OneTrust fix guide
OneTrust not honoring Global Privacy Control? Why tags still fire
OneTrust only applies Global Privacy Control to the cookie categories you tick in each geolocation rule, and only blocks scripts it controls. A rule for another region, an unticked category, or a pixel loaded outside OneTrust lets tags fire after the signal.
Free. No account. Results in about a minute.
What OneTrust says it does
- GPC is configured per cookie category inside each geolocation rule, then the script is republished.
- A GPC-enabled category shows as off by default in the preference center when the signal is present.
- Turning on GPC for any category disables the Accept All option in the rule's behaviors.
- A visitor's own manual choice overrides GPC: if they opt back in, the category stays on.
- An optional opt-out signal notification in the template tells visitors the signal was honored.
From OneTrust's own documentation, linked below.
How to set it up
- In OneTrust, go to Cookie Consent, then Geolocation Rules, and open the rule group your site uses.
- Edit each rule that serves US visitors, expand Cookie categories, and tick Global Privacy Control for every category that holds advertising or sharing tags.
- In Cookie Consent, then Templates, open the template, and under Opt-in/opt-out preferences turn on the opt-out signal notification. California requires showing that the signal was processed.
- Save and publish the script, then test with a browser that sends GPC.
Why tags still fire with OneTrust
- GPC ticked in one rule, not the others. If California has its own rule and the rest of the US falls into a default rule, visitors from Colorado, Texas or New Jersey may get no GPC handling at all.
- Scripts OneTrust doesn't block. OneTrust can only hold back scripts it controls, through auto-blocking or by tagging them with its category classes. A pixel added straight to the page outside that setup isn't gated.
- Changes saved but not published. Geolocation rule and template edits don't reach your site until the script is published again.
Gaps on every consent platform
- Pixels hardcoded outside the consent platform. A Meta or TikTok pixel pasted into the theme, or injected by a store app, never asks the consent platform for permission. It fires no matter what the banner says.
- Tag manager tags with no consent condition. Google Consent Mode only governs Google's own tags. Meta, TikTok, Pinterest and other tags in Google Tag Manager need their own triggers or consent checks, or they run for everyone.
- Ad tags filed under the wrong category. The opt-out only blocks the categories it's applied to. An advertising pixel sitting in a functional or performance category keeps running after the signal.
- Tags loading other tags. One ad script can pull in several more. The consent platform may gate the first one and never see the rest.
- Server-side forwarding. Conversion APIs and server containers send data from your server, not the browser, so the browser's opt-out never reaches them unless you pass it along.
Which tags do this most? See pixels that ignore opt-outs.
Questions
Does OneTrust support Global Privacy Control?
OneTrust only applies Global Privacy Control to the cookie categories you tick in each geolocation rule, and only blocks scripts it controls. A rule for another region, an unticked category, or a pixel loaded outside OneTrust lets tags fire after the signal.
Why do trackers still fire after GPC with OneTrust?
Usually because the tag isn't under OneTrust's control: it's hardcoded in the page, loaded by an app or another tag, or sits in a category the signal doesn't reach.
How do I test whether OneTrust honors GPC on my site?
Load the page with Global Privacy Control on, without touching the banner, and record every request. Consentinel's free scan does exactly this and names every ad vendor that ran, with the request as proof.
Sources: OneTrust: Global Privacy Control in geolocation rules
Other platforms: Cookiebot · Osano · Didomi · TrustArc
This is a technical guide, not legal advice. OneTrust is a trademark of its owner; Consentinel isn't affiliated with it.
See what OneTrust is missing on your site.
Free, about a minute. We test reject, accept and Global Privacy Control, and name every tag that ran when it shouldn't have.
Free. No account. Results in about a minute.