Step-by-Step Onboarding Guide: Cookie Consent

Getting up and running with your Cookie Consent solution

Thank you for choosing the OneTrust Cookie Consent solution to help manage your privacy, security, and governance program needs.

The solution is designed to be intuitive and easy to configure and this guide will take you through each step one by one.

And if you have questions along the way, or at the end of your implementation, you can reach out to the team who will be happy to help.

Before you begin

Before you get started with your implementation, complete the following key activities which will help you accelerate your implementation:

  1. Assign Key Process Decision Makers

    It’s important to identify who will be the owner of the OneTrust tool as well as the development work required on your domain.

    The Tool Owner will scan the scoped websites, classify cookies, and design the Cookie Banner and Preference Center.

    The Development Decision Maker will oversee blocking cookies, integrating with your internal tools, and ensuring the banner script is deployed to all pages.

  2. Identify Domains

    Having a listing of all domains you intend to deploy the OneTrust banner will help you be clear about your scope and enable your team to get the banner live in the most efficient way possible.

  3. Consent Models

    Think about how data subjects that visit your site should interact with cookies. Whether you decide to create cookies and only notify the data subject or require explicit consent from the data subject before they are created, we have a model that will work for you. For more information on our consent models, see Cookie Consent Models.

  4. Define Cookie Notice Language

    OneTrust provides out-of-the-box verbiage for both the Cookie Banner and Preference Center. However, many clients may have their own preferences around what wording is used on their site. Ask if your team wants to keep our wording or create your own.

Let’s get you started

Follow the steps below to get your solution set up. Each stage of the process is covered by comprehensive guidance and support collateral on the My.OneTrust.com online resource platform and this guide will direct you towards all the information you need.



Cookie Consent Configuration

For an overview of the Cookie Consent module and its features, read this article here.

You can access all our knowledge base articles at the link here. The steps below direct you to the most relevant ones to get started as quickly as possible.

Refer to the frequently asked questions page for answers to the most common questions and issues. We also recommend watching our prerecorded Cookie Consent Implementation Webinars which can be accessed here. The first and second webinar will cover the functional implementation and the third and fourth webinar will cover the technical implementation.

Functional Implementation Steps

Step 1: Scan a Website

The first step is to scan your website(s) for the cookies that are being dropped by your website to visitor devices.

  • Exclude the prefix “www” if you want to scan the entire root domain including subdomains.

  • It is common for scans to take several hours or days depending on the size of the website, performance, redirects and number of scans kicked off within a tenant.

  • While you wait for the results you may wish to move to step 3, Configure Template Design below.

Want further details about scanning?

Scanning a website – How to scan a website, tool fields and options, scan statuses.

Viewing Scan Results – How to access scan results, tool dashboards, tab fields and details, cookie categories.

Website Scanning Best Practices – Recommended best practices when configuring and running your website scans.

Step 2: Manage and Categorize Cookies

Once the scan has been completed, you can view the results of your website scans and edit the details of individual cookies. This will allow you to see all the cookies and tracking technologies present on your website site and categorize them based on function.

These categories will allow site visitors to consent to cookies by category in your Preference Center.

Most cookies will already be categorized based on the OneTrust Cookiepedia database – you will need to manually assign a category to any unknown cookies.

Note:

Cookiepedia is the largest database of pre-categorized cookies and online tracking technologies.

Want further details?

Managing and Categorizing Cookies – Types of Cookies, how to categorize and recategorize unknown cookies, how to add and remove cookies from the categorization screen.

Step 3: Configure Template Design

Templates control the look and feel of your Cookie Banner, Preference Center, and Cookie List to seamlessly match the style of your website and comply with applicable consent frameworks.

Note:

  • OneTrust offers several pre-seeded templates to meet different regulatory frameworks.

  • You can also configure the layout, styling, content and behavior for the cookie banner and Preference Center to your own specifications.

Want further details?

Customizing the Banner Template

Customizing the Preference Center Template

Customizing the Cookie List Template

Step 4: Configure Geolocation Rules

You will now need to set up the consent settings and Geolocation Rules. These rules must be setup to ensure that your website is compliant with regional privacy laws.

These settings will also allow you to collect data on consent responses.

Note:

  • Geolocation rules determine based upon where the user is coming from in the world what consent model/banner and preference center they will view. You can define consent rules by location and determine which templates you want to assign to each rule and show how to assign domains.

  • You must have at least one rule (“Global”) that defines the default behavior to use when no other rules apply.

Want more details?

Adding, Editing and Deleting Geolocation Rules – How to add and configure rules, different consent models and category statuses.

Enabling Consent Logging and the Cookie Consent Dashboard - How to log records of consent and consent preferences, Cookie Consent Dashboard, Advanced Analytics.

Cookie Consent Models – You can configure cookie consent models for each category of cookie you set up in your CMP (Consent Management Platform).

Step 5: Script Integration

The next steps will place the Cookie Banner, Preference Center, and Cookie List on your website.

Any changes you make to the Cookie Banner, Preference Center, or Cookie List will be made automatically after publishing, unless you are hosting the script locally.

Note:

  • After entering the publish modal, you will be provided with both Testing and Production scripts.

