Decline Means Decline: When Your Opt-Out Doesn't Stop Tracking
A cookie banner makes a promise. When a visitor clicks "Decline," tracking is supposed to stop. Two 2026 lawsuits — against Toyota and the NFL — allege it didn't, and a wave of CCPA enforcement now punishes the same gap. Here's why a decline button that doesn't actually stop trackers has become one of the clearest privacy risks a website can carry, and how to close it.
A "Decline" button only protects you if it's technically enforced — if clicking it actually stops non-essential third-party trackers from loading and transmitting. When the banner governs cookies but trackers keep firing anyway (through fingerprinting, session recorders, or tags nobody wired to the banner), you have the exact gap that two 2026 lawsuits target and that California regulators are actively sweeping for.
The fix isn't a better banner — it's enforcement: block non-essential trackers until genuine consent, stop them the moment a visitor opts out (cookie-based and cookieless alike), and log the decision as proof. This is general information, not legal advice.
What this guide covers
Clicking "Decline" on a cookie banner feels like closing a door. You're telling the site: don't track me. The entire architecture of consent banners is built on the premise that this click means something — that behind it, the site changes its behavior. The uncomfortable finding of 2026's litigation and enforcement is that, on a lot of sites, the click changes nothing at all.
The promise a cookie banner makes
Every consent banner is, at heart, a promise. It presents a choice — usually "Accept" and "Decline," or "Accept All" and "Reject All" — and the implicit representation is that the choice is honored. A visitor who declines has been told, in effect, that the non-essential tracking won't happen. That representation is what gives the banner its legal and ethical weight; it's also what makes a broken opt-out so dangerous. A site with no banner at all makes no promise. A site with a banner that ignores the choice makes a promise and breaks it — and a broken promise about privacy is exactly what plaintiffs and regulators are built to punish.
Here's the mechanism most teams miss. A cookie banner, by default, governs cookies. Decline, and the cookie isn't set. But a growing share of tracking doesn't rely on cookies at all: browser fingerprinting reads the signals your browser emits just by loading a page, and session recorders capture what you do on the page directly. Neither needs a cookie, so neither is necessarily stopped when you decline the cookies. The banner does its narrow job — cookies — while a second layer of tracking runs underneath it, untouched. That gap is the whole story of the two cases below.
Toyota: allegedly tracked after clicking "decline"
In July 2026, a proposed class action was filed against Toyota in Los Angeles County Superior Court. The lead plaintiff, Brittany Conner, alleges she visited Toyota.com several times and each time "elected to reject all third-party cookies" — and that the site tracked her anyway.[1] According to the complaint, Toyota.com used fingerprinting to keep identifying and following visitors who had declined, assembling device and browsing details into a profile distinctive enough to recognize a person across visits and devices, then sharing that data with third parties for cross-device advertising.
The plaintiff frames it as an "outrageous privacy 'bait and switch' scheme" — a banner that offered a choice while the tracking continued regardless. The legal theory runs through the California Invasion of Privacy Act (CIPA), whose trap-and-trace provision (Penal Code §638.51) plaintiffs have repurposed for website tracking, with statutory damages commonly cited at $5,000 per violation under Penal Code §637.2.[1] The case is newly filed and unproven — Toyota has not answered and nothing has been decided — but the theory is the point: it targets the exact moment a consent banner is supposed to protect the visitor and, allegedly, didn't.
We've written a full breakdown of the case, the fingerprinting mechanism, and why declining cookies doesn't stop it, in our Conner v. Toyota deep-dive.
A cookie is a file stored on the device — you can block or delete it, which is why banners are built around cookies. A fingerprint stores nothing; it's assembled from signals the browser exposes on every page load. Decline the cookies and the fingerprinting script, if it's already running, keeps working. A banner that only manages cookies can't close that gap — which is precisely what the Toyota complaint alleges happened.
The NFL: 186 trackers alleged to run after opt-out
If Toyota is the clean illustration, the NFL case is the detailed one. Filed July 6, 2026 in Alameda County Superior Court (Kimmons v. NFL Enterprises LLC, No. 26CV197596), it's built on forensic testing of NFL.com — and the numbers are what make it land.[2] According to the complaint, the site deployed 182 third-party trackers before a visitor could make any privacy choice: 24 cookies, four canvas fingerprinting scripts, and one session recorder, with data flowing to major advertising networks.
