What happens if you never accept or decline cookies?

Short answer: usually nothing breaks, and on a site that follows the European and UK rules, ignoring the banner counts as “no”. That site should only use the cookies it strictly needs to work, such as the one that keeps your cart or login, until you make a choice. The catch is that your choice is itself stored in a cookie, so if you never make one, the banner keeps coming back. And in practice, study after study has found that many sites start tracking before you answer, or even after you say no. In Australia there’s no specific law that requires a cookie banner at all, which is why some Australian sites don’t show one.

This is general information, not legal advice. If you run a website and aren’t sure what applies to you, talk to a privacy adviser.

The short version

Why the banner is there at all

A cookie is a small file a website saves in your browser. Some are essential: without them the site couldn’t remember you’re logged in or what’s in your cart. Others count your visits for statistics, or follow you from site to site so ads can be aimed at you.

The banners come mostly from Europe. The EU’s ePrivacy rules (Article 5(3) of the ePrivacy Directive) say a site needs your consent before it stores anything on your device or reads it back, unless that storage is strictly necessary for something you asked for. The GDPR then sets what “consent” means. The UK has the same model in its own law (PECR). So any site that has European or UK visitors, or uses a website template built for them, tends to show a banner, wherever it’s based.

Ignoring it isn’t saying yes

Under the GDPR, consent has to be a clear affirmative act. Recital 32 says plainly that silence, pre-ticked boxes or inactivity don’t count. The regulators have spelled out what that means for banners:

• Scrolling isn’t consent. The European Data Protection Board’s consent guidelines (05/2020, paragraphs 84 and 86) say scrolling or swiping through a page doesn’t count as agreeing, and neither does just carrying on using the site.
• Pre-ticked boxes aren’t consent. The EU’s top court decided that in the Planet49 case in October 2019.
• “By continuing you agree” isn’t consent. The UK’s Information Commissioner’s Office (ICO) says that if people ignore the banner and carry on into the site, setting non-essential cookies isn’t valid consent, and that rejecting has to be as easy as accepting.
• Reject should sit next to Accept. In January 2023 a taskforce of European regulators reported that most of them expect a “reject all” option, or something equivalent, on the first screen of the banner, not buried a click deeper.

What about the X? This is where regulators differ. France’s CNIL, the most active on cookies, says carrying on browsing should be read as refusal, that closing the banner counts as a refusal too, and that a site using the X this way should say so on the banner. Not every country spells it out like that, and plenty of sites simply hide the banner without saving anything. If you want to be certain, click Reject all.

Regulators have backed this with real fines. The CNIL fined Google €150 million and Facebook €60 million, announced in January 2022, because refusing cookies took more clicks than accepting them. In September 2025 it fined Google another €325 million and the retailer SHEIN €150 million in separate cookie and advertising cases.

Why it keeps coming back

A website has no memory of you except what’s saved in your browser, and that includes your cookie answer. Click Accept or Reject and the site stores your choice, usually in a small cookie of its own (a strictly necessary one, so it needs no consent). The CNIL suggests remembering it for about six months.

Never answer, and there’s nothing to store. So the banner pops up again on the next page, or the next visit. The same thing happens when you:

• clear your browser’s cookies or site data,
• use a private or incognito window, which forgets everything when you close it,
• switch to another browser or device, since your answer lives in one browser on one device.

That’s the price of ignoring the banner on a well-run site: no tracking, but a pop-up that keeps asking.

What actually happens: plenty of sites don’t wait

The rules say “nothing until you choose”. Researchers who measure real websites keep finding something else:

• A 2020 study of banners using the advertising industry’s standard consent system found sites that recorded a “yes” before the visitor had chosen anything, and some that stored consent even after the visitor opted out (Matte, Bielova & Santos).
• The same year, a study of 680 popular UK sites using the most common consent tools found only 11.8% met the minimum legal requirements, and that taking “reject” off the first screen raised the number of people who accepted by about 22 to 23 percentage points (Nouwens et al.).
• A 2024 study of about 97,000 sites popular in Europe found that 65.4% of those offering a reject option were likely still collecting data after the visitor rejected (Bouhoula et al.).

These are measurements of potential breaches, not court findings, but the pattern is consistent: on many sites, trackers load the moment the page opens, whatever you do with the banner.

