How to setup One Trust cookie baner to work with Google Tag Manager

Published by
Oct 27, 2022

This guide is all about how to implement OneTrust cookie consent on your website. This is complex guide how to do it step by step using OneTrust Autoblocking for scripts implemented directly in your website and Google Consent mode for scripts which are implemented using Google Tag Manager.

At the begining we need to be clear what is:

  • Google Consent Mode - Google Consent Mode is a mechanism built in Google Tag Manager which is responsible for adjusting Google tags behavior to user consent settings. It will for example block data transfer to Google Analytics if cookie consent for analytics_storage will be not granted but will allow data transfer to Bigquery without user specific information.
  • OneTrust Autoblocking - this is a mechanism included in One Trust cookie solution that blocks/alllows cookies automatically by scaning your website regualry and categorize specific cookies to the corresponding categories. 

 Then we need to do the following steps:

  1. Add your new website to OneTrust panel to allow OneTrust to scan it.
    To do that you need to click: "Add website" in OneTrust tool

    Adding new website to OneTrust

    Then you need to insert your website details and click "Scan&Configure"

    Scan new website

    Next step is to create new custom experience kit. Experience kit represents a geolocation rule group and each of the templates assigned to the rules within the rule group.

    create custom kit

    After that you need to add your name of kit, and choose language your users speak:

    chose language in Onetrust experience kit


    Choose which frameworks you need to be compliant with. In this case we use GDPR because website operates in Germany.

    framework to be compliant with

    Then you need to choose banner layout and customize it to suit your website.

    cookie banner layout

    The same with preference center:

    Preference center layout

    On the last screen you will be asked just to review settings once again and confirm it.
  2. Install One Trust scripts on your website.
    You need to go to the scripts section of OneTrust cookie consent tool and copy from there cookie banner script and paste it on your website.

    Onetrust script code

    You should paste the code into your website. 
    In the script sections you have also two other scripts: cookie settings button and cookie list. Both of them should be implemented on the website. Cookie setting button should be implemented somewhere in the footer, cookie list on your privacy page.
  3. Adjust your Geolocation rules
    • Turn on: Google Consent Mode for each geolocation rule connected to your website:

      google consent mode
    • Turn on: Capture of user consent

      Capture user consent
    • Make sure each Geolocation Rule has the appropriate template assigned to it.

      Geolocation rule cookie template
  4. Customize your templates
    If you did not adjust your templates appearance during first step you need to do that now. Adjust colors, behavior and content.
  5. Publish your scripts
    Go to scripts and then "Publish production"
    During publishing remember about:
    • Enabling Cache Buster
    • Enabling Automatic Blocking of Cookies(all technologies that you manage in your GTM should not be blocked by this so you have to uncheck some positions).
  6. Adjust cookie sources
    Go to Cookiepedia > Categorization and chose your website from the list. Check each cookie, and if you find any cookies which are set by your tags in Google Tag Manager make sure that you delete all sources for them. To do that you can select specific cookie and go to the source settings. This action will prevent OneTrust blocking tags that you already implemented in Google Tag Manager.
  7. Make sure you set up Google Consent Mode in your Google Tag Manager for all tags.
    How to do it you can read here: How to setup Google Consent Mode in Google Tag Manager
  8. Test cookie consent settings impact on your tags and cookies.
    You can do that checking your browser cookie list to see what is blocked and what is active depending on user consent. Also in Google Tag Manager debug mode you will be able which tags are blocked or not.
Published Oct 27, 2022 by Piotr Ulacha

If you enjoyed the content please share it:

If you have any question about this topic feel free to comment or react below.

Other articles about Data privacy
How to track more data in GA4 in the world of data privacy and adblockers.

If you have implemented cookie policy on your website to be compliant with GDPR you have probably notice that you started automatically to see less data reported in your Google Analytics reports. Luckily Google consent mode and server side tracking can increase the amount of data you measure by up to 100% compared to the standard implementation of GA4. 

Published by Piotr Ulacha
Oct 31, 2022
Popular recently
Implementation of various environments in GA4
# GA4

Environment - is a set of necessary elements of technical / software infrastructure, which is the basis for the operation of a given website/application. Google Tag Manager environments are simply multiple versions of the same container. When we have a website with a different version for development, testing, production and QA, instead of creating separate GTM containers for each version, we can set up separate environments in the same container that will work independently in each version.

Published by Anna Bacciarelli
Jan 17, 2023
Server-Side GTM like a nuclear technology

Some time ago I listened to a podcast from the Technical Marketing Handbook series from Simo Ahava, whose guest was Adam Halbardier from the Google Tag Manager product team. During the conversation, the topic of transparency of data handled by the Server-Side container appeared.

Published by Mariusz Michalczuk
Dec 04, 2022
How to measure the impact of email campaigns?

If you plan email marketing campaigns you are interested in the same as with other campaigns, to measure their impact on your business. When you are starting with this topic it is good to know that without additional effort you will not be able to access this impact. You will see no results because Google Analytics will treat traffic from the email campaigns as direct traffic (when users are using your own app) or as referrals (when users are using web email clients). 

Nov 28, 2022