The site asks for consent and registers the refusal, but the tags that the refusal should stop do not sit behind the gate. The screen confirms the choice; the wire shows the same traffic as before.
Why it is a separate entry
A refusal that changes nothing makes the right to withhold and to withdraw consent a formality. The visitor believes they have decided something and they have not.
How it arises
tags hardcoded rather than gated
consent tool blocks cookies but not the loading of scripts or containers
banner is informational and wired to nothing
Not to be confused with
If nothing was asked before the tag fired, that is Tracking before consent. If no refusal option is offered at all, that is No refusal option.
How to establish it
Set comparison: the third-party hosts contacted after an explicitly registered refusal are equal to, or a superset of, those contacted without any interaction. There is no third reading.
method differentialQoD 97
Requirements on the measurement
two separate captures, each with a fresh profile
read the consent state back after clicking refuse; an unregistered click measures a failed click, not a hollow refusal
identical conditions otherwise: same page, same window, same country
What would refute it
automatedThe refusal was not registered.The most important one: it turns a finding into a measurement error.finding falls
automatedThe banner does block, but later than the capture window.finding falls
not from the captureThe surviving requests are strictly necessary for a service the visitor asked for.A judgement per host. Never excluded automatically; an entry may be cited with this untested as long as that is stated.reclassify
Where this plugs into existing processes
The one question that surfaces itShow me two captures, one where the visitor refused, and tell me the difference.
In a DPIA, verify this
Verify that refusing changes the outgoing traffic, rather than accepting that a consent tool is installed.
As a procurement clause
On delivery, the set of third-party hosts contacted after refusal is empty of measurement hosts, demonstrated by two captures.
With a complaint, hand over
Two HARs, no-interaction and refused, plus the read-back consent state proving the refusal registered.
Reproduction
METHOD.md · by hand · no dedicated reproduction exists yet; follow the general method and the indicator above
repro/web/check.mjs · script · the run reports DPE-2026-0002 as present, with the detail behind it
Third parties that can confirm it: urlscan.io, webbkoll
Legal framing
eu-gdpr-6-1-a
nl-tw-11-7a
Case law
cjeu-planet49
Objections, and the answer
“The banner is there, so the visitor has a choice.”
The choice exists on screen and not on the wire. Consent requires an active act of the user; an act without effect is not such an act.
“This is analytics, which needs no consent.”
Then the banner should not have listed it, and there would be no refusal to honour. A party cannot both treat something as consent-bound and ignore the refusal.
What this does not establish
harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
unlawfulness; that is for a supervisory authority or a court
intent; a fault is usually a build decision, not a plan
absence: not finding it in one capture is not evidence that it is not there
DPE Catalogue. DPE-2026-0002: Refusal without effect. Schema 2.0, entry status active. Retrieved from https://totaledigitalewaarborging.nl/register/DPE-2026-0002
Measurement
When you publish a finding, cite the method version alongside the entry: “DPE-2026-0002, established under DPE Measurement Method 1.0”
Identifiers are permanent and are never
reused. An entry that is deprecated keeps its number and its address, with the reason attached, because
references to it exist elsewhere.