There’s also a grey zone. Google’s Consent Mode, used on many sites with Google Analytics or Google Ads, has two settings. In the basic one, Google’s tags don’t load at all until you answer, so ignoring the banner sends Google nothing. In the advanced one, the tags load straight away in a “denied” state: they don’t write analytics or ad cookies, but they still send Google small cookieless pings (the time, your browser type, the page you came from and your consent state), which Google uses to estimate the visits and sales it can’t see. So on those sites, ignoring the banner still sends some information to Google, just not a cookie that identifies your browser.

And in Australia?

Australia doesn’t have a cookie-consent law like Europe’s. The Privacy Act 1988 and its Australian Privacy Principles don’t require a banner, and we found no requirement for one from the regulator, the Office of the Australian Information Commissioner (OAIC). That doesn’t mean cookies are a free-for-all:

• Cookie data can be personal information when it can identify you, for example when it’s tied to an account or combined with other details. Simple page counts generally aren’t (APP Guidelines, Chapter B).
• Tracking pixels are allowed, with conditions. The OAIC’s November 2024 guidance says collect the minimum, explain the pixels in your privacy policy, offer an opt-out for direct marketing, and get express consent where sensitive information such as health is involved.
• Health sites have already been caught. In June 2026 the Privacy Commissioner found that tracking pixels on the Medmate and Monash IVF websites had collected sensitive information without consent.
• Many small businesses are exempt. Businesses with annual turnover of $3 million or less generally aren’t covered by the Privacy Act, but there are exceptions, including health service providers and businesses that buy or sell personal information (OAIC).

So why do so many Australian sites show a banner anyway? Mostly because they have overseas visitors, or because the website platform or consent tool they use was built for European rules and switches the banner on by default.

What we do on this site: digitalgreenhouse.com.au doesn’t show a cookie banner. We use Google Analytics, which sets its own cookies. Our own code doesn’t set cookies; it only uses your browser’s local storage for things like your light or dark theme choice. Our privacy policy lists what’s set and how to opt out.

Better ways to deal with banners

1. Click Reject all when it’s on the first screen. It’s the one click that saves a “no”, so the banner goes away and stays away on that browser.
2. Use a browser that limits tracking by default. Safari has blocked third-party cookies by default since 2020, and Firefox’s Total Cookie Protection keeps each site’s cookies in a separate jar so they can’t follow you around. Chrome is the exception: in April 2025 Google said it would keep third-party cookies, and in October 2025 it retired most of its “Privacy Sandbox” replacements. You can still block third-party cookies yourself in Chrome’s settings.
3. Let a tool answer for you, carefully. Consent-O-Matic, from Aarhus University, fills in banners using preferences you set once, and works in Chrome, Firefox, Edge and Safari. The Brave browser blocks cookie notices by default. Firefox briefly offered an automatic “reject” feature in some regions, but has since withdrawn it.
4. Know the difference between hiding and refusing. Extensions such as “I Still Don’t Care About Cookies” make banners disappear, but hiding a banner isn’t the same as saying no. A 2024 study found banner-clicking extensions increased tracking unless they were set to reject all.

In California, a browser setting called Global Privacy Control counts as a legal opt-out request: the first public settlement under the state’s consumer privacy law, a US$1.2 million deal with Sephora in 2022, was partly for ignoring it. It has no legal force in Australia, but turning it on costs nothing.

Can a cookie banner be dangerous?

A real cookie banner is safe to click. The risk is fakes. Scammers who break into websites sometimes put up pop-ups dressed as a cookie notice or a “verify you’re human” check, and there have been cases of an invisible ad hidden under a cookie notice, and of a hacked consent script used to spread malware. The rule of thumb is simple: a genuine cookie banner never asks you to download anything, paste a command, or type a password or card number. If one does, close the tab.

If you run a website

If you’re an Australian business deciding what your own banner should do, a few points carry across:

• Know what your site actually loads. Analytics, ad pixels, chat widgets, embedded videos and maps can all set cookies. Your privacy policy has to describe them accurately, banner or not.
• Take health and other sensitive information seriously. If your site is about health, ad pixels on booking or symptom pages are where Australian regulators have already acted.
• If European or UK visitors matter to you, use a consent tool that loads nothing non-essential until the visitor chooses, puts Reject next to Accept, and treats “ignored” as “no”.
• Don’t show a banner that does nothing. A pop-up that asks but loads the trackers anyway is the worst of both: it annoys visitors and misleads them.

