Cookie Consent Integration with Microsoft's Universal Event Tracking

What is Universal Event Tracking?

Microsoft’s Universal Event Tracking (UET) enables conversion tracking and remarketing within Microsoft Advertising. With Microsoft Consent Mode and Microsoft Clarity, UET behavior dynamically adapts based on user consent, ensuring compliance with privacy regulations like GDPR, ePrivacy, the Digital Markets Act (DMA), and more. The OneTrust CMP can manage these consent signals effectively.

Microsoft Guidance: Things to Know

Consent Mode Behavior

Microsoft requires consent signals to adjust tracking behavior. The primary control parameters are ad_storage, which can be 'granted' or 'denied'.

Microsoft Clarity Behavior

Microsoft Clarity requires consent signals to adjust tracking behavior. The primary control parameter is analytics_storage, which can be 'granted' or 'denied'.

Mandatory Default Setting for Certain Regions

For users in the EEA, UK, and Switzerland, Microsoft mandates the default ad_storage value to be denied until explicit consent is granted.

Deadline for Compliance

As of May 5, 2025, advertisers must implement Consent Mode or face loss of conversion tracking, retargeting, and algorithm performance.

From Microsoft: As of October 31, 2025, Clarity begins enforcing consent signal requirements for page visits originating from the European Economic Area (EEA), United Kingdom (UK), and Switzerland (CH). A valid consent signal is required to ensure full functionality of Clarity features for users in these regions.

Implementation Details

Consent Mode uses actions such as 'default' (initial load) and 'update' (when consent changes), both modifying the ad_storage value.

Basic vs. Advanced Consent Mode

Microsoft Consent Mode can be implemented in basic or advanced modes.

Basic

When Consent Mode is implemented in the basic version, the Microsoft tags are prevented from loading until a user interacts with the consent banner.

  • When a user grants consent, Microsoft tags load and execute the consent mode APIs.

  • When a user rejects consent, no data is transferred to Microsoft, not even the consent status. Tags are completely blocked from firing.

Advanced

When Consent Mode is implemented in the advanced version, Microsoft tags and consent mode APIs load when a user lands on the website. The tags and APIs then do the following:

  • Set the default consent state. By default, consent will be denied, unless you set your own defaults. When consent is denied, Microsoft tags send cookieless pings.

  • Wait for user interaction with the cookie banner and updates the consent status. Only when a user grants consent to data collection will Microsoft tags send the full measurement data.

  • If you use Auto-Blocking, assign bat.js to an Allowed Category.

    Add the source to the safe list and configure the purpose as Strictly Necessary. For more information, see OneTrust Cookie Auto-Blocking.

Implementing Microsoft Consent Mode with OneTrust Cookie Consent

  1. On the Cookie Consent menu, select Geolocation Rules. The Geolocation Rule Groups screen appears.

  2. Select a geolocation rule group from the list. The Geolocation Rule Group screen appears.

  3. Select a rule to configure.

  4. Click the Edit icon in the rule header to configure the rule.

  5. Enable the Microsoft Consent Mode setting.

    By default, the Targeting category will be associated with ad_storage and analytics_storage. You can change categories to associate with each consent key setting and save the settings for the geolocation rule.



  6. Configure the categories.



  7. Once Microsoft Consent Mode and all other configurations are ready, click the Save button.

  8. Publish the domain script. For more information, see Publishing and Implementing Cookie Consent Scripts.

Testing Microsoft Consent Mode

Testing the functionality of Microsoft Consent Mode is crucial for ensuring compliance with data privacy regulations and providing a better user experience. Testing this functionality ensures that user consent is properly collected and tracked.

Checking the datalayer

The datalayer console command can be used to see the "consent" event that is triggered when the user provides or revokes consent for data processing in Microsoft Consent Mode.

After using the datalayer console command, it is possible to see all the events that are being triggered on the domain. Within this list the "consent" event can be seen, which shows the default settings for Microsoft Consent Mode and any updates to these settings due to user interaction.

Before user interaction:



After user interaction:



Verifying Enablement at the Browser Level

  1. Open up the Developer Tools on your browser. You can

    1. Right click on the page and select Inspect > Console; or

    2. In your browser settings, select Tools > Developer Tools.

  2. In the Console, enter OneTrust.testLog(); to verify that your latest publish has gone through. You can also verify the version of the script matches your latest publish.

  3. In the Console, enter OneTrust.GetDomainData().MCMData. You can view each Microsoft Storage Type and the category IDs for each assigned OneTrust category been assigned to it.

  4. Verify that the correct cookie categories are assigned to the Microsoft Storage Types. If any storage types are missing a category or have the incorrect category ID, reconfigure your geolocation rule to make the necessary changes and re-publish the production script.

Additional Consent Mode Resources

Microsoft has provided additional information about UET and Consent Mode in their documentation here.