Leveraging CMP Compliance Assistant

Important:

The Compliance Assistant feature is available for customers with solution packaging only.

Using Cookie Consent, you can review your CMP configuration for potential compliance gaps with the Compliance Assistant interface. This interface compares your CMP with specific regulatory requirements and provides automated gap identification for each of your websites.

Compliance Assistant works by simulating user interactions from corresponding geographic regions, comparing website behavior to published specifications and guidelines, identifying potential implementation gaps and suggesting ways to address them. The feature is designed to streamline CMP maintenance by automatically reviewing your configurations and flagging areas of potential noncompliance.

Compliance Assistant does not leverage AI to simulate interactions, compare behavior, identify gaps, or make suggestions. For more information on AI-powered features, see Available AI Platform Features.

Note:

Only users with the Site Admin role can interact with the Compliance Assistant interface or to view daily reports.

Eligibility Requirements

Compliance Assistant is available only for eligible websites. The eligibility requirements for your site are:

  • The banner must be published on the website.

  • There should be at least one successful scan completed.

Safelisting IP Addresses

Share the IP addresses below with your IT team and have them added to the allow-list for both test and production environments. This ensures the scanner can reach your site from multiple geolocations. Adding IP address to your allow-list is necessary if any of the following apply:

  • Your site uses bot-detection tools that could block the new Scanner IPs.

  • Scanner’s user-agent string will stay the same as regular scans: AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.199 Safari/537.36;OneTrust

  • Your security controls restrict traffic to approved IPs only.

IP Addresses

Each scan will originate from a specific geolocation based on the framework.

Framework

Scan Origination

IP Address

UK General Data Protection Regulation and Data Protection Act

UK

IPv4 Cidr:104.30.177.120/32

IPv6 Cidr:2a09:bac0:1001:45c::/64

EU General Data Protection Regulation

EU

IPv4 Cidr:104.30.163.109/32

IPv6 Cidr:2a09:bac0:1000:83f::/64

Brazil General Data Protection Law

Brazil

IPv4 Cidr:104.30.163.110/32

IPv6 Cidr:2a09:bac0:1000:840::/64

Quebec Private Sector Act (Law 25)

Quebec

IPv4 Cidr:104.30.163.113/32

IPv6 Cidr:2a09:bac0:1000:843::/64

California Consumer Privacy Act

California, USA

IPv4 Cidr:104.30.163.111/32

IPv6 Cidr:2a09:bac0:1000:841::/64

US Generic

USA

IPv4 Cidr:104.30.163.112/32

IPv6 Cidr:2a09:bac0:1000:842::/64

To enable or disable Compliance assistant

  1. Click the Gear icon to access the Global Settings menu.
  2. On the Global Settings menu, select Compliance assistant from the Cookie Consent section. The Compliance assistant screen appears.

  3. Configure the Allow compliance assistant to operate setting. A confirmation modal appears.


  4. Click the Save button.

To access the Compliance assistant screen

  1. On the Cookie Consent menu, select Compliance assistant.

    The Compliance Assistant screen appears.

  2. Review your unresolved findings. For more information, see Compliance assistant screen reference.

The Compliance Assistant screen is updated daily. Scans for each domain include 15 pages, which are determined via scan results:

  • 10 pages with the highest number of cookies.

  • 5 pages where videos are detected.

Compliance assistant screen reference



Field

Description
Regulatory frameworks

Rating

This rating represents the average compliance score of the corresponding framework across your websites.

  • A) Excellent: 90–100% of requirements fulfilled.

  • B) Fair: 75–89% of requirements fulfilled.

  • C) Weak: 60–74% of requirements fulfilled.

  • D) Poor: Less than 60% of requirements fulfilled.

View compliance settings

Click the link to access the Compliance settings screen. For more information, see To deactivate frameworks and compliance checks.

(Number of) unresolved findings

Click the link to view the unresolved findings for the corresponding framework.
Job queue

The job queue section displays all compliance scans grouped by the following statuses:

  • Failed

  • Success

  • In progress

  • Pending

  • Partially succeeded

For more information, see To view job details.
Unresolved findings

Manage columns

Select the Manage Columns icon to configure which columns display. For more information, see To configure the unresolved findings columns.

Export

Select the Export icon to export your findings. For more information, see To export the unresolved findings list.

Refresh

Select the Refresh icon to refresh the list of unresolved findings.

Finding

The CMP behavior that may not meet a legal requirement.

Select the name of the finding to view details.

Website

The website where the behavior was found.

Framework

The framework leveraged on the corresponding CMP configuration.
Add filter

Websites

Enter and select a website name to filter the list of unresolved findings by domain.

Frameworks

Enter and select a framework name to filter the list of unresolved findings by legal framework.

Persistence

Select a persistence period to filter the list of unresolved findings by persistence

To configure the unresolved findings columns

  1. On the Cookie Consent menu, select Compliance assistant. The Compliance Assistant screen appears.

  2. Click the Manage Columns icon . The Manage columns modal appears.


  3. Use the up and down arrow icons to configure the order of columns.
  4. Use the left and right arrows to configure the visibility of columns.
  5. Select any columns you want to freeze, i.e., fix on the left when scrolling.
  6. Click the Save button.

