HeadFlash report
The Cookie Loophole: what “I do not consent” really switches off
AI-generated audio (Readerr) - may contain errors
The “NIE WYRAŻAM ZGODY” (“I DO NOT CONSENT”) button switches off consent. It does not switch off “legitimate interest”, the second door through which companies walk in without asking. On Onet, a major Polish news portal, 810 companies still have the green light after you refuse. On Gazeta.pl there are 246 of them before any click, and after refusing… the same 246.
I checked this on 50 big websites visible from Poland, in September 2026. You can download the full report below without giving your email, and the data is public.
What the “I do not consent” button switches off
The banners of big websites run on the advertising industry’s IAB TCF standard. After every click the site records your decision and passes it on to its advertising partners. That record holds two lists of companies: those with consent and those with legitimate interest.
Refusing clears only the first one. On six news sites the legitimate interest list after “no” is exactly the same as after “I accept”. The same companies, to the last one:
| Site | Companies on legitimate interest after refusal |
|---|---|
| onet.pl | 810 |
| rmf24.pl | 371 |
| wp.pl | 367 |
| wyborcza.pl | 336 |
| gazeta.pl | 246 |
| natemat.pl | 61 |
Two doors: “I do not consent” closes only consent. Simplified diagram; automated counter, 4 September 2026. Graphic generated by AI, checked by me.
On Onet your “no” switched off roughly one company in five out of 1,013. You can of course object to the rest. In the same settings, eight screens further down.
To be fair: ten sites do it cleanly. After a refusal on OLX, Otomoto, TVN24, MSN, Lidl, Wykop, Rzeczpospolita, Allegro and TVP Info, not a single company is left in the record. On naTemat only after a full refusal.
In the report: where the objection is on each site, what it costs, and why on Onet I ran into something I did not see anywhere else.
Do you have to accept cookies?
No. But “no” costs different amounts depending on where you are. “Yes” always costs one click: on every site where my counter measured accepting, in all three runs.
Every one of the ten global giants in my sample that shows a banner has a refusal on the first screen. YouTube: “Odrzuć wszystko” (“Reject all”). Facebook: “Odrzuć opcjonalne pliki cookie” (“Reject optional cookies”). LinkedIn: “Odrzuć” (“Reject”). Polish shops, banks and services: 8 out of 11.
YouTube: “Odrzuć wszystko” (“Reject all”) next to “Zaakceptuj wszystko” (“Accept all”), on the first screen. Browser pass, 2 September 2026.
Polish news sites? I measured ten. One has a refusal on the first screen, rp.pl. And it sits in a scrolling frame, four screens down. On Onet a full refusal takes three clicks and eight screens of scrolling. On rmf24.pl and natemat.pl, four clicks.
rp.pl: you see “Ustawienia zaawansowane” (“Advanced settings”) and “Akceptuję” (“I accept”), the refusal button sits at the bottom of a scrolling frame of text. Automated counter, 4 September 2026.
On wp.pl refusal comes with a price list. The path ends on a screen saying “Odrzucam zgody i płacę od 5,75 do 7,50 zł / miesiąc” (“I refuse consents and pay from PLN 5.75 to PLN 7.50 a month”). Credit to WP for one thing: the price is written out plainly.
WP after refusing: “I refuse consents and pay from PLN 5.75 to PLN 7.50 a month”. Browser pass, 2 September 2026.
It can be simpler. gov.pl and the European Commission’s website have a one-click refusal.
In the report: the number of clicks and screens on each of the 50 sites, and buttons that sound like a way into the article but are consent.
Legitimate interest in cookies: what it means
GDPR knows six legal bases for processing data. Consent is only one of them. Another one is “legitimate interest” (Article 6(1)(f)).
The difference is simple. A company has to get consent from you. Legitimate interest it assesses first by itself. At most, you can lodge an objection, if you know where to look for it.
The TCF standard splits what companies do with data into eleven purposes. It allows legitimate interest for six of them, among others for measuring ads and choosing ads based on limited data. Who is on Onet’s list? According to the IAB registry, among others Google, Amazon, Microsoft, TikTok, LinkedIn, Criteo and RTB House.
The European Data Protection Board, in its draft guidelines of October 2024, writes that for storing and reading information on the device in direct marketing, consent will likely be the appropriate legal basis. Part of what I measured is hard to square with that reading. Judging legal compliance, though, is the job of authorities and courts, not mine.
In the report: all six purposes in plain language, how I know who has the green light, and why this is a side entrance.
