Consent banners give digital consumers a right of refusal that websites do not reliably honor. A dual-persona audit of 100 highly trafficked domains across five consumer-facing sectors (news, e-commerce, health, finance, and government) found third-party cookies set before any interaction on 33.0% of domains; no programmatically reachable rejection path on 69%; and, where rejection was possible, third-party cookies continued to be stored on 51.6%, and identifier-pattern cookies were retained on 74.2%. Guided by these findings, we present CyberGuard, a Manifest V3 browser extension that enforces privacy at the client through a minimal network blocklist; fingerprint fuzzing across canvas, WebGL, and audio; behavioral masking; and a human-in-the-loop cookie vault. In a replication matched by browser mode on the same corpus, run on two separate days with all cookies accepted in both conditions, CyberGuard reduced third-party cookies by 56.5% on average (11.3 to 4.9 per domain; Wilcoxon W = 66.5, p = 1.7 × 10⁻¹¹). The initial campaign, in which the two conditions ran under different browser modes, had measured 70.8% (15.37 to 4.49; W = 20.0, p = 1.16 × 10⁻⁵); part of that figure reflects the mode difference rather than the extension. The reduction is structural: its pattern is consistent with a single blocked advertising entry point suppressing a downstream header-bidding stratum far beyond the two targeted networks, while platform embeds largely persisted. Client-side enforcement thus lowers tracking exposure even when consent is granted; the datasets, the consent selectors, and the crawler harness are released.