Configuring the OneTrust CMP for UK GDPR

This article provides guidance on user-consent, user choice, transparency and audibility for storage and access technologies connect to UK GDPR and Privacy and Electronic Communications Regulations (PECR) compliance. This article also outlines how to configure your OneTrust CMP to reflect these requirements.

For more information, see Adding, Editing, and Managing Cookie Consent Templates, Customizing the Banner Template, and Customizing the Preference Center Template.

Definitions for UK GDPR

Storage & Access technologies

: cookies, pixels, SDKs, device identifiers.

Strictly Necessary technologies

: required for user-requested services.

Consent logging

: recording and maintaining user consent actions.

Legislative and regulatory requirements

The following regulatory requirements are central to PECR, UK GDPR, and the Information Commissioner's Office (ICO).

PECR

  • Non-essential storage/access technologies require consent.

  • Clear and comprehensive information must be provided.

  • Non-essential cookies cannot be placed before consent.

UK GDPR

  • Applies when personal data is processed.

  • A lawful basis must be identified, typically consent.

  • Transparency, fairness, and purpose limitation apply.

  • Rejecting must be as easy as accepting.

  • Consent must be freely given, informed, and specific.

  • Users must be able to withdraw consent.

  • Consent logging is required for accountability.

CMP configuration essentials

Reference the following guidance when designing your CMP for UK GDPR.

Consent banner / preference center

  • Banner must load before any non-essential technologies.

  • Clear, plain language.

  • Must include Accept All, Reject All, Manage Preferences.

  • Reject All equal in prominence to Accept All.

  • Granular controls available in the preference center.

  • Enable users to withdraw consent easily.

Auditing, logging, and record-keeping

  • Logs must include user ID, timestamp, action type, region, and template version. Logs must be secured and periodically audited.

Geolocation and regional rules

  • UK users must receive the UK GDPR template. Ensure accuracy of geolocation logic.

OneTrust CMP key settings

Configure your CMP with the following settings and features to improve your compliance with UK GDPR.

For more information, see Adding, Editing, and Managing Cookie Consent Templates, Customizing the Banner Template, and Customizing the Preference Center Template.

Feature

Required Setting

Template

Select the UK GDPR template.

Reject button

Enable the Reject All button.

Equal Choice

Ensure Accept and Reject have equal visibility.

User Identifier Display

Show the user identifier in the template.

Geolocation Rule

Apply the UK GDPR template for UK users.

Consent Logs

Enable logging for audit and accountability.

Auto-Blocking

Block non-essential technologies until consent.

Configuration checklist

Use the checklist below to confirm your CMP is configured for UK GDPR.

Feature

Status

UK GDPR template selected

Reject All button enabled

User ID display enabled

UK geolocation configured

Consent logging enabled

Auto-blocking enabled

Preference center correctly configured

Transparency information accessible

Withdrawal of consent enabled