Where traffic goes, before you click and after you refuse
The record of your decision is a declaration. Network traffic shows what the browser actually did. I count conservatively: 39 sites where refusal succeeded in all three runs, advertising and analytics domains only.
- On 24 of 39 sites traffic goes to advertising or analytics companies before you click anything. The banner is still asking, and the traffic is already flowing.
- On 26 of 39, after a full refusal, traffic still goes to such companies.
- Google’s advertising domains receive traffic after refusal on 25 of 39.
Traffic after a full refusal: on how many of 39 sites the browser still connects to these companies’ domains. Automated counter, 4 September 2026, three runs. Graphic generated by AI, checked by me.
On 13 sites there is no such traffic after refusal at all, including YouTube, Facebook, Allegro, mBank and gov.pl. The European Commission’s website is the only site where the counter saw analytics cookies set before the decision disappear after a refusal.
A caveat without which this section would be dishonest: a request to a domain alone does not prove that personal data is processed. I show where the traffic went. What was done with it, I don’t know.
In the report: the record holders, company names, and the site where the record is clean while traffic goes to 13 companies.
How to withdraw cookie consent
GDPR says it in one sentence: “It shall be as easy to withdraw as to give consent” (Article 7(3)). Giving it costs one click. I checked the way back, without logging in.
| Site | Way into the consent settings |
|---|---|
| Żabka | icon visible right away, 0 screens |
| gov.pl | footer, just under 4 screens |
| ikea.com | about 14 screens down |
| gazeta.pl | about 23 screens |
| interia.pl | about 24 screens |
| tvn24.pl | about 31 screens |
| msn.com | the page has no bottom (infinite scroll) |
MSN: change your choice “in the ‘Zarządzaj preferencjami’ (‘Manage preferences’) area at the bottom of this page”. Browser pass, 2 September 2026.
MSN promises a link “at the bottom of this page” in its banner. The home page is an endless stream: the further you scroll, the longer it gets. Wykop points to an icon at the bottom left that isn’t there.
In the report: who promises a place in the banner that doesn’t exist, and where it works properly.
Set it once, in the browser: Article 88b and who doesn’t want it
On 19 November 2025 the European Commission proposed Article 88b GDPR, in the Digital Omnibus package. You set your consent, refusal or objection once, the browser passes it on to websites, and websites would have to respect it. The media are exempt from that duty.
Media industry organisations still wrote to ministers on 5 June 2026 that the provision must be “rejected and removed”. In the EU Council compromise text of 18 June 2026 Article 88b is deleted in full. On 10 September the Kill the Cookie Banner coalition (including noyb, EDRi, BEUC and EFF) asked for it to be restored. This is the state as of 14 September 2026.
Why fight a provision that doesn’t apply to you? I leave my interpretation, with numbers, to the report.
My view: a binding browser signal is a good idea. The cookie banner doesn’t ask for consent. It manufactures it.
In the report: a “who benefits” table (publishers, IAB, Google, Meta, banks, banner vendors) and the five strongest arguments of the banner’s defenders, with an answer to each.
How I measured
Two instruments. First, 42 sites in the browser, on 2 and 3 September 2026: an AI agent (Claude in Chrome) clicked and took notes, and I supervised every step. Then an automated counter: all 50 sites, three times each, on 4 September 2026, reading the record of the decision, cookies and network traffic.
Ordinary Chrome in Polish, no blockers, no login, through a Polish internet provider, desktop only. On 13 September Grok, xAI’s agent, independently measured the sites on my list without knowing my results. Nowhere did it come out the opposite way, sometimes differently, because sites change.
I worked a lot with AI on this report and I say so openly: Claude models, the browser agent, Grok’s check. The infographics were generated by AI, and I checked each one against the data. The screenshots are real. I sign it.
In the report: the chapter “Method, and where I may be wrong”, with the mistakes I found along the way.
Download the report and the data
The report has ten chapters, two appendices with results site by site, and footnotes for every claim. The measurement data on GitHub contains the results (CSV and JSON), the records of both instruments, screenshots and the list of domains with my categorisation, with a description and a column glossary in Polish and English.
Licence: text and results CC BY 4.0. Screenshots and banner quotes belong to the sites and are reproduced to document the measurement.
About the author
My name is Marcin Rybak. Security and privacy are a passion for me, not a job. I run HeadFlash, a newsletter and podcast on AI, privacy and security. I made this report with my own money and in my own time. Nobody paid me for it.
Since I’m writing about banners: this page sets no cookies and shows no banner.
Questions, comments and corrections are welcome. I read every one.