Then the number that gives the case its edge: the complaint alleges that even after a user opts out, the site continued to run 186 third-party trackers.[2] Opting out didn't reduce the tracking — by the complaint's count, it slightly increased. That's the "opt-out that doesn't opt you out" allegation in its starkest form, and it targets the gap between what a consent banner promises and what a website actually does.
The NFL complaint also raises the highest-risk configuration in this whole area: a session recorder that allegedly captured not just mouse movements and navigation but keystrokes typed into input fields — the order and timing of individual keys, whether or not the visitor ever hit submit.[2] Capturing what someone types is capturing the contents of a communication, which is what CIPA's §631 wiretapping provision protects, and it's a much harder claim to dismiss than a routing-data theory. Our Kimmons v. NFL deep-dive walks through all of it.
Both suits are newly filed and unproven. Toyota and the NFL will contest the technical allegations, the reach of a 1967 statute over modern tools, and whether the plaintiffs suffered a cognizable injury — and CIPA outcomes remain genuinely split. The value here isn't "these companies are liable." It's that the alleged fact pattern — tracking that survives a visitor's opt-out — is common, measurable from the outside, and now attached to statutory damages.
Why opt-outs quietly fail
The striking thing about both cases is how ordinary the underlying failure is. Neither complaint describes an exotic hack or a decision to defy the law. They describe the default behavior of a typical modern web stack. Here's how a "decline" button ends up meaning nothing, in three completely mundane steps:
- Trackers fire on page load. In most tag-manager setups, tags fire the instant the page loads — before the banner even appears, let alone before anyone clicks it. So the "pre-consent" tracking is baked in by default.
- The banner only sweeps up cookies. Many consent tools, on "decline," clear or block cookies. But session recorders and fingerprinting scripts don't depend on cookies, so they sail straight through an opt-out that was only ever wired to cookie storage.
- Nobody re-checks after changes. A marketing team adds a new pixel through the tag manager to measure a campaign. It fires site-wide. No one goes back to confirm the banner suppresses it on decline. The gap opens silently and stays open.
None of that requires bad intent. It's the path of least resistance for a busy team — which is exactly why it's so widespread, and why a plaintiff firm can find it on a famous website just by loading the page and clicking "decline." The mismatch between the banner's promise and the page's behavior is observable from the outside, with no inside knowledge at all.
The regulatory side: California is actively sweeping for this
Litigation isn't the only pressure. The same broken-opt-out gap is now squarely in regulators' sights, and here the rules are explicit rather than theoretical. Under the CCPA (as amended by the CPRA), businesses must honor opt-out preference signals like Global Privacy Control (GPC) — a machine-readable signal a browser sends to say "opt me out of sale/sharing."[3] A tracker that keeps sending data to an ad vendor after a GPC signal is, in the regulators' view, ignoring a valid opt-out.
Two 2026 developments sharpen this considerably:
- Mandatory confirmation. As of January 1, 2026, revised CCPA regulations (§7025(c)(6)) changed "may" to "must": a business must now show that it processed a consumer's opt-out signal — a visible "Opt-Out Preference Signal Honored" indicator, not silent processing.[4] Silent handling no longer suffices.
- Coordinated enforcement. California, Colorado, and Connecticut announced a joint investigative sweep targeting businesses that fail to honor GPC opt-outs.[3] This isn't a hypothetical risk; regulators are testing banners directly.
And the enforcement has teeth. California's first major action referenced Sephora's alleged failure to honor a GPC opt-out and ended in a $1.2 million settlement; more recent opt-out and dark-pattern matters include Tractor Supply ($1.35 million) and Sling TV ($530,000).[3][5] The common thread across all of them is the same gap the Toyota and NFL suits allege: a consumer signaled "no," and the tracking allegedly continued.
CCPA's 2026 rules also require symmetric choice: opting out can't be harder than opting in, and reject controls must be as prominent as accept controls.[5] So the risk isn't only "did the decline work?" — it's also "was declining as easy as accepting?" A one-click "Accept All" paired with a buried, multi-step opt-out is itself a documented enforcement target.