We can check what your site loads and set it up properly. Get in touch.

What’s changing

• EU. In November 2025 the European Commission proposed, as part of its “Digital Omnibus” package, one-click refusal, a rule that sites can’t ask again for months after you say no, some new exemptions such as basic audience measurement, and respect for consent signals set in your browser. EU governments agreed their position in October 2026, dropping the browser-signal part. The European Parliament hasn’t settled its view yet, so nothing changes before 2027 at the earliest.
• UK. The Data (Use and Access) Act 2025 lets UK sites set some low-risk cookies without asking, such as statistics used only to improve the site (with a clear way to object) and cookies for the site’s appearance or features. Advertising cookies still need consent.
• Australia. A draft of the next round of Privacy Act reforms, released for consultation in August 2026, proposes that collecting and using personal information must be “fair and reasonable”, and adds new rights. It’s still a draft and it doesn’t include a cookie-banner rule.

Common questions

Sources

All checked 03/11/2026.

European and UK law and regulators

• General Data Protection Regulation (EU) 2016/679, Recital 32 and Article 4(11). eur-lex.europa.eu
• ePrivacy Directive 2002/58/EC, Article 5(3). eur-lex.europa.eu
• Court of Justice of the EU, Planet49, C-673/17, press release (01/10/2019). curia.europa.eu
• European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, paragraphs 84–86. edpb.europa.eu
• European Data Protection Board, Report of the work undertaken by the Cookie Banner Taskforce (17/01/2023). edpb.europa.eu
• CNIL, Cookies et autres traceurs : comment mettre mon site web en conformité ? and the consolidated cookie recommendation (January 2026). cnil.fr, cnil.fr (PDF)
• CNIL, closure of the injunction issued against Google (2023), covering the €150 million fine of 31/12/2021. cnil.fr
• CNIL, closure of the injunction against Facebook (2022), covering the €60 million fine. cnil.fr
• CNIL, fines against Google and SHEIN (announced 03/09/2025). cnil.fr
• UK ICO, Guide to PECR: cookies and similar technologies. ico.org.uk
• UK ICO, Guidance on the use of storage and access technologies: what are the exceptions? ico.org.uk
• European Commission, Digital Omnibus proposal, COM(2025) 837 (19/11/2025), and Council of the EU text ST 9773/2026 REV 1. consilium.europa.eu; summary by Heuking (23/10/2026). heuking.de

Australia

• OAIC, Australian Privacy Principles guidelines, Chapter B: Key concepts. oaic.gov.au
• OAIC, Tracking pixels and privacy obligations (November 2024). oaic.gov.au
• OAIC, Privacy Commissioner finds privacy breaches in third-party tracking pixel investigation (24/06/2026). oaic.gov.au
• OAIC, Small business. oaic.gov.au
• Attorney-General’s Department, exposure draft, Privacy Amendment (Personal Data Protection) Bill 2026 (31/08/2026). ag.gov.au

Research

• C. Matte, N. Bielova, C. Santos, Do Cookie Banners Respect my Choice?, IEEE Symposium on Security and Privacy 2020. arxiv.org
• M. Nouwens et al., Dark Patterns after the GDPR, CHI 2020. arxiv.org
• A. Bouhoula et al., Automated Large-Scale Analysis of Cookie Notice Compliance, USENIX Security 2024. usenix.org
• N. Demir, T. Urban et al., study of cookie-banner browser extensions, PoPETs 2024. petsymposium.org

Browsers, tools and vendors

• Google, Consent mode overview. developers.google.com
• Google, Next steps for Privacy Sandbox and tracking protections in Chrome (April 2025) and Update on plans for Privacy Sandbox technologies (October 2025). privacysandbox.google.com, privacysandbox.google.com
• WebKit, Full Third-Party Cookie Blocking and More (March 2020). webkit.org
• Mozilla, Firefox rolls out Total Cookie Protection by default to all users worldwide (June 2022). mozilla.org
• Mozilla Support, Cookie banner reduction (feature no longer available). mozilla.org
• Brave, Blocking cookie notices (June 2023). brave.com
• Consent-O-Matic, CAVI, Aarhus University. github.com
• California Attorney General, Sephora settlement (24/08/2022). oag.ca.gov
• SecurityWeek, clickjacking campaign hidden under a cookie notice. securityweek.com; Sucuri, cookie consent script used to distribute malware (2018). sucuri.net