Skip to content

Evidence and diagnosis

Why Google Analytics can send requests after cookie rejection

A Google Analytics request after cookie rejection doesn't, by itself, prove the banner is broken. Advanced Consent Mode can send measurements without cookies while analytics storage is denied. To diagnose the result, inspect consent state, cookie behavior, and request timing together.

Repeat that inspection at the visitor location where the request appeared. A regional default or tag configuration may differ from the one your own browser received.

Try it yourselfIllustrative example · no live audit

Interpret the same request with different evidence

All three examples include an analytics request after rejection. Switch the supporting evidence to see how the diagnosis changes.

Supporting evidence
Network evidence
Analytics collection request after rejection
Consent state
analytics_storage: denied
Cookie evidence
No analytics cookie observed
Investigation detail
Manual debugger confirms a measurement without cookies

Consistent with the example's intended advanced Consent Mode setup.

Invented evidence for one fresh UK rejection path. The cookieless example includes an additional manual debugger inspection. CookieTrail's request capture omits bodies, headers, and query values and cannot establish that detail on its own.

Identify the intended Consent Mode setup

Consent Mode is Google's mechanism for adjusting tag behavior to a visitor's choices. In a basic implementation, Google tags remain blocked when consent isn't granted. In an advanced implementation, tags load with consent defaults and can send cookieless measurements under denied storage consent.

Ask the person responsible for tracking which implementation the site intends to use in each region. A request can fit an advanced setup and still conflict with a team's intended basic setup.

Inspect the choice and event order

In a fresh browser, record the default before any choice, then reject and read the saved choice. Use Tag Assistant, Google's tag debugging tool, to inspect analytics_storage and the advertising signals ad_storage, ad_user_data, and ad_personalization. A rejected category in the banner may not have reached every tag.

Trace the consent event order and compare it with the request's timestamp. If a tag ran before the default was applied, the final denied state won't establish what the earlier event used.

Separate requests from cookie writes

  • A measured request identifies network activity. Its destination alone doesn't establish whether it carried identifiers or used cookies.
  • A known analytics cookie appearing in a clean session while analytics storage is denied warrants investigation. Retain the name, domain, and timing; inspect which script wrote it.
  • A cookie remaining after earlier acceptance needs a withdrawal test. Presence alone doesn't establish a new write after rejection.
  • Unreadable consent state or missing cookie capture leaves the diagnosis incomplete, even when a request was captured.

Repeat the diagnostic check by country

Use the same URL, fresh rejection path, and observation window at each relevant location. Verify the network country and record the region decision your consent platform exposes. Compare the default, saved choice, cookies, and requests; don't infer the second country's behavior from the first.

You can collect this evidence in a regional browser and debugger. Repeating it means preserving the routing, clean-session setup, and capture window. CookieTrail saves regional consent, cookie, and selected request evidence so your developer can investigate and rerun the affected check.

Request capture excludes bodies, headers, and query values, so it can't certify that a request was cookieless. Use your debugger and tag configuration for those details. Server-side tracking and unrecognized endpoints need separate inspection.