OneTrust

Overview

OneTrust is a leading consent management platform (CMP) and privacy compliance suite used by enterprises to manage GDPR, CCPA, and global privacy regulation compliance. Its script serves the cookie consent banner, records granular consent decisions, conditionally blocks or activates third-party scripts based on category, and powers privacy preference centers, cookie audits, and data subject request (DSR) workflows. OneTrust is the consent infrastructure itself — not a third-party tracker.

What This Script Does

Consent Banner and Preference Center

• Loads and renders the cookie consent banner or modal on first visit, configured by the site operator
• Presents granular category controls: Strictly Necessary, Performance/Analytics, Functional, Targeting/Advertising
• Fires the preference center when users click "Manage Preferences" or equivalent triggers
• Stores user consent selections and preference timestamps

Script Blocking and Activation (Tag Manager Integration)

• OneTrust integrates with Google Tag Manager, Adobe Launch, and standalone tag deployments to conditionally fire or block scripts based on consent state
• Uses <script type="text/plain" class="optanon-category-C0002"> pattern to hold scripts until consent is granted for the relevant category
• Dispatches custom JavaScript events (OneTrustGroupsUpdated, OTConsentApplied) so other scripts can react to consent changes in real time

Cookies Set

• OptanonConsent — the primary consent record cookie; stores consented/rejected category codes, timestamp, and version string; first-party, 1 year
• OptanonAlertBoxClosed — records that the banner has been dismissed; first-party, 1 year
• OTGPPConsent — encodes consent in IAB Global Privacy Platform (GPP) string format for downstream systems
• eupubconsent-v2 — IAB TCF v2.x consent string written to the TC String cookie for ad tech vendors
• _oneTrustCDNDomainCheck — CDN availability probe, session

Script Files and CDN

• Primary loader: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js (or cdn.cookielaw.org variants)
• Domain script: https://cdn.cookielaw.org/consent/<UUID>/OtAutoBlock.js
• IAB TCF stub: loaded inline to ensure the __tcfapi function is available before any ad scripts fire
• All assets served from OneTrust's Cloudflare-backed CDN (cdn.cookielaw.org)

Additional Features

• Cookie scanning and auto-categorization (crawls the site to discover and classify cookies)
• Data Subject Access Request (DSAR) portal for handling Article 15–22 GDPR rights requests
• Vendor management and IAB TCF Vendor List integration
• Consent audit log storage for regulatory record-keeping (Article 7(1) GDPR requirement)

Consent & Compliance

Consent category: Essential / Functional

OneTrust is the consent management infrastructure and is strictly necessary under GDPR. Article 7(1) requires that the controller be able to demonstrate that the data subject has consented — OneTrust fulfills this obligation by recording and storing consent decisions. The OptanonConsent cookie is the mechanism for honoring user privacy choices across sessions. Blocking it would make it impossible for users to exercise rights under GDPR Article 7(3) (withdrawal of consent) and CCPA's opt-out mechanisms. The IAB TCF stub must load before any advertising scripts to prevent unlawful processing.

Should You Block This Without Consent?

No. OneTrust is the consent management tool itself. It must always load first, unconditionally — blocking it would prevent the consent banner from appearing and remove the mechanism by which users exercise their privacy rights. It is strictly necessary infrastructure.