To filter the unresolved findings list

  1. On the Cookie Consent menu, select Compliance Assistant. The Compliance assistant screen appears.

  2. Click the Add filter button.
  3. Select a website, framework, or persistence by which to filter the list.


  4. Select the relevant criteria.


  5. Click the Clear all button to remove the filter.

To export the unresolved findings list

  1. On the Cookie Consent menu, select Compliance Assistant. The Compliance assistant screen appears.

  2. Click the Export icon . A confirmation modal appears.
  3. Click the Export data button.
    Note:

    Larger files may take longer before they are available to download.

  4. Click the Notifications icon. The Notifications popover appears.


  5. Click the description of the export to download the xls file. The file contains the following columns:

    • Findings

    • Website

    • Framework

    • Finding Details

To view job details

The job queue displays the status and timestamp of the latest compliance scans. Each row represents a scheduled job that monitors pages within your selected websites.

  1. On the Cookie Consent menu, select Compliance assistant. The Compliance Assistant screen appears.

  2. Click the Job queue link. The Job queue screen appears.


  3. Select the name of a website with a status of Failed, Partial Success, or Success. The Overview screen appears.


  4. Review the job details, including the following:

    • Duration

    • Frameworks successfully checked

    • Pages successfully monitored

To sort and filter the job queue

  1. Click the column headers to sort the list of jobs by different criteria.


  2. Click the Add filter button to apply a filter to the screen. The Advanced filter modal appears.

  3. Select a criterion, operator, and value.


  4. Click the close (X) icon to dismiss the filter.

To view finding details and suggestions

  1. On the Cookie Consent menu, select Compliance assistant. The Compliance Assistant screen appears.

  2. Select a Finding from the Unresolved findings list. The finding details appear.


  3. Review the details of the finding, including suggested resolutions.

    Each finding includes the following:

    • Description: An explanation of the detected issue (e.g., missing consent storage, misaligned purpose mapping).

    • Legal reference: The specific legal requirement to which the finding may not comply.

    • Best practices for resolution: Suggested steps to correct the misconfiguration.

    • Page URL: The URL for each finding, which enabled quick validation.

To view framework requirement checks

You can view requirements for each framework and its corresponding checks for each component of your CMP configuration. This screen maps the requirements of your selected framework to individual checks.

  1. On the Cookie Consent menu, select Compliance assistant. The Compliance assistant screen appears.

  2. Select a framework from the Regulatory frameworks list. The framework details appears.


  3. Review your account's Rating for this specific framework across all applicable sites.
  4. Review the Legislative summary section to learn more about the law.
  5. Expand each row in the Framework requirements section to view checks related to each component of your CMP implementation.

    • Google Consent Mode (GCM)

    • Video Privacy Protection Act (VPPA)

    • Global Privacy Control (GPC)

    • California Invasion of Privacy Act (CIPA)

    • Transparency and Consent Framework (TCF)

    • Global Privacy Protocol (GPP)

    • Preference Center

    • Banner

    • Implementation

To deactivate frameworks and compliance checks

  1. On the Cookie Consent menu, select Compliance assistant. The Compliance assistant screen appears.


  2. Click the View compliance settings link on the Regulatory frameworks list. The Compliance settings screen appears.


  3. Click the Edit button. The settings for each framework and its compliance checks become configurable.


  4. Use the expand and collapse icons to show or hide compliance checks for each framework.
  5. Click the setting icon next to each framework or check you want to deactivate.
  6. Click the Save changes button.

To view activity history for framework and check configurations

  1. On the Cookie Consent menu, select Compliance assistant. The Compliance assistant screen appears.


  2. Click the View compliance settings link on the Regulatory frameworks list. The Compliance settings screen appears.


  3. Click the View activity log button. The Activity log pane appears.


  4. Review the activity history to see what changes were made to your compliance frameworks and checks and which user made the changes.

FAQ

How often are my sites scanned?

Compliance assistant runs a full scan every 24 hours for eligible sites. The job queue reflects the timestamp of the most recent scan.

Once a compliance assistant scan is completed for a website, the website owner is notified via email. You can configure website owners when adding a new website to the scanner. See Scanning a Website.

Important:

The CMP Governance through Ownership feature is under Public Preview. Please contact OneTrust Support to request early access.

How is the compliance score calculated?

Each framework check carries equal weight. Your site’s overall grade is based on the ratio of successful checks to total checks across all frameworks.

Once I remediate a violation, when are the changes reflected in the assistant?

Once you remediate the violation and republish your script, the updated score will automatically reflect in the Compliance Assistant after the next scheduled or manual scan.

How does OneTrust simulate user behavior?

Our scanners mimic real-world visitor interactions, including pressing consent buttons and navigating site flows, from various geolocations. Any anomalies in expected consent behavior are flagged.

Can I run custom checks aligned with my internal audit processes?

Advanced users can configure additional framework-aligned rules or request custom policies through their Customer Success Manager.

What if my site uses bot-detection or WAF rules?

You can to safelist the regional IPs to prevent scans from being blocked.