Does OneTrust itself require visitor consent before loading?

No. OneTrust is the consent management platform — it must load unconditionally before any other scripts so it can present the consent banner and honor user privacy choices. Blocking it would prevent the banner from appearing and remove the mechanism by which visitors exercise GDPR withdrawal rights and CCPA opt-out rights.

What cookies does OneTrust set and why?

OneTrust sets OptanonConsent (1-year cookie storing consented category codes, timestamp, and version), OptanonAlertBoxClosed (records banner dismissal), OTGPPConsent (IAB Global Privacy Platform string), and eupubconsent-v2 (IAB TCF v2 consent string for ad tech). These are the compliance records required under GDPR Article 7(1).

How does ConsentStack relate to OneTrust?

OneTrust and ConsentStack are both consent management platforms — they serve the same function and would not typically be used together on the same site. If your site uses OneTrust, ConsentStack is the alternative. ConsentStack manages script blocking, consent records, and vendor auditing in the same way OneTrust does, with a simpler setup.

What tracker domains does OneTrust use?

ConsentStack has catalogued tracker domains for OneTrust including cookielaw.org, onetrust.com and cookiepro.com. These are the network destinations OneTrust's scripts contact, which a consent platform blocks until a visitor agrees.

What cookies does OneTrust set?

OneTrust sets cookies such as OptanonConsent and OptanonAlertBoxClosed. ConsentStack identifies these and classifies them so they can be blocked or allowed based on the visitor's consent choice.

OneTrust (cookielaw.org) - Consent Management Platform & Privacy Info

Back to Vendor Library

Overview

OneTrust is a leading consent management platform (CMP) and privacy compliance suite used by enterprises to manage GDPR, CCPA, and global privacy regulation compliance. Its script serves the cookie consent banner, records granular consent decisions, conditionally blocks or activates third-party scripts based on category, and powers privacy preference centers, cookie audits, and data subject request (DSR) workflows. OneTrust is the consent infrastructure itself — not a third-party tracker.

What This Script Does

Consent Banner and Preference Center

Loads and renders the cookie consent banner or modal on first visit, configured by the site operator
Presents granular category controls: Strictly Necessary, Performance/Analytics, Functional, Targeting/Advertising
Fires the preference center when users click "Manage Preferences" or equivalent triggers
Stores user consent selections and preference timestamps

Script Blocking and Activation (Tag Manager Integration)

OneTrust integrates with Google Tag Manager, Adobe Launch, and standalone tag deployments to conditionally fire or block scripts based on consent state
Uses <script type="text/plain" class="optanon-category-C0002"> pattern to hold scripts until consent is granted for the relevant category
Dispatches custom JavaScript events (OneTrustGroupsUpdated, OTConsentApplied) so other scripts can react to consent changes in real time

Cookies Set

OptanonConsent — the primary consent record cookie; stores consented/rejected category codes, timestamp, and version string; first-party, 1 year
OptanonAlertBoxClosed — records that the banner has been dismissed; first-party, 1 year
OTGPPConsent — encodes consent in IAB Global Privacy Platform (GPP) string format for downstream systems
eupubconsent-v2 — IAB TCF v2.x consent string written to the TC String cookie for ad tech vendors
_oneTrustCDNDomainCheck — CDN availability probe, session

Script Files and CDN

Primary loader: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js (or cdn.cookielaw.org variants)
Domain script: https://cdn.cookielaw.org/consent/<UUID>/OtAutoBlock.js
IAB TCF stub: loaded inline to ensure the __tcfapi function is available before any ad scripts fire
All assets served from OneTrust's Cloudflare-backed CDN (cdn.cookielaw.org)

Additional Features

Cookie scanning and auto-categorization (crawls the site to discover and classify cookies)
Data Subject Access Request (DSAR) portal for handling Article 15–22 GDPR rights requests
Vendor management and IAB TCF Vendor List integration
Consent audit log storage for regulatory record-keeping (Article 7(1) GDPR requirement)

Consent & Compliance

Consent category: Essential / Functional

OneTrust is the consent management infrastructure and is strictly necessary under GDPR. Article 7(1) requires that the controller be able to demonstrate that the data subject has consented — OneTrust fulfills this obligation by recording and storing consent decisions. The OptanonConsent cookie is the mechanism for honoring user privacy choices across sessions. Blocking it would make it impossible for users to exercise rights under GDPR Article 7(3) (withdrawal of consent) and CCPA's opt-out mechanisms. The IAB TCF stub must load before any advertising scripts to prevent unlawful processing.

Should You Block This Without Consent?

No. OneTrust is the consent management tool itself. It must always load first, unconditionally — blocking it would prevent the consent banner from appearing and remove the mechanism by which users exercise their privacy rights. It is strictly necessary infrastructure.

Is OneTrust GDPR compliant?

OneTrust typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So OneTrust can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads OneTrust, not on OneTrust itself.

Visit website

Consent Categories

Essential Functional

Also Known As

onetrust CMPonetrust GDPRonetrust cookie bannerconsent management platformonetrust preference centeronetrust blocking

Industries

Programming and Developer SoftwareComputers Electronics and Technology

Tracked Domains (3)

OneTrust's trackers are common, seen on about 8% of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

cookielaw.orgFunctional

cookielaw.org is a functional domain operated by OneTrust, used to run site features like chat, video, embeds, and preferences. Seen on about 8% of scanned sites.

onetrust.comFunctional

onetrust.com is a functional domain operated by OneTrust, used to run site features like chat, video, embeds, and preferences. Seen on about 7% of scanned sites.

cookiepro.comConsent

cookiepro.com is a consent domain operated by OneTrust, used to manage cookie consent and preferences. Seen on under 1% of scanned sites.