Overview
This check extends the single-page opt-out validation into a full, multi-step consumer journey (landing page through category, product, and cart pages, for example) confirming the opt-out state persists through every subsequent step rather than resetting or leaking partway through.
Note: This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization's specific CCPA/CPRA compliance obligations
Why is it important
An opt-out is not a per-page signal; once selected, CCPA requires it to persist across the entire session and across subsequent visits from the same browser. A CMP can pass a single-page Reject-All test and still leak on a later page in the journey if, for example, a single-page-application route change re-initializes a tag before checking the stored consent state, or a third-party checkout iframe doesn't inherit the parent page's consent context.
Implementation
Build a Journey that opts out via the CMP as its first step, then navigates a representative multi-step flow (landing, category, product, and cart/checkout pages).
Create a Rule with a WHEN condition matching your advertising/sharing tag accounts (by tag ID or a regex on the request/tag name) and an EXPECT assertion that none of them fire, then attach it via update_journey_rules at the action level to every step after the opt-out (landing, category, product, and cart) not just journey-wide, since a journey-level rule would average across steps and could mask a leak that appears on only one of them.
Run the Journey and pull get_journey_run_rule_results for the per-step pass/fail verdict, then use analyze_journey_tags on the same run to see exactly which tag reappeared and on which step if a rule failed.
Remediation
When a later journey step reintroduces a blocked tag, check whether the page uses client-side routing that bypasses the tag manager's normal page-load listener — SPA route changes often require an explicit consent re-check on each virtual pageview rather than relying on the original page-load consent gate. For third-party iframes or embedded checkout flows, confirm the embedded component reads the parent's consent signal (via postMessage, a shared cookie or the CMP vendor's cross-domain consent API) rather than defaulting to an ungated state. Re-run the full Journey after each fix and confirm every per-step Rule now passes in get_journey_run_rule_results, then schedule the Journey to run on your daily critical-page cadence given how easily a single route or checkout change can reintroduce the leak.
Conclusion
Single-page opt-out checks catch the most obvious violations, but only a full-journey Journey test catches the routing and third-party-iframe leaks that are invisible from a single page load. This is the check that proves the opt-out actually holds for a real user, not just a test page.