What happens when a shopper says no.
Airlock ran its five-state consent protocol against 22 live Shopify storefronts. These are the results, with the method published and the failures counted.
Which vendors continued after an explicit refusal
Counted as the number of measured storefronts where that vendor sent at least one request while a refusal was in force and verified.
The names at the top are not rogue operators. They are the default marketing stack of a mid-market Shopify store, installed deliberately, doing what they were configured to do. That is the finding: this is not an outlier problem, it is the normal configuration.
Store by store
Every store below is a public storefront, measured from a US vantage point. Requests were counted only in states the storefront confirmed by readback.
| Storefront | Requests under refusal | Vendors | Post-withdrawal | |
|---|---|---|---|---|
| trueclassictees.com | 75 | 9 | — | |
| drsquatch.com | 57 | 14 | — | the banner gated nothing |
| rothys.com | 57 | 8 | — | the banner gated nothing |
| magicspoon.com | 51 | 9 | 2 | |
| brooklinen.com | 33 | 8 | 3 | |
| liquiddeath.com | 32 | 2 | — | the banner gated nothing |
| peakdesign.com | 31 | 5 | 1 | |
| outdoorvoices.com | 29 | 6 | — | |
| allbirds.com | 20 | 4 | — | |
| untuckit.com | 12 | 5 | — | |
| chubbiesshorts.com | 2 | 1 | 2 | the banner gated nothing |
Three things this does not say
- It does not say these stores are breaking the law. Compliance depends on configuration, geo-gating and documentation. This is a measurement of behaviour, not a legal conclusion, and the distinction is not a hedge — it is the difference between a finding and an accusation.
- It does not generalise beyond a US vantage. Consent platforms geolocate by IP. A European visitor may be shown different behaviour entirely, and every one of these numbers would need re-measuring from there.
- It does not blame the consent platforms. Several of these findings are structurally unreachable by any client-side consent manager, because Shopify renders the tag server-side before any JavaScript exists to gate it. The method page explains why.
A second measurement: what leaves before anyone is asked
The figures above are about what happens after a shopper answers. This one is about what happens before they can. In August 2026 Airlock loaded 40 live Shopify storefronts in a real browser as a first-time visitor — nothing clicked, no banner answered — and recorded every tracking request with the millisecond it left.
The timing is the finding
The median first tracking request left at 1.60 seconds. The fastest left at 0.28 seconds — before most pages have finished painting, and long before a human could read a banner, let alone answer one. And on 23 of 26 storefronts no consent banner rendered for this visitor at all, so there was never a moment at which answering was possible. That last figure is a statement about a US vantage point and would very likely differ from Europe.
Which vendors were present before consent
And the subset that matters most — vendors whose tags were emitted by a Shopify app block, which the platform renders server-side before any JavaScript exists to gate them: Klaviyo (5), Okendo (3), Attentive (2), Yotpo (2), Recart (1), Ordergroove (1). For those, installing a different consent app changes nothing.
The heaviest twelve
| Storefront | Requests before consent | First sent | Unreachable | Banner at |
|---|---|---|---|---|
| trueclassictees.com | 162 | 1.64s | 3 | none |
| purple.com | 102 | 1.62s | — | none |
| nomadgoods.com | 88 | 3.33s | — | 2.37s |
| greatjonesgoods.com | 78 | 1.36s | 1 | none |
| drsquatch.com | 72 | 1.65s | — | none |
| rothys.com | 71 | 0.95s | 2 | none |
| deathwishcoffee.com | 62 | 1.37s | 1 | none |
| partakefoods.com | 54 | 1.60s | 1 | none |
| outdoorvoices.com | 42 | 0.28s | 2 | none |
| peakdesign.com | 38 | 2.25s | — | none |
| brooklinen.com | 36 | 0.70s | 1 | 6.18s |
| untuckit.com | 34 | 2.78s | 1 | 8.03s |
The full board is public → Every row links to its own report, with the millisecond timeline behind it. You can re-run it yourself and get different numbers, because a storefront changes daily — but the same shape.
Reproduce it
Every figure here comes from the same protocol the public scanner runs. Put any of these domains into the scanner, run the consent protocol, and you should see the same shape of result — different numbers, because a storefront changes daily and your vantage is not ours, but the same verdicts.
← RUN IT YOURSELF