43% of Tracking Cookies Survive After You Click Reject All

Ghostwritten is the research community's word for a specific kind of cookie: it is stored under the website's own name, but a third-party script host appears in the code path that wrote it. Think of _fbp from the Meta pixel or _ga from Google Analytics. First-party in form, third-party in function. These are the cookies consent banners exist to control.

The survival number is not even the strangest part. 97.5% of the cookies that survived Reject were already in the browser before the visitor touched the banner. Clicking Reject did not remove them because most consent setups are not built to remove anything. They are built to prevent what happens next.

This post walks through what we measured, why rejected cookies stay, and what a fair reading looks like. Everything here is a behavioral measurement of what pages did, not a legal verdict on any site.

What we measured, exactly

Between May 5 and July 30, 2026, our compliance scanner completed scans of 1,505 websites from a European vantage point. 949 of them showed a consent banner that loaded and offered a Reject option the scanner could actually click. Those 949 are the measured set, using each site's most recent scan.

On each visit the scanner clicked Reject All, finished the page load, and then examined the browser's cookie jar. For every non-essential cookie stored on the site's own domain where a third-party script host appears in the write stack, we recorded two things: was it still present at the end of the visit, and did it exist before the consent choice was made. That produced 6,964 cookie observations across 791 sites.

Two notes on rigor. Every headline figure in this post was derived twice, independently, from the same raw scan data, including a from-scratch rebuild of the domain grouping, and the numbers matched to the digit. And sites running ConsentStack are excluded from every figure here: only 7 appear in the corpus, which is too small a sample to publish either way.

The headline number, and its context

43.4% of ghostwritten tracking cookies survived Reject All. Widen the lens to every non-essential cookie we observed and the picture barely moves: 44.2% persisted. Only 288 of the 863 sites where we could measure it, about one in three, ended the visit with every non-essential cookie cleared.

Survival is not evenly distributed. It tracks the script host that appears in the cookie's write path:

The spread is the story: survival runs from under 3% to over 97% depending on which script host shows up in the write path. Cookies tied to the biggest names, Google Tag Manager, Google Analytics, the Meta pixel and TikTok, survived roughly a third of the time each.

Why rejected cookies survive: they were already there

97.5% of the surviving cookies share one property: they existed before the visitor answered the banner. 97.3% were set during the initial page load. The sequence is mundane. A tag fires as the page loads, the cookie lands in the jar, the visitor reads the banner for a few seconds and clicks Reject All, and the consent setup blocks things from that moment forward. The cookie that landed in the first second stays.

Consent tools draw a fence at the moment of choice. Prevention stops scripts from running until consent exists, and done properly the tracking cookie is never written at all. Removal, going back and clearing what was already stored, is a different capability. Some setups in our data do clear pre-existing cookies at Reject time, and on those sites survivors are rare. On most sites, nothing removes what landed before the click, and by then the fence is standing behind the cookie.

The standard industry answer is an assertion

This question already has a page-1 answer, and it is worth quoting. TermsFeed, in an article that ranks for exactly this question, says CMPs generally do not delete cookies when users revoke consent, and that instead they ensure cookies stop collecting. Secure Privacy, itself a consent platform, tells users that cookies set by third-party vendors in previous sessions will remain in the browser's storage even after consent is declined.

Notice what both answers have in common: they describe the surviving cookie as dormant, and neither cites a measurement. Our contribution is not the observation that cookies survive; the industry already concedes that. It is the number. How often, on how many sites, from which script hosts, and the finding that survival is the norm for some of the most common tags on the web.

Dormant is also doing a lot of work in those answers. A cookie that stays in the browser stays readable the next time the same code runs, and a persistent identifier is precisely the thing privacy law treats as storage. We measured presence, not downstream use, so we will not claim the surviving cookies were read. But unmeasured is not the same as fine.

Rejection is not revocation

The closest academic study, arXiv 2411.15414, measured 200 websites and found that 57.5% do not delete cookies after consent revocation. Revocation is the rare path: the visitor accepts first, then later changes their mind. Our measurement is initial rejection, the visitor's first and only choice, which is the common case. It also runs at a different scale: 949 sites and 6,964 cookie observations against 200 sites, from a live scanning system that re-runs continuously rather than a one-off crawl. The two results rhyme, and they describe different moments in the consent lifecycle. Ours is the moment most visitors actually live through.

How ConsentStack handles it

ConsentStack sits in the prevention family, and we want to be precise about what that means, because precision is the entire point of this post. Our SDK neutralizes tracking script tags before the browser executes them, so a blocked tracker never runs and its cookie is never written. There is nothing to remove at Reject time because nothing was stored. You can read exactly how that works in our script blocking guide.

What ConsentStack does not do is delete tracker cookies that were already in the browser before it was installed, or that were written outside the script blocking paths it controls. We are saying that in public, on purpose. The honest version of this product category is measurable prevention, not a promise to sweep the jar.

This measurement comes from the same scan corpus behind our state of cookie compliance census and the per-platform follow-up. The corpus refreshes continuously, and we will re-run this measurement as it grows.