noyb Cookie Consent Best Practices Guide
The default OneTrust GDPR template meets all noyb recommendations by default. To use the default, navigate to Templates, click Add New then select the "GDPR (General Data Protection Regulation) Template.
In 2021, the privacy activist organization noyb sent out draft complaints to 500+ website owners regarding their cookie banner implementations. These complaints contained specific issues the organization identified as well as recommended updates. Since then, noyb has continued to communicate with organizations and regulators regarding their cookie banner implementations.
It’s important to remember that EU regulatory authorities and industry frameworks, such as IAB Europe's Transparency and Consent Framework, may have different guidance and interpretations than those recommended by noyb. You should work with your legal advisors to make final decisions regarding if and how you should adjust any cookie settings.
At OneTrust, we are here to support you regardless of your specific interpretation and implementation decisions.
Below you will find several resources to help better understand the details of the complaint, as well as how to make adjustments if that is what your organization decides.
Available Resources
In addition to this guide, please see the following resources for guidance on how to address noyb's draft complaints.
Webinars will be recorded and posted on myOneTrust if you are unable to join. If you have additional questions, reach out to your OneTrust representative or submit a support ticket.
The following best practices guide will provide materials and resources to assist in any configuration review that needs completing. We will continue to update this article as required, and provide additional resources via MyOneTrust. Please note that after any changes are made, they will need to be saved and published to the websites you’d like to update.
Topic A: Including a Reject All Button in your Cookie Banner
To include a Reject All button in your banner, please review the following article:
Customizing the Banner Template
Depending on your configuration, you may need to update more than one banner template.
Topic B: Configuring an Opt-In Consent Model
To ensure you are applying an opt-in consent model, please review the following article:
Adding, Editing, and Deleting Geolocation Rules
An opt-in consent model will ensure no cookie categories are enabled by default.
Your geolocation policy may have a number of rules applying to different regions. Review and update all required rules within the geolocation policy.
Topic C: Using a Cookie Settings Button instead of a Link
In your cookie banner, you can include an option for the user to customize their settings by clicking on either a link or a button within the banner.
If you would like to present a button, please review the following article:
Adding Reject All to a Cookie Banner
See the value for Cookie Settings Button Style in the Button Set Screen Reference.
Topics D and E: Configuring Button Colors and Contrasts
In your template configuration, you can control the color values for a number of UI components.
The following article will explain where these values can be changed:
Customizing the Banner Template
The best practice here is to ensure that any “Accept” button has equal prominence and coloring to and “Reject” button. As such, using the same colors for each is recommended.
WCAG contrast requirements change per text size. For more information, please reference the WCAG webpage here.
Topic H: Disabling Legitimate Interest if using the IAB TCF 2.0
This topic is only applicable for organizations making use of the IAB TCF2.0. Typically this applies to publishers.
To control whether Legitimate Interest is in use by your IAB TCF2.0 configuration, please review the following article:
Topic I: Updating Cookie Categorizations
For consent to be valid, cookies must be correctly categorized. The OneTrust scan will automatically categorize known cookies by their purpose, but it is always important to review.
In order to update cookie categorizations, please review the following article:
Managing and Categorizing Cookies
You can also view the following implementation webinar on cookie categorizations:
Scanning a Website, Categorizing & Maintaining Cookies Implementation Webinar
Topic K: Making Consent as Easy to Withdraw as it is to Give
To make consent easy to withdraw, it is important to make it easy for users to access the Cookie Consent interface.
To do this, a link can be included to open the Preference Center when clicked by a user. See the following article:
Implementing Cookie Consent Scripts
See the Cookie Settings Button section.
Alternatively, an unstyled tag can be used. For example:
<a class="ot-sdk-show-settings">Cookie Settings</a>
Or, you can enable the persistent Cookie Settings button through template configuration. When a user gives consent or closes the banner, there will be a button overlay on the page for the user to re-surface the Preference Center.
You can enable a persistent cookie settings button by configuring the Button Set in the Content section of a Preference Center template.
Read more here:
Customizing the Preference Center Template
The persistent cookie settings button overlay will not appear if the script detects there is already a link to the cookie settings on the page.
By default the persistent icon is a cookie, which can be replaced with a custom image within the Preference Center styling section.
Testing Configuration Changes
Whenever changes are made to your configuration, it is important to thoroughly test and validate before publishing to live production websites. It is strongly recommended to test using our Live Preview functionality, which you can find information on here:
Using the Live Preview to Perform Real Time Testing
Further training materials can be accessed via our implementation webinars series, available at any time here: