Hiding a cookie banner is not consent — what actually happens when you click "Reject all"
Most banner blockers do the same thing: they hide the banner with CSS and call it a day. The banner is gone from your screen — but nothing was ever told to the site. The tracking scripts you were shown a choice about? They load anyway. You got the appearance of consent without the mechanism. I spent the last few months building a browser extension that takes the other approach: instead of hiding…
Banner blockers often conceal the consent banner using CSS, but this does not constitute genuine consent. The tracking scripts in question continue to load despite the seemingly given consent. Over the past few months, I developed a browser extension that adopts a different approach. Rather than hiding banners, the extension clicks the genuine Reject all button or communicates with the consent platform's API, if available.
Through this, I have gained insights into how consent operates behind the scenes, and it is crucial to understand that hiding and rejecting are legally distinct actions.
When a real reject button is clicked, various outcomes occur based on the consent management platform (CMP) employed by the site. A consent cookie gets set with a clear denial status. The site's tag manager scrutinizes this cookie on every subsequent page visit and inhibits non-essential scripts. A JavaScript API may also be invoked — most prominent CMPs possess their own API, which triggers an event listened to by third-party scripts. In certain configurations, a server-side endpoint is accessed to register the opt-out.
In essence, rejecting is a state alteration observable by the site and every script adhering to the framework. Conversely, hiding the banner is merely a visual modification discernible solely to the user. The complexity arises with the "long tail" — entities beyond the major consent platforms. These encompass regional CMPs, self-hosted script snippets, and sites crafting their own banners.
To address this, the extension incorporates a text-matching fallback capable of identifying reject-style buttons in 35 languages. Additionally, it disseminates the Global Privacy Control (GPC) signal on each webpage, as several US state statutes now treat it as a binding opt-out.
It is important to note that merely blocking everything is impractical and does not align with user intent. A genuine consent framework affords users a choice, and the courteous default is in line with privacy legislation: non-essential tracking should be disabled, while the site should remain functional with no data transmitted.
The extension I created is entirely local, storing only the hostname and user's choice per site, and it can be erased at any moment. CookieGuard is accessible as a Chrome and Edge extension. The free version permits 40 successful rejections per week with all detection features enabled; the Pro version ($19.9 lifetime or $11.99/year) removes the cap and includes per-site defaults.
It is also slated for launch on Product Hunt. If you have ever questioned whether your "Reject all" click truly made a difference, this extension offers an intriguing exploration. I am readily available to address any inquiries regarding consent-platform intricacies in the comments.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
