in theory or in practice?
​
In theory you’re only tracked when you accept the cookie. You might have been tracked before you touch accept, but it should only be sent to your analytics program (Google analytics most of the time) after you press accept.
It could also be that when you don’t click accept, data is still being sent to GA, but anonymised.
In practise, you’re being tracked whether you click accept or you don’t. Really depends on how far they went with being GDPR compliant but i’ve seen way more sites doing piss all than sites who are 100% compliant.