OneTrust

OneTrust’s CMP works from a scan: it crawls your site — simulating real user behavior, including behind logins — and matches what it finds against a database OneTrust says exceeds 45 million pre-categorized cookies. The result is a maintained inventory of first- and third-party trackers, grouped into consent categories that drive banners and preference centers. Geolocation rule groups let one configuration serve GDPR-style opt-in in the EEA and opt-out regimes by region, country, or US state, with banner translations in 250+ languages. It is an IAB TCF-approved, Google-certified CMP with Google Consent Mode support, SDKs for mobile apps and OTT/CTV, and consent receipts retained as compliance records.

The data model shows up everywhere downstream. Categories carry IDs like C0001–C0004 (strictly necessary, performance, functional, targeting), and the active set is exposed on the page as the OnetrustActiveGroups data layer variable — which is what your GTM, Adobe Launch, or Tealium triggers key on. Code that must wait for consent hooks the OptanonWrapper callback or the consent-changed event; there are JavaScript APIs to update consent programmatically (UpdateConsent), inject scripts conditionally (InsertScript/InsertHTML), and read TCF vendor consent strings. Blocking before consent comes in two flavors: no-code auto-blocking that rewrites scripts as the page loads, or manual recategorization plus tag-manager gating. Auto-blocking is the faster rollout and the more common source of breakage — if the scanner miscategorizes a script your site depends on, it gets suppressed, so plan a QA pass per template and rescan on a schedule as your tag population drifts. A server-side CMP API also exists for consent enforcement beyond the browser, with explicit handling for carrying consent across the anonymous-to-authenticated identity transition.

Migration in either direction mostly means untangling those category IDs: GTM triggers, consent mode defaults, and any custom OptanonWrapper logic all reference OneTrust-specific group codes that have no direct equivalent in other CMPs. It is enterprise software in every sense — procurement is quote-based, configuration depth is real, and teams that only need a banner often find the surface area, and the script weight of a fully loaded configuration, more than the job requires.

Use it when you operate across jurisdictions and want consent, subject rights, and privacy-program tooling from one vendor your legal team likely already knows. Look past it when you need a fast, self-serve CMP for a handful of sites — lighter tools ship in an afternoon at published prices.