OneTrust Consent Manager

Integrate RudderStack with the OneTrust consent management platform.

Data protection laws such as GDPR, CCPA, etc., require the websites to get user consent for collecting their data through cookies.

Consent managers offer various cookie consent solutions allowing the customers to determine what personal data they want to share with a business.

OneTrust is a popular consent management platform that provides data governance, privacy management, and security solutions to thousands of businesses worldwide.

The JavaScript SDK seamlessly integrates with the OneTrust SDK. It lets you map the OneTrust cookie/consent groups to RudderStack’s consent purposes. RudderStack, in turn, uses this consent information to enable/disable tracking and sending the data.

warning
The OneTrust integration with the JavaScript SDK is applicable only for the device mode connections. For the cloud mode connections, you can write a transformation to implement your desired use-case.

How the RudderStack-OneTrust integration works

Whenever a user starts browsing a website, OneTrust pops up a modal to take consent from the user. This modal contains a list of cookie groups representing the GDPR consent purposes that the user needs to decline or accept.

The JavaScript SDK fetches these consented groups and the destination (OneTrust category) mappings specified in the RudderStack dashboard. Depending on these settings, the SDK filters the destinations.

Setting up the integration

The following sections highlight the steps to set up the JavaScript SDK integration with OneTrust.

Step 1: Configuring OneTrust

Follow these steps to configure OneTrust for your web app:

  1. Create a OneTrust account and get subscription to their Cookie Consent product.
  2. Navigate to Websites > Add Websites.
  3. Enter your top-level website URL to scan and click Start Scan.
  4. Go to the Categorizations tab and define the new categories or modify the existing ones, as required.
info
The categories should be associated with/attached to at least one cookie to be displayed in your RudderStack dashboard’s OneTrust modal.
  1. Go to the Scripts tab, select the domain to be published and click Publish to publish the script.

You need to enable OneTrust for a given JavaScript source. To do so, specify the consent category names defined in OneTrust (Step 1) for each destination connected to that JavaScript source.

OneTrust category names

Step 3: Setting up your website

  1. Load the OneTrust script that you published in your web app in Step 1, as shown below:
<!-- OneTrust Cookies Consent Notice start for samplewebsite.com -->
<script
        src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js"
        type="text/javascript"
        charset="UTF-8"
        data-domain-script="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" >
</script>
<script type="text/javascript">
        // Required OneTrust callback
        function OptanonWrapper() { }
</script>
<!-- OneTrust Cookies Consent Notice end for samplewebsite.com -->
warning
As seen in the above snippet, you must first load the OneTrust script and then load the JavaScript SDK only if the user provides their consent. This is because the SDK determines whether to send events to a destination based on the user’s consent. If a user denies consent in OneTrust, then Rudderstack does not load the destination SDKs or send any events to them.
  1. One way to load the JavaScript SDK after the user provides the consent is to modify the OptanonWrapper() callback function provided by OneTrust. You also need to add the cookieConsentManager option in the load() call as shown:
function OptanonWrapper() {
  if (window.OneTrust.IsAlertBoxClosed()) {
    // Load the SDK
    rudderanalytics.load(WRITE_KEY, DATA_PLANE_URL, {
      cookieConsentManager: {
        oneTrust: {
          enabled: true
        }
      },
      //other options
    });
  }
}
info
If a user updates the consent settings, the web page must be refreshed for the changes to take effect in the SDK.

Once completed, RudderStack reads the consented categories and filters the destinations accordingly.

info
Replace the write keyThe write key (or source write key) is a unique identifier for your source. RudderStack uses this key to send events from a source to the specified destination. and data plane URLThe data plane URL is the location where events are routed and sent to the RudderStack backend for processing. You will need this URL to configure sources. in the snippet with their actual values.

If you are using a consent manager other than OneTrust, configure the cookie categories you want to show on your website whenever a new user visits your website.

Next, you need to create an internal mapping between these cookie categories and the destinations configured in RudderStack. For example:

  • Analytical cookie: Amplitude, Google Analytics
  • Targeting cookie: Bing Ads, Google Ads
  • Marketing cookie: Braze, Mailchimp, Customer.io

When a user provides consent, you should fetch the consent (via the API or SDK provided by your consent manager) and filter the destinations depending on the consent. Once you have the list of destinations for which the user has provided consent, you can only load the JavaScript SDK for those destinations.

For example, if a user has provided consent for an analytical cookie, then you can load the JavaScript SDK as shown:

rudderanalytics.load(WRITE_KEY,DATA_PLANE_URL,{
   integrations: {
       All: false,
       "Amplitude": true,
       "Google Analytics": true
       // only provide the destinations the user has provide consent for
   }
   // pass other initialization options
});

FAQ

Currently, RudderStack only supports OneTrust cookie consent manager. For using other consent managers, you can refer to the Consent management with other managers section.

What happens if the JavaScript SDK is loaded before the OneTrust modal is closed?

In this case, the JavaScript SDK will not be able to capture the user consent. Hence, it will load all connected destinations and all events will flow through to them.

Questions? Contact us by email or on Slack