Deny Cookies

The banner on later.com offers Accept all, and beside it More choices. My browser extension read that as a site with no way to refuse, and marked it red, the mark for a site that tracks you whatever you click. Red is there to stop a green tick telling me a comforting lie, and here it told me a frightening one about a site that does offer a choice.

I built Deny Cookies to turn cookie pop-ups down for me. Where a site has a reject button it clicks it, and where there isn't one it opens the settings panel, switches off every category the site doesn't need to run and saves. Then it shows me a receipt of what it did.

It doesn't hide the banner and call that a refusal. It doesn't click Accept.

A hidden banner and a refused one look the same from the outside, and that gap is what I built this against.

That one site beat me over and over. Each time I'd got the reason wrong.

At first I read it as a site with no reject on offer. Wrong. More choices sat in none of the phrases I look for. To my extension the banner read as Accept and nothing else.

Then I figured the panel used a switch my extension couldn't work, and wrote it up as work to build. Also wrong. The tool I checked with was simpler than the extension itself, so it saw nothing where the extension had already found the panel.

I found five plain checkboxes inside. One greyed out, four already ticked, and a button reading Confirm. Ordinary stuff.

And no extension can refuse it. The consent software that site runs only takes a click it can tell came from a real finger, and my extension can't fake one. It clicks Confirm, the box closes and nothing's stored. Banner gone. Consent untouched.

So a banner going away doesn't count as proof any more. What counts? Before it saves, my extension takes a snapshot of what the site has stored on my machine, and that snapshot has to move. It keeps names and sizes, and leaves the contents alone (reading those would make my extension the thing I don't trust).

That panel taught me one more thing. Four clicks in a row left every checkbox showing unticked, and three of the categories were still on the books as consented. Now it re-reads every box before it saves.

My best proof came from the same digging. On accuweather.com the Reject All inside the settings box only flips switches, and it's the button at the bottom that stores the answer.

I wrote a rule that gets that order right, then ran the live site twice, once with the extension and once without. Without it the site's own log records targeted advertising as granted by default. With it: denied, from the reject button, logged as a real choice.

On that same win my receipt claims more than it should. It prints a fixed list of what's denied. On accuweather analytics stays granted through a successful refusal: the site parks it behind a dead switch and there's no opt-out at all.

Reading that list out of the site's own record is the fix. I haven't written it.

Pre-launch. It installs by hand. I'm the only one running it. It doesn't connect to anything else I've built.

If you find a site where my receipt claims more or less than the site logged, please let me know: that's the report I want most.