  • You can publish a Testing script to use on your testing website. Simply add the Testing script to your testing environment in the <head> section of the website. There is no cache for testing scripts, so changes will appear immediately.

  • When you are ready publish the Production script, you will need to copy this script and paste it into the <head> section of your website.

Want more details?

Publishing and Implementing Cookie Consent Scripts – Testing and Production CDN, Tool fields, Descriptions and Settings

Restoring or Publishing Previous Script Versions – Navigating through different versions of scripts.

Technical Implementation Steps

The next section of this guide deals with the options you have around Cookie Blocking. It is recommended that the Technical Decision Maker or Technical Team is involved in these steps.

There are several options around Cookie Blocking that you can use with the Cookie Consent Solution. Key information is provided below but it is recommended you consult the full Knowledge Base on this topic and review the following sections on My.OneTrust. To block cookies, it is important to know their origin, as the blocking needs to be applied at a source level.

Step 6: Blocking Cookies that are Injected Directly on the Website

Cookies themselves cannot be directly blocked; however, most cookies that fall under legislation are set through inserted scripts or tags, such as JavaScript or HTML iFrames. This includes most analytics and third-party cookies, such as advertising cookies. Therefore, to comply with the law, such scripts should be blocked, or substituted for non-cookie alternatives, whenever consent has been withheld or withdrawn.

To achieve this, you can use one of the two methods below.

For cookies that are injected via scripts on the source code directly, you can either use the Manual Blocking (Client-Side Cooke Management) method where you need to manually re-write the cookie dropping scripts or Automatic Cookie Blocking (Auto-Blocking) method in which case, the OneTrust Cookie Consent tool provides you with a custom script that will re-write the cookie dropping scripts automatically for you.

  1. OneTrust Cookie Auto-Blocking™: Automatic Cookie Blocking – With Auto-Blocking turned on, the source of tags/cookies are automatically blocked when the categories are turned off by default or when consent is revoked after explicit action. This is for the tags/cookies are categorized in a category in the tool.

    Note:

    If you do not want to block specific sources, you need to either remove the source from the cookie in the tool or use the following script: Preventing Auto-Blocking from Blocking Scripts

  2. Client-Side Cookie Management: Manual Cookie Blocking via Manual JavaScript Rewriting – This option can be used to block cookies in the website source code by altering the code directly.

Additional documentation:

Manually Rewriting iFrames in Cookie Consent

Using Facebook Pixel with Cookie Consent

If the Manual JavaScript Re-write method is used, then there is no need to deploy the Auto-Blocking script. The same applies for the vice versa scenario.

And/or Step 7: Blocking via a Tag Manager

If you use a Tag Manager (e.g., Google Tag Manager, Tealium, Adobe Launch) to inject tags and cookies on your website and manage site content, you can set it up so that the scripts are controlled by the consent preferences choices selected by visitors.

Cookie Consent Integration with Google Tag Manager: For cookies coming from Google Tag Manager, you can control when tags fire based upon user consent. This will be different for each tag and depends on which tags you use to create cookies. Some will not create cookies.

Note:

You can find the OneTrust GTM (Google Tag Manager) container at the bottom of the document in “attachments” which has a built-in configuration already.

Cookie Consent Integration with Tealium: If you use Tealium to manage the cookies on your website, you can integrate with your banner script so visitors on your websites can control their consent preferences.

Cookie Consent Integration with Adobe Launch: If you use Adobe Launch to insert scripts or code that sets your cookies, you can configure the tool, so that scripts are controlled by the consent preferences set by site visitors.

For more Third-party integrations and Blocking Guidance please visit the corresponding section here.

And/or Step 8: Optional - Google Consent Mode

Cookie Consent Integration with Google Consent Mode: Google Consent Mode allows for the adjustment of how Google tags behave based on the consent given or not given by users through Cookie Consent and is an alternative blocking method for Google components. The feature indicates whether consent has been granted for Analytics and/or Ads cookies and Google's tags dynamically adapt by only utilizing cookies for the specified purposes or cookie categories.

Steps to integrate Google Consent Mode:

  1. Enable Google Consent Mode within the Geolocation Rules.

  2. Map the Google storage types with the categories you are using within the OneTrust platform.

  3. Add the Google Site Tag and Define Default Consent (Denied – Opt-in vs Granted – Opt-out).

Google Consent mode can also be used as an additional method of actioning of consent on Google related tags where Cookie Blocking via a Tag Manager (GTM) has already been introduced. Cookie Blocking via a tag manager is documented on Step 7 above. If you have additional non-Google related tags dropping in Google Tag Manager for which you need consent for, you can add additional consent via selecting Edit > Advanced Settings > Consent Settings in the tag.

Note:

If you use Google Consent Mode with Auto-Blocking, please bear in mind that Google Consent Management will already be controlling/blocking Google tags/cookies, so Auto-Blocking should not block Google cookies. Therefore, you will need to:

  • Uncheck Google tags from “Automatically Block Known Tracking Technologies” when publishing the script.

  • Remove the sources of all Google cookies in the Categorization tab.

  • Or instead: add the “data-ot-ignore" attribute (Preventing Auto-Blocking from Blocking Scripts) to Google scripts being loaded on the website.

Complete!

Congratulations on completing your implementation.