Apex is bring-your-own consent. You run the banner. Apex reads the signal and decides what to do when no signal arrives.

Open Settings → Workspace → Privacy.

Default when nothing arrives

Conservative (the default): missing signal means denied. Outbound ads and audiences stay off until your banner grants the purpose.
Inferred: missing signal means granted. Use this only when your counsel says inferred consent is legal for you.

Apex does not sell a consent product. Naming OneTrust, Cookiebot, or GCM here is about the signal you already send, not an Apex feature.

When someone says no and then sends a form

A visitor who declines cookies is not measured. The snippet keeps no visitor id, sends no page views, and keeps no ad click ids.

If they then send you a form with their email, they asked you to know who they are. Apex adds them as a person with the form's answers and nothing else:

No browsing history is joined to them, and the page address is stored without its query string.
No ad click id or campaign tag is kept.
Advertising consent is recorded as denied, so no ad platform is ever sent them and they stay off ad audiences.

Signing up works the same way. When you set requireConsent and the person has not said yes, the SDK's identify and trackForm, and identify in the React Native and Capacitor apps, still add them as a person when you pass an email. They send no event and no visitor or device id, and advertising is recorded as denied. Every other call still sends nothing until they say yes.

Marketing vs transactional

Marketing letters and ad audiences honor this policy. Transactional letters (receipts, password resets, invites the person asked for) still send. Do not use a transactional letter to do marketing work around a deny.

What you will see

The Privacy page also shows which channel last sent a signal, so you can tell whether your banner is actually talking to Apex.