Overview
This check confirms that non-essential tags stop sending data once a visitor who previously accepted cookies withdraws consent. ObservePoint runs an Audit as an opted-out visitor and verifies that targeting, advertising, and tracking tags send zero requests on every scanned page.
Non-essential means any tag outside the Strictly Necessary consent category, such as analytics, advertising, social, and personalization. Strictly Necessary tags, like the consent banner itself, may still fire.
Note: This guide is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding your organization's specific GDPR obligations.
Why it is important
This check proves that tracking actually stops when a visitor who previously accepted cookies changes their mind and opts out.
It is different from the pre-consent check. The pre-consent check covers a visitor who has not touched the banner yet. This check covers a visitor who said yes, then said no. A site can pass the first and still fail the second: the banner records the opt-out, but the tags that were already running never hear about it and keep sending data.
The legal basis is GDPR Article 7(3). People have the right to withdraw consent at any time, and withdrawing must be as easy as giving consent. A withdrawal that the website does not honor in practice does not meet that standard.
Implementation
Run an Audit that accepts cookies and then withdraws consent, and check that only the tags you approved still fire.
In Consent Categories, create an approved list for the Strictly Necessary category. Pull in a recent Audit and select only the tags, cookies, and request domains you consider strictly necessary, such as your consent banner. If you use OneTrust, you can import its categories instead.
Create an Audit for your European site and choose a European location, such as Frankfurt.
In the Pre-Audit Actions tab, add the privacyoptin action with your site URL so the Audit accepts cookies first. Then add the privacyoptout action with the same URL so it withdraws consent. If your banner is not supported, add an action set that clicks Accept, then reopens the banner and clicks Reject.
Assign the Strictly Necessary consent category to the Audit, leave third-party cookie blocking off, and run the Audit on a schedule.
Open the pre-built ObservePoint report for Pages with Unapproved Tags. Each tag listed fired after consent was withdrawn and is not on your approved list.
Note: Review the approved list whenever you add, remove, or change a tag. Edit the list, then reprocess the Audit so the report reflects the change. If a tag appears in the report and you decide it is strictly necessary, add it to the list. If not, it is a leak to fix.
Remediation
If tags keep firing after opt-out, work through these common causes for each tag in the report:
Connect each tag to its consent category. A frequent root cause is a tag that checks consent only when the page loads, so it never notices a later withdrawal. In your tag manager, add a condition so the tag fires only while its category is allowed, and make sure it responds to the banner's consent-changed event.
Stop tags that are already running. Some tags keep working until the page reloads. Ask your cookie banner or tag manager admin to reload the page on withdrawal, or to send the vendor's own consent-update or opt-out signal.
Make the choice stick on every page. The opt-out must be saved and read on each later page. Check that the banner loads before other tags, so no tag fires before it has read the visitor's saved choice.
Find tags outside the tag manager. Pixels placed directly in page code often skip consent logic entirely. Work with engineering to remove them, or wrap them in a consent check.
Re-run and lock it in. Run the Audit again after each fix and confirm the report is empty. Then update Consent Categories in ObservePoint for the corrected tag, so a future release cannot bring the problem back unnoticed.
Conclusion
A consent banner is only as good as what happens after someone clicks "reject" or withdraws consent. Testing the opt-out path on its own, in addition to the pre-consent check, shows whether your privacy promise matches what your site actually does.
Running this Audit on a schedule turns a one-time fix into lasting evidence that withdrawing consent works on every page, for every visitor.