OneTrust Cookie Auto-Blocking™
About Auto-Blocking
OneTrust Auto-Blocking automates the process of setting your cookies, scripts, and tags to respond to the preferences selected by site visitors.
Other blocking options, such as Tag Manager integrations and JavaScript type-rewriting may be leveraged to achieve cookie blocking. Auto-blocking, however, can automate this process on many sites where it is a good fit.
How It Works
OneTrust Cookie Auto-Blocking works by analyzing the cookies on your site to determine which script on the page drops the associated cookie. Combining this information with the categorizations for each cookie, OneTrust can help prevent scripts that drop cookies from firing on your page until the proper consent is granted.
OneTrust intercepts scripts that will be added to the page and sets their type to Text/Plain with a class name associated with a category. Once the consent is granted, the type is changed to Text/JavaScript and the script can load normally.
The behavior can be configured to change by jurisdiction based on the consent model. When the script loads on your page, the cookies will be blocked according to your consent policy, geolocation rules, and the preferences selected by the site visitor.
Is Auto-Blocking Appropriate for Your Domain?
Auto-Blocking can often simplify the maintenance and configuration of your OneTrust Cookie Consent solution. There are considerations, however, that may position another blocking method as a better fit for your website.
- If you have lots of cookies and/or intensive site content
-
, AutoBlock must be loaded synchronously on the page. If you have a long list of cookies, the download of the AutoBlock script may cause your page to render more slowly than expected. If this is a concern, consider integrating with your tag manager for a more performant implementation. For more information, seeCookie Consent Integration with Google Tag Manager.
- If you generate revenue from targeted ads
-
AutoBlock.js might impact the timing and order of scripts firing. This can sometimes cause ad targeting libraries to malfunction and impact revenue. The best practice is to use a method other than Auto-Blocking for cookies related to ad targeting.
- If you leverage Bulk Domain Management
-
, due to the nature of web properties, the source URLs for many scripts will change per domain.
If any of the above scenarios are applicable to your domain(s), Auto-Blocking might not be the best fit for your website. Consider tag manager integration or type-rewriting for your cookie blocking needs. It is still possible to use a combination of solutions, so AutoBlock may be a good fit for some but not all of your cookie blocking.
Implementation Requirements
|
Requirement |
Explanation |
|---|---|
|
|
Auto-Blocking may not be loaded asynchronously on the page. This means that content rendering is paused until the |
|
The |
If the scripts are deployed using a tag manager, there is a high risk of latency between the domain and the tag manager. This leads to the possibility that tags will fire before |
|
If revenue is generated from targeted advertisements, it is recommended you utilize manual blocking methods. |
Auto-Blocking can cause tags to behave unexpectedly on page-load and can impact ad revenue. |
Common Host Blocking
OneTrust Auto-blocking can block commonly identified trackers automatically without the need to locate a source URL. This behavior is configured during publishing. The common hosts are listed below.
|
addthis.com |
addtoany.com |
adsrvr.org |
|
amazon-adsystem.com |
bing.com |
bounceexchange.com |
|
bouncex.net |
criteo.com |
criteo.net |
|
dailymotion.com |
doubleclick.net |
everettech.net |
|
facebook.com |
facebook.net |
googleadservices.com |
|
googlesyndication.com |
krxd.net |
liadm.com |
|
linkedin.com |
outbrain.com |
rubiconproject.com |
|
sharethis.com |
Taboola.com |
twitter.com |
|
vimeo.com |
yahoo.com |
youtube.com |
To enable this functionality, see the Automatically Block Known Tracking Technologies section in Publishing and Implementing Cookie Consent Scripts. When enabled, any script on the website inserted by the hosts listed above is mapped to OneTrust’s Targeting category and is only allowed when the user accepts targeting cookies on a site.
Things to Know
-
Cookies may not be detected by the scanner if the related tag is triggered by actions such as form submission, scroll depth, timing delay, etc. These tags will either need to be added manually to OneTrust or blocked using another method.
-
Any cookie categorized as non-essential (Functional, Performance, Targeting, Social Media, or any custom category) that has an accurate source URL will be controlled by Auto-Blocking. If a cookie is categorized as Strictly Necessary or Unknown, it will not be included in the
OtAutoBlock. -
Cookies set by in-line scripting (e.g., using 'document.cookie' inline) are not supported by Auto-Blocking functionality. Instead, consider Client-Side Cookie Management type-rewriting for these cookies.
Prerequisites
OneTrust Cookie Auto-Blocking uses your scan results and cookie categorizations to know what to block. If a cookie has not been detected by the site scanner, is not categorized, or does not have a source URL included, it will not be controlled by the auto-blocking script.
To ensure a successful implementation of the Auto-Blocking script, rescan your site before beginning the implementation, ensure all cookies are categorized, and ensure all the cookies for the domain have the correct source URLs included.
To publish the cookie script with Auto-Blocking enabled
You should never deploy this functionality without first validating it in a testing environment to avoid unexpected errors on your user-facing (production) site.
- Enable the Enable Automatic Blocking of Cookies setting. This will update the script to include OneTrust Cookie Auto-Blocking.
