Loading auth config...
Skip to main content
Lokker
A comprehensive visual representation of privacy regulations and consent management, featuring icons such as locks for security, shields for protection, checkmarks for compliance, arrows indicating data flow, and symbols for cookies and tracking pixels, all interconnected to illustrate the integration of OneTrust and Google Tag Manager in enforcing consent-aware tracking.

OneTrust and Google Tag Manager Integration

Table of Contents​

Problem Description​

Google Tag Manager (GTM) is supposed to respect OneTrust consent preferences, but tags are firing regardless of user consent choices. Analytics, marketing, and other tracking scripts are running even when users haven't given permission.

Common Causes​

1. OneTrust Not Set for Automatic Blocking​

OneTrust is configured to only show the banner without actually blocking scripts.

Google Tag Manager isn't properly configured to use OneTrust consent signals.

The connection between OneTrust and GTM isn't properly established.

4. Incorrect Trigger Configuration​

GTM triggers aren't set up to check consent status before firing tags.

Step-by-Step Configuration​

Step 1: Verify OneTrust Automatic Blocking​

  1. Navigate to OneTrust Admin Panel

    • Go to Admin → Data Governance → Cookie Compliance
    • Or use: https://yourcompany.onetrust.com/app/admin/

  2. Check Script Blocking Settings

    • Go to Scripts → Script Management
    • Verify that "Automatic Script Blocking" is enabled
    • Check that scripts are properly categorized

  3. Verify Cookie Categories

    • Go to Cookies → Cookie Inventory
    • Ensure cookies are assigned to correct categories
    • Verify blocking rules are set for each category

  1. Enable Consent Mode in GTM

    • In GTM, go to Admin → Container Settings
    • Enable "Consent Mode"
    • Set default consent to "denied" for all purposes

  2. Configure Consent Types

    • Go to Tags → Consent Mode
    • Set up the following consent types:
      • analytics_storage
      • ad_storage
      • functionality_storage
      • personalization_storage
      • security_storage

Step 3: Set Up OneTrust-GTM Integration​

  1. Create OneTrust Consent Variables
    • In GTM, go to Variables → New
    • Create a custom JavaScript variable:
function() {
  // Check if OneTrust is loaded
  if (typeof OneTrust !== 'undefined') {
    return {
      analytics: OneTrust.IsAlertBoxClosed() && OneTrust.IsAlertBoxClosedAndValid(),
      marketing: OneTrust.IsAlertBoxClosed() && OneTrust.IsAlertBoxClosedAndValid(),
      functionality: OneTrust.IsAlertBoxClosed() && OneTrust.IsAlertBoxClosedAndValid(),
      personalization: OneTrust.IsAlertBoxClosed() && OneTrust.IsAlertBoxClosedAndValid()
    };
  }
  return {
    analytics: false,
    marketing: false,
    functionality: false,
    personalization: false
  };
}
  1. Create Consent Triggers
    • Go to Triggers → New
    • Choose "Consent Initialization - All"
    • Set up triggers for each consent type

Step 4: Configure Tag Triggers​

  1. Update Existing Tags

    • For each tag that should respect consent:
    • Go to Tags → Select the tag
    • In "Triggering", add the appropriate consent trigger
    • Example: Analytics tags should only fire when analytics_storage consent is granted

  2. Set Up Consent Overrides

    • In tag settings, go to "Advanced Settings"
    • Enable "Consent Settings"
    • Select the appropriate consent types

Step 5: Test the Integration​

  1. Preview Mode Testing

    • Use GTM Preview mode
    • Check that tags only fire with proper consent
    • Verify consent state changes when banner is interacted with

  2. Browser Console Verification

    • Open DevTools → Console
    • Look for OneTrust consent events
    • Check GTM consent mode status

Common Configuration Issues​

Issue 1: Scripts Still Firing​

Cause: Tags not configured with consent triggers Solution: Add consent triggers to all tags that should respect user choices

Cause: OneTrust events not properly connected to GTM Solution: Verify OneTrust script is loaded before GTM and events are firing

Cause: GTM default consent set to "granted" Solution: Set default consent to "denied" for all purposes

Advanced Configuration​

If you need more granular control, create custom events:

// In OneTrust script
window.dataLayer = window.dataLayer || [];
window.dataLayer.push({
  'event': 'consent_update',
  'consent_state': {
    'analytics_storage': OneTrust.IsAlertBoxClosed() && OneTrust.IsAlertBoxClosedAndValid(),
    'ad_storage': OneTrust.IsAlertBoxClosed() && OneTrust.IsAlertBoxClosedAndValid()
  }
});

Ensure consent state persists across page loads:

// Check for existing consent
const existingConsent = localStorage.getItem('OneTrustConsent');
if (existingConsent) {
  // Update GTM consent mode
  gtag('consent', 'update', JSON.parse(existingConsent));
}

Troubleshooting Checklist​

  • OneTrust automatic blocking is enabled
  • GTM consent mode is enabled
  • Consent types are properly configured
  • OneTrust-GTM integration variables are set up
  • Tags have appropriate consent triggers
  • Default consent is set to "denied"
  • Consent events are firing properly
  • No JavaScript errors in console

Testing Your Setup​

  1. Clear Browser Data

    • Clear cookies and local storage
    • Refresh the page

  2. Check Initial State

    • Verify no tracking scripts load initially
    • Check GTM consent mode shows "denied"

  3. Accept Consent

    • Accept all cookies in OneTrust banner
    • Verify scripts now load properly

  4. Deny Consent

    • Deny cookies and refresh
    • Ensure scripts remain blocked

Still Having Issues?​

If the problem persists:

  1. Check OneTrust Logs

    • Look for consent events in OneTrust admin
    • Verify script blocking is working

  2. GTM Debug Mode

    • Enable GTM debug mode
    • Check consent state in real-time

  3. Browser Extensions

    • Disable ad blockers and privacy extensions
    • Test in incognito/private mode