How do I fix “Tracking continues after consent is withdrawn”?

Make the consent tool’s “withdraw” or “reject” action in the settings stop every non-essential tag, just like the first-layer reject. In Google Tag Manager, use consent-aware triggers so tags stop firing when consent changes, not only on the first page view. Delete or stop reading tracking cookies you control when consent is withdrawn.

Tracking after cookie consent is withdrawn

Tracking continues after consent is withdrawn

Short answer: Yes. Under the GDPR people can withdraw consent at any time, and from that moment non-essential cookies and tags have to stop. France’s CNIL fined Orange €50 million and American Express €1.5 million in part because cookies kept being read after consent was withdrawn. A “Reject” in the cookie settings must work as well as the first-layer one.

Consent & tracking · Critical riskLast reviewed 27 September 2026Automated checks and general information, not legal advice.

Do trackers have to stop when a visitor withdraws their cookie consent?

We accepted cookies, then changed our mind through the site’s own cookie settings. Advertising or analytics requests kept firing after the withdrawal.

People can withdraw consent at any time, and from then on tracking must stop. France’s CNIL fined Orange and American Express partly because cookies kept being read after consent was withdrawn.

Check it yourself in two minutes

Open your site in a private window and click “Accept all”.
Use your “Cookie settings” link or consent icon, and choose “Reject all”.
Open DevTools → Network and reload the page.
Look for your analytics and ad vendors. After withdrawing, nothing non-essential should load.

How to fix it

Make the consent tool’s “withdraw” or “reject” action in the settings stop every non-essential tag, just like the first-layer reject.
In Google Tag Manager, use consent-aware triggers so tags stop firing when consent changes, not only on the first page view.
Delete or stop reading tracking cookies you control when consent is withdrawn.

How untick detects it

A fresh visitor accepts cookies, reloads, then uses the site’s own way back: a “Cookie settings” link or a consent tool’s floating icon. We click “Reject all” there (or switch every optional category off and save), reload, and record every request. Trackers that still fire are listed with their timing.

Every finding comes with screenshots, the evidence we collected and a fix for your setup. How a scan works.

Questions people ask

Why would tracking continue after withdrawal?

Usually because tags only check consent on the first page view, a pixel is hard-coded in the theme, or the consent tool’s “save” in the settings doesn’t send an update to your tags. Tag Manager tags without consent-aware triggers are a common cause.

Do I have to delete the cookies already set?

At minimum, stop reading them. Clearing the first-party analytics and ad cookies you control is the safer choice: both CNIL decisions cited cookies that were still read after withdrawal.