Tip:
If you want to automatically include Auto-blocking for scripts from common hosts, select Automatically Block Known Tracking Technologies.
There may be scripts on your site that you’d like to explicitly exclude from Auto-Blocking. For more information, see Preventing Auto-Blocking from Blocking Scripts.
To unblock source URLs
You can remove source URLs from your Auto-Blocking JavaScript for greater control over your Auto-blocking functionality.
Auto-Blocking supports exact URL matches, not pattern matches. For example, if you remove a specific URL like abc.com/test.js from the Auto-Block tab, the URL remains excluded in future scans for that domain. But if the URL is dynamic, such as abc.com/test123.js, and changes every time with each page load (e.g., to abc.com/test456.js), the new URL will be treated as a new resource and included in the next scan.
- Select the source URLs you want to remove from your auto-blocking.
To manually block source URLs
- Click the Search button.
-
Previously Linked URLs
-
If the source URL matches to an existing cookie, the existing cookie displays.
-
Click the Block button.
-
-
New URLs
-
If the source URL does not match to an existing cookie, configure the fields.
- Field
- Description
- Link to
-
Select an item to which the source URL should be linked.
-
Existing Cookie
-
New Cookie
-
- Existing Cookie
- Cookie
-
If linking to an existing cookie, select the cookie to which the URL belongs.
- New Cookie
- Name
-
Enter the cookie name.
- Host
-
Enter the host URL.
- Lifespan
-
Select Persistent or Session.
- Default Category
-
Select the default category for the cookie. The category will be assigned to this cookie on all domains until you edit it in the Advanced Categorizations screen.
If a new domain is scanned and an existing cookie is found, it will be assigned to the Default Category on that domain.
For more information, see Configuring Purposes.
-
Click the Block button.
-
-
To reset the list of blocked URLs
FAQs
When should I use Auto-Blocking?
OneTrust suggests using Auto-blocking for simpler websites (where you don’t have dynamic URLs firing cookies on the website and where you have fewer cookies, which makes it easier to maintain the Auto-Blocking file).
You will need to check your autoblock.js file every time a new publish occurs to ensure no new or incorrect URLs are added.
This JavaScript file is available within the scripts in https://cdn.cookielaw.org/consent/(YOUR. DATA DOMAIN ID)/AutoBlock.js
Does the Auto-Blocking script have to be the first element on the site?
Yes, the Auto Blocking script must be the first item in your head section. This is to ensure it runs before any cookies are dropped.
Not all the cookies are being blocked. What do I need to do?
Ensure all cookies on your site have been categorized. Cookies that are uncategorized will not be blocked by the auto-blocking feature. Additionally, any cookies that are categorized as Strictly Necessary will not be blocked by the Auto-Blocking feature.
Confirm that the correct source URL is linked to the cookie in the OneTrust tool if a cookie is not being blocked. Republish after adding the correct URL and test if the cookie is now being blocked as expected. You can check the Auto-Block tab on the Website Details screen to see if the source URL is added in the Block List
Check the consent model being used for your region. If the consent model is Opt-out, then the cookies will be enabled until the site visitor opts out.
How do I check which cookie has the source URL that is breaking my site?
You can export an Excel file that gives you a list of all the cookies and their associated source URL(s). To export this file, follow the steps in the To export you cookie list section of Configuring Purposes.
Disable the Exclude Resource URLs setting on the Cookie Export modal when exporting your cookie list.
What happens to newly added, uncategorized cookies on my site?
Cookies will not be blocked until they are categorized, have the correct source URLs included, and the Auto-Blocking script has been republished to include the new URLs.
When should I use a tag manager versus Auto-Blocking?
Simple integrations are available for all tag managers, giving you a great way to control when tags fire based upon user consent.
With Auto-Blocking turned on, new tags are automatically disabled if the tag is in a category blocked and the correct source URLs are present until consent is given.
How do I ensure my Auto-Blocking settings are up to date?
You can rescan your site by using the automatic scan scheduler or by manually initiating a scan. If new cookies are found, you will need to make sure they are categorized with correct source URLs present or they will not be blocked.
After categorizing the new cookies, you will need to publish the script.
Can I use custom category IDs with Auto-Blocking?
Yes, you can use custom category IDs with the Auto-Blocking script. It uses whatever IDs are configured in the tool. The Auto-Blocking script adds the appropriate IDs to the tags that need to be blocked.
Does Auto-Blocking work with iFrames embedded directly on the page?
Auto-Blocking currently only works for iFrames created dynamically on the page, such as advertising iFrames that are injected by a JavaScript file.
For iFrames embedded directly on page, for example some YouTube videos, we recommend following the manual steps to block those iFrames.
For more information, see Client-Side Cookie Management.
Can I use an Opt-out consent model with Auto-Blocking?
Yes, you can use any consent model with Auto-Blocking. When using an opt-out consent model, cookies are allowed when the user first visits the site. If the user chooses to opt-out or reject a category, cookies belonging to that category are blocked on the website. This also applies to Auto-Blocking.