the full inventory remains frozen in the report model. Every elapsed value is measured from the start of its own named scenario.

Representative network and script records

Evidence	Type / timing	Sanitized URL	Scenario / stage
EV-TT-ACCEPT Observed	Network POST · Timing unavailable	https://analytics.tiktok.com/api/v2/shopify_pixel	US after Accept All after action
EV-REBUY-ACCEPT Observed	Network POST · Timing unavailable	https://rebuyengine.com/api/v2/analytics/event/bulk	US after Accept All after action
EV-TT-REJECT Observed	Network POST · Timing unavailable	https://analytics.tiktok.com/api/v2/shopify_pixel	US after Reject All after action
EV-REBUY-REJECT Observed	Network POST · Timing unavailable	https://rebuyengine.com/api/v2/analytics/event/bulk	US after Reject All after action

Per-scenario activation timeline

Scenario sequence	Elapsed from its start	Observed event / sanitized endpoint	Evidence
US before click Event 1	Timing unavailable	OneTrust groups before the click: C0001:1, C0002:0, C0003:0, C0004:0 Observed https://store-j.example/	EV-CMP-eu_fresh
US after Reject All Event 4	Timing unavailable	analytics.tiktok.com 8 requests after Reject All, including 4 POST /api/v2/shopify_pixel Observed https://analytics.tiktok.com/api/v2/shopify_pixel	EV-TT-REJECT
US after Reject All Event 5	Timing unavailable	Rebuy analytics/event/bulk 6 requests and 6 events after Reject All Observed https://rebuyengine.com/api/v2/analytics/event/bulk	EV-REBUY-REJECT
US after Reject All Event 6	Timing unavailable	trkapi.impact.com 4 requests after Reject All (Accept also 4) Observed https://trkapi.impact.com/	EV-IMPACT-REJECT

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Appendix B · Evidence IDs

Traceability

Referenced evidence index

All 23 evidence IDs referenced by report content are printed across index page 1 of 2.

EV-CMP-eu_freshObserved

Browser Signal · US before click · before action

OneTrust groups before the click

EV-CMP-eu_reject_allObserved

Browser Signal · US after Reject All · after action

OneTrust groups after Reject All

EV-CMP-eu_accept_allObserved

Browser Signal · US after Accept All · after action

OneTrust groups after Accept All

EV-TT-ACCEPTObserved

Network · US after Accept All · after action

analytics.tiktok.com after Accept

EV-TT-REJECTObserved

Network · US after Reject All · after action

analytics.tiktok.com after Reject All

EV-TT-IDObserved

Browser Signal · US after Reject All · after action

TikTok anonymous_id

EV-REBUY-ACCEPTObserved

Network · US after Accept All · after action

Rebuy analytics/event/bulk after Accept

EV-REBUY-REJECTObserved

Network · US after Reject All · after action

Rebuy analytics/event/bulk after Reject All

EV-REBUY-IDObserved

Browser Signal · US after Reject All · after action

Rebuy uuid and rsid

EV-IMPACT-ACCEPTObserved

Browser Signal · US after Accept All · after action

trkapi.impact.com after Accept

EV-IMPACT-REJECTObserved

Browser Signal · US after Reject All · after action

trkapi.impact.com after Reject All

EV-METAObserved

Browser Signal · US after Accept All · after action

Meta after Accept

EV-GOOGLEObserved

Browser Signal · US after Accept All · after action

Google after Accept

EV-KL-ACCEPTObserved

Browser Signal · US after Accept All · after action

Klaviyo after Accept

EV-KL-REJECTObserved

Browser Signal · US after Reject All · after action

Klaviyo after Reject All

EV-CL-ACCEPTObserved

Browser Signal · US after Accept All · after action

Microsoft Clarity after Accept

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Appendix B · Evidence IDs

Traceability

Referenced evidence index

All 23 evidence IDs referenced by report content are printed across index page 2 of 2.

EV-CL-REJECTObserved

Browser Signal · US after Reject All · after action

Microsoft Clarity after Reject All

EV-SHOP-REJECTObserved

Browser Signal · US after Reject All · after action

Shopify monorail after Reject All

EV-SHOP-ACCEPTObserved

Browser Signal · US after Accept All · after action

Shopify monorail after Accept All

EV-COOKIE-TTPObserved

Cookie · US after Reject All · after action

_ttp cookie name

EV-COOKIE-RSESSIONObserved

Cookie · US after Reject All · after action

_rsession cookie name

EV-COOKIE-SCIDObserved

Cookie · US after Reject All · after action

shopify_client_id cookie name

EV-RED-01Observed

Browser Signal · US before click · in observation

Delivery redaction state

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Appendix C · Lineage

Document control

Lineage, reproducibility, and report boundary

Versions and hashes establish which collection, redaction, catalog, rule, and template inputs produced this rendering.

Component	Version	Hash / reference	Source
Audit framework	store-j-us-2026-10-15	sha256:store-j-20261015	Static
Collector	chrome-net-export	sha256:store-j-capture-20261015	Static
Redaction profile	delivery-minimum-v3.1	sha256:sample-redaction-37fa	Static
Rule pack	runtime-rules-2026.10	sha256:sample-rules-a81e	Static
Vendor catalog	vendor-catalog-2026.10	sha256:sample-catalog-4c22	Static

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Appendix C · Lineage

Document control

Lineage, reproducibility, and report boundary

Versions and hashes establish which collection, redaction, catalog, rule, and template inputs produced this rendering.

Component	Version	Hash / reference	Source
Report template	report-v3.1	sha256:sample-template-31aa	Static
Redaction policy	query-values-bodies-headers-inputs-excluded	sha256:sample-policy-e920	Static
Build provenance	ConsentProbe deterministic report builder	completed_audit; LLM used: false	Derived

ConsentProbe · Report CP-SAMPLE-STORE-J-20261015Appendix C · Lineage

Document control

Lineage, reproducibility, and report boundary

Versions and hashes establish which collection, redaction, catalog, rule, and template inputs produced this rendering.

Snapshot state

completed_audit; report ID derived

CP-SAMPLE-STORE-J-20261015

Data boundary

Cookie values, storage values, query values, form field names, labels, placeholders, selectors, option text, action paths and action queries, discovered link text, public-notice page text, purpose descriptions, unmatched notice terms, sensitive-data inspected values and hashes, input values, request bodies, request headers, advanced-persistence file contents and metadata, bucket configuration, Shared Storage keys, values, worklet data, URL candidates, arguments and results, browser and network-endpoint IP addresses, IP hashes, raw CDP events, complete initiator call stacks, and raw runtime responses are excluded from this report surface.

Technical report boundary Static

Anonymized capture of Store J, a Shopify store, on 2026-10-15 from a US connection. Counts are observed requests. Paid audits also run EU and California scenarios. 付费审计另跑欧盟和加州场景。 This is not legal advice.

Vendor