Does your "Decline" button actually stop the tracking?
Run a free scan to see every third-party tracker on your site — the ones firing before consent, and the ones still running after opt-out. It's the same check a plaintiff firm or regulator would run, and it takes about 10 seconds.
Why "but we offered a choice" backfires
There's a counterintuitive twist that catches operators off guard. You might assume that having a consent banner is a defense — proof you gave visitors a choice. In the broken-opt-out scenario, it's the opposite. A banner that visibly offers "Decline" while trackers keep firing doesn't demonstrate consent; it documents the gap between what you promised and what you did.
Consider how each theory uses the banner against the operator:
- CIPA / wiretap claims. The most common defense to a tracking claim is "the visitor consented." But if the visitor affirmatively declined and the tracking continued, that defense inverts — the record shows the opposite of consent. The Toyota "bait and switch" framing is built precisely on this.
- CCPA / regulatory claims. The banner is the representation. If it says "Reject All" and the site keeps sharing data with vendors, the regulator has a clean before-and-after: the consumer's expressed choice, and the site's contrary behavior.
In both worlds, a decline button that doesn't work is worse than no button — because it converts an ordinary tracking setup into a demonstrable broken promise. The banner stops being a shield and becomes Exhibit A.
"We have a consent banner, so we're covered" is the wrong conclusion. A banner only protects you if declining it actually stops the tracking — all of it, including the cookieless layer. An unenforced banner gives you the liability of a promise with none of the protection of keeping it.
How to make "decline" actually work
The good news is that the fix is concrete and technical, not a matter of legal interpretation. It's the same posture whether your pressure is a CIPA suit, a CCPA sweep, or simply doing right by your visitors. Four things close the gap:
1. Block non-essential trackers until genuine consent
Nothing non-essential — cookie-based or cookieless — should load or transmit before a visitor affirmatively agrees. This closes the "fired before any choice" gap (the 182-tracker problem in the NFL complaint). The key word is block, not "set a flag": the tracker shouldn't run at all until consent, because a tag that fires and then apologizes has already sent the data.
2. Enforce opt-out on everything, including cookieless tools
When a visitor declines — or sends a GPC signal — every non-essential tracker must stop, not just the cookie-based ones. That means fingerprinting scripts and session recorders too. This is the specific failure the Toyota (fingerprinting) and NFL (186-after-opt-out) complaints describe, and the one GPC enforcement targets.
3. Keep session replay off sensitive fields
Session recorders that capture keystrokes in input fields create the §631 "contents of a communication" exposure — the hardest kind to dismiss. Keep session replay away from login, checkout, intake, and search fields, or disable keystroke capture entirely.
4. Log the decision as proof — and show it
Under the 2026 CCPA rules you must be able to demonstrate the opt-out was honored, not just claim it.[4] Keep a timestamped record of each consent decision, and surface the confirmation the rules now require. That log is also what answers a "bait and switch" allegation before it becomes a settlement — it's the evidence that your decline button did its job.
This is exactly the posture ConsentPixel is built to deliver: it blocks third-party trackers at the browser level until a visitor genuinely consents, honors the opt-out across cookie-based and cookieless tools alike, continuously verifies what actually fires, and logs each decision as evidence — so "Decline" means what it says. It's a prevention-first consent layer, not legal advice; for your specific exposure, work with qualified counsel.
The bottom line
A consent banner is a promise, and in 2026 the cost of breaking that promise stopped being hypothetical. Toyota and the NFL are being sued on the allegation that their sites tracked people who opted out; California, Colorado, and Connecticut are sweeping for the same failure and fining companies that ignore opt-out signals. The gap in every one of these stories is identical: a visitor said no, and the tracking continued.
The reassuring part is that this is a solved problem — technically. You don't need to predict how CIPA case law resolves or how aggressive the next enforcement sweep is. You need your decline button to work: block non-essential trackers until consent, stop all of them on opt-out, and keep the proof. Decline has to mean decline — and when it does, the entire category of risk this article describes simply doesn't apply to you.
The cheapest first step is to find out where you stand. Load your own site, click "decline," and watch what still fires — or let a scan do it in ten seconds.
