Consentinel research · October 26, 2026
Who keeps tracking after visitors opt out.
We tested 313 US e-commerce brands whose trackers kept running after a visitor said no. Meta ran on 47% of them. Most were caught by the browser opt-out signal every browser has to offer from January 1, 2027.
313
brands with trackers firing after an opt-out
86%
caught with Global Privacy Control on (270 brands). The other 43 kept tracking after a reject click.
17
critical findings on the median brand
US e-commerce brands where Consentinel found trackers still firing after a visitor opted out, by clicking reject or sending Global Privacy Control. Sites that passed aren't in this data, so these figures describe brands that leak, not all brands.
Which trackers ignore the opt-out
Share of the 313 brands where each vendor was among the tags still firing. A brand usually has several, so the shares add up to more than 100%.
What we found
- The biggest ad platforms lead. Meta (47%), Google Ads (45%) and TikTok (36%) were the most common trackers still running after an opt-out. These are the tags that matter most for ad targeting, and the ones regulators and plaintiffs name.
- Most had no reject button to click. On 86% of the brands there was no reject control we could use, so we tested the Global Privacy Control signal instead. That's how most US visitors will opt out once Chrome, Edge and Safari have to offer it.
- Marketing tools count too. Klaviyo (28%) and Attentive (12%) power signup forms, so stores treat them as part of the site. They also track browsing for email and SMS marketing.
- A working banner isn't enough. On many of these sites the consent platform worked. Tags wired outside it kept running anyway, the same gap behind California's $1.55 million Healthline settlement. More on that
By category
Number of brands in the data by category. This reflects which brands we tested, not which categories leak more.
How we tested
- Clean browsers, real opt-outs. Each homepage was loaded in fresh Chromium browsers: once clicking the consent banner's reject button where one existed, once accepting, and once with Global Privacy Control on and no click.
- Two scans had to agree. A vendor counts only if it fired after the opt-out in two separate scans and never waited for consent in either.
- Fixed signatures, no guessing. Requests and cookies were matched against a fixed library of ad and analytics vendors. Store platforms and consent tools are left out.
- What this data can't say. Brands that passed aren't in it, so it doesn't show what share of all stores leak, and brands aren't named. Scans ran through October 26, 2026.
Free to cite and republish with a link (CC BY 4.0). Cite as: Consentinel, "Who keeps tracking after visitors opt out" (October 26, 2026), https://www.getconsentinel.com/research/opt-out-report-2026
Is your store in the next report?
Run the same test on your site. Free, about a minute, and it lists every tag that ran after the opt-out, with the request that proves it.
Free. No account. Results in about a minute.