Should You Accept Cookies? What Actually Happens When You Click Accept
Every website asks. Most people click "Accept All" without thinking. But what actually happens when you accept cookies — and should you?
This guide explains what cookies do in plain English, which types matter for your privacy, and when you should accept or reject.
What Are Website Cookies?
Cookies are small text files that websites save on your device. They store information about your visit — your login status, what's in your shopping cart, your language preference, or a unique ID that identifies you across visits.
They're called "cookies" because of an old programming term ("magic cookie" — a small piece of data passed between programs). Nothing to do with baked goods.
The Four Types of Cookies
Not all cookies are the same. Understanding the categories helps you make informed choices:
1. Strictly Necessary Cookies
What they do: Keep the site working — login sessions, shopping carts, security tokens, load balancers.
Who sets them: The website itself (first-party).
Can you reject them? No — and you don't need to. These are exempt from consent requirements because the site literally cannot function without them.
Example: When you add an item to your cart on an e-commerce site and navigate to another page, a cookie remembers your cart contents. Without it, the cart would be empty every time you click.
2. Analytics Cookies
What they do: Track how you use the website — which pages you visit, how long you stay, where you click, how you arrived.
Who sets them: Usually Google Analytics (the most common), but also tools like Hotjar, Mixpanel, or Matomo.
Privacy impact: Moderate. Google Analytics data is aggregated but can be linked to your Google account. The website owner sees aggregate behavior patterns. Google also uses this data across its advertising network.
Example: Google Analytics sets a _ga cookie that persists for 2 years. It assigns you a unique ID and records every page you visit on that site.
3. Advertising Cookies
What they do: Track you across multiple websites to build a profile of your interests, then show you targeted ads.
Who sets them: Third-party ad networks — Meta (Facebook Pixel), Google (Google Ads), TikTok, LinkedIn, Twitter, and hundreds of ad exchanges.
Privacy impact: High. These cookies follow you from site to site. Visit a shoe store, and shoe ads appear on completely unrelated websites. The ad network knows which sites you visit, what products you look at, and often your approximate location.
Example: The Meta Pixel (_fbp cookie) tracks your browsing on any site that has it installed, then uses that data to show you ads on Facebook and Instagram. It persists for 90 days.
4. Functional Cookies
What they do: Remember your preferences — language choice, dark mode setting, video player preferences, chat widget state.
Who sets them: The website itself or embedded services like YouTube, live chat providers.
Privacy impact: Low. These mostly affect your experience on that specific site.
Example: A language preference cookie so the site shows you content in German without asking every visit.
What Happens When You Click "Accept All"
When you click Accept All, you're giving permission for all four categories. Here's what typically fires within milliseconds:
- Google Analytics starts recording your session — pages viewed, time on site, scroll depth, clicks
- Meta Pixel fires and sends your page view to Facebook's servers, linking it to your Facebook profile if you're logged in
- Google Ads remarketing tags you for retargeting — you may see ads for this site on other websites
- Various ad exchange pixels (The Trade Desk, Criteo, etc.) add you to advertising audiences
- Hotjar or similar may record your mouse movements and scrolling behavior
- Social media widgets (Facebook Like buttons, Twitter embeds) start tracking your presence
All of this happens in the background. You don't see any of it.
We scan hundreds of websites and the average site loads 15-30 tracking requests the moment you accept cookies.
What Happens When You Click "Reject All"
On a properly implemented site:
- Only strictly necessary cookies remain active
- No tracking scripts fire
- No data is sent to Google, Meta, or ad networks
- The site works normally — just without personalized ads and analytics
The catch: Many websites don't implement rejection properly. We regularly find sites where clicking "Reject" doesn't actually stop tracking cookies from firing. The banner is cosmetic — it asks for consent but doesn't enforce it.
If you're curious whether a specific website respects your rejection, you can scan it for free.
When to Accept Cookies
Accept when:
- You trust the site and don't mind being tracked on it
- You want personalized features like product recommendations
- The site is one you use daily and you've reviewed their cookie policy
- You're on a shopping site and want to see relevant deals
When to Reject Cookies
Reject when:
- You're browsing casually and don't want to be tracked
- You're on a news or content site that you'll visit once
- You're researching sensitive topics (health, finance, legal)
- You value privacy and don't want advertising profiles built about you
- You're using a shared or public computer
The Site Will Still Work
This is the most important thing to understand: rejecting cookies almost never breaks a website. Strictly necessary cookies (the ones that actually make the site work) are exempt from consent — they're always active.
The only things you lose by rejecting:
- Personalized advertising (you'll see generic ads instead)
- Some "remember me" features across sessions
- Potentially less relevant product recommendations
Everything else — navigation, content, checkout, login — works the same.
How to Manage Cookies Better
Browser-Level Controls
Instead of clicking Accept/Reject on every site:
- Firefox Enhanced Tracking Protection — blocks third-party tracking cookies by default
- Safari Intelligent Tracking Prevention — limits cookie lifespans and blocks cross-site tracking
- Brave browser — blocks ads and trackers by default
- Global Privacy Control (GPC) — a browser signal that tells websites to stop selling/sharing your data. Legally binding under CCPA
Check What a Site Actually Does
Before trusting a cookie banner, you can verify what's actually happening:
- Scan the website — Tag Leak checks what fires before and after consent
- Browser DevTools — Open DevTools > Application > Cookies to see what's stored
- Network tab — Watch for requests to tracking domains (facebook.com, google-analytics.com) before you click Accept
Why Websites Want You to Accept
Website owners want you to accept cookies because:
- Advertising revenue — Publishers earn money from targeted ads, which require tracking cookies
- Analytics data — Understanding how users behave helps improve the website
- Remarketing — E-commerce sites retarget visitors who didn't purchase
- Marketing attribution — Businesses track which ads and campaigns drive sales
None of these require your data for the site to function. They're business interests, not technical necessities.
The Bottom Line
- Strictly necessary cookies are fine — accept them (you have no choice anyway)
- Analytics cookies are low risk but do track you — your call
- Advertising cookies build profiles about you across the web — reject unless you want targeted ads
- Rejecting won't break the site — it just removes tracking and personalization
- Most banners have a "Reject All" option — use it if you prefer privacy
If you run a website and want to see what your visitors experience, scan your site to see exactly what cookies fire before and after consent.
Related Reading
- What Is Cookie Compliance? — what websites are required to do
- Cookie Consent Examples — good and bad banner designs
- Compliance Index — see how websites handle cookies