Find out if your opt-out actually works
Scan your site free to see every third-party tracker that fires — before consent and after opt-out — the exact gap these lawsuits and enforcement sweeps target. Then close it with a consent layer that blocks trackers until visitors genuinely agree.
Scan your site free →No account needed · then start a 14-day trial from $8.99/domain/mo · or browse the CIPA lawsuit tracker · information, not legal advice
We build prevention-first consent tooling: blocking third-party trackers until visitors genuinely consent, honoring opt-out and GPC signals across cookie-based and cookieless tools, continuously verifying what fires, and logging each decision as evidence. This article is information, not legal advice; privacy law is fact-specific and evolving, so verify your position with qualified counsel. ConsentPixel — Privacy · Verified is not a law firm.
Frequently asked questions
Is it illegal to track someone after they click "decline"?
It can expose you to serious legal and regulatory risk. Two 2026 lawsuits — against Toyota and the NFL — allege exactly this, brought under the California Invasion of Privacy Act (CIPA), with statutory damages commonly cited at $5,000 per violation under Penal Code §637.2. Separately, under the CCPA a business must honor opt-out preference signals like Global Privacy Control, and California, Colorado, and Connecticut have run a joint enforcement sweep targeting businesses that don't. Whether any specific setup is unlawful depends on the facts and is for a court or regulator to decide, but tracking that continues after a visitor opts out is the precise pattern both plaintiffs and regulators are pursuing. This is general information, not legal advice.
Why doesn't declining cookies stop all tracking?
Because not all tracking uses cookies. A cookie banner, by default, governs cookies — decline, and the cookie isn't set. But browser fingerprinting identifies you from signals your browser emits on every page load, and session recorders capture your activity directly; neither depends on a cookie. So a banner wired only to cookie storage can leave fingerprinting and session-replay scripts running after you decline. Closing that gap requires enforcing the opt-out on every non-essential tracker, not just the cookie-based ones — which is the failure the Toyota and NFL complaints describe.
What did the Toyota and NFL lawsuits actually claim?
In Conner v. Toyota, the plaintiff alleges Toyota.com used fingerprinting to keep tracking visitors who had rejected cookies, sharing their data for cross-device advertising — an "outrageous privacy bait and switch." In Kimmons v. NFL Enterprises, forensic testing cited in the complaint alleges NFL.com ran 182 third-party trackers before any consent choice and 186 after opt-out, including canvas fingerprinting and a session recorder that captured keystrokes. Both are newly filed and unproven; the defendants have not been found liable. They matter because the alleged fact pattern — tracking that survives a visitor's opt-out — is common and measurable. This is general information, not legal advice.
What is Global Privacy Control (GPC) and do I have to honor it?
GPC is a machine-readable signal sent by a user's browser (or an extension) indicating they want to opt out of the sale or sharing of their personal information. Under the CCPA/CPRA, businesses subject to the law must treat a GPC signal as a valid opt-out request — not set tracking that constitutes "sale" or "sharing" when it's present. As of January 1, 2026, revised CCPA regulations also require businesses to show that they've processed the signal, with a visible confirmation rather than silent handling. California, Colorado, and Connecticut have announced coordinated enforcement targeting businesses that ignore these signals. Whether your business is subject to a given law is fact-specific; consult qualified counsel.
Doesn't having a consent banner protect me?
Only if the banner is enforced. A banner that offers "Decline" while trackers keep firing can actually work against you: it documents that you represented a choice and then didn't honor it. In a CIPA claim, the usual "the visitor consented" defense inverts when the visitor affirmatively declined. In a CCPA matter, the banner is the representation a regulator compares against your site's actual behavior. An unenforced banner gives you the liability of a broken promise without the protection of a kept one — so the banner has to be backed by technical enforcement, not just displayed.
How do I check whether my own opt-out works?
Test it from the visitor's side. Load your site, click "Decline" (or "Reject All") on your banner, and check whether any non-essential third-party trackers are still firing — paying special attention to cookieless tools like fingerprinting and session recorders, which often ignore a cookie banner entirely. A free scan does this in about ten seconds and lists every tracker that loads and when, including before consent and after opt-out. If anything non-essential still transmits after you decline, that's the gap these lawsuits and enforcement sweeps target, and the fix is to block those trackers until consent and enforce the opt-out across all of them.