Switch from OneTrust to Cookiequiet

Switching a website from OneTrust's cookie consent to Cookiequiet means removing OneTrust's script stub and its OptanonWrapper function, adding one Cookiequiet script tag first in the head, converting the tags you blocked with optanon-category-C000X classes to Cookiequiet's data-cq-category attribute, renaming data-src to data-cq-src on blocked iframes, and pointing the "Cookie Settings" button at the new preferences centre. One check comes first: if OneTrust is your IAB TCF CMP for Google AdSense, Ad Manager or AdMob ads in Europe, stay on a certified CMP for those ads, because Cookiequiet is not one.

Should you switch?

OneTrust is a broad privacy platform. Sites that use it only for a cookie banner on one or a few websites often find that a lighter tool covers the same ground: blocking until consent, Google Consent Mode v2, a preferences centre, a consent log and a cookie policy. Cookiequiet is free for one website and costs €3 per website per month on Starter, with no pageview limit; the cost calculator compares totals for your sites and traffic, and the comparison page lists the differences.

Stay on a TCF CMP if you serve programmatic ads to visitors in the EEA, the UK or Switzerland. Google requires a Google-certified CMP integrated with the IAB TCF for AdSense, Ad Manager and AdMob there, and Cookiequiet is not a Google-certified CMP for the TCF. TCF for publishers explains when it applies.

How do OneTrust's groups map?

OneTrust identifies cookie categories by group IDs. Its documentation uses C0002 for performance cookies, C0003 for functional cookies and C0004 for targeting cookies; in most setups C0001 is strictly necessary and C0005 social media, but check the IDs under Categorizations in your OneTrust admin, since custom groups get other IDs.

OneTrust's performance group holds analytics tools such as Google Analytics, which is why it maps to analytics rather than functional.

What changes in the markup?

OneTrust's client-side cookie management article describes JavaScript type rewriting: the script gets type="text/plain" and a class naming its group, and OneTrust activates it after consent. Several groups can be listed in one class, such as optanon-category-C0002-C0003-C0004. Cookiequiet does not read the class, so add its own attribute and drop the class:

A script blocked for OneTrust:

html
<script type="text/plain" class="optanon-category-C0002"
  src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>

The same script for Cookiequiet:

html
<script type="text/plain" data-cq-category="analytics"
  src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>

For a tag listed under several groups, pick the strictest one (marketing if C0004 or C0005 is among them), since Cookiequiet uses one category per tag.

For iframes, OneTrust moves the URL to data-src and adds the group class. Cookiequiet reads data-cq-src:

html
<iframe data-cq-src="https://www.youtube-nocookie.com/embed/VIDEO_ID"
  data-cq-category="marketing" title="Video"></iframe>

Scripts that OneTrust's auto-blocking held without markup are covered by Cookiequiet's auto-blocker when the host is among the about 80 trackers in its provider database; mark the rest by hand, as described in block scripts until consent.

What else needs rewiring?

• The settings button. OneTrust opens its preference centre from elements with the class ot-sdk-show-settings (often the button with id ot-sdk-btn). Replace it with an element carrying data-cq-show-preferences, or a link to #cq-preferences.
• OptanonWrapper and OneTrust events. Code inside OptanonWrapper, or listening for OneTrustGroupsUpdated, should listen to the cq:consent window event or use window.Cookiequiet.on(callback); window.Cookiequiet.get() returns the stored choice.
• Google Tag Manager. Triggers built on OneTrust's dataLayer variables (the active groups) move to the cq_consent event and its cq_analytics, cq_marketing and cq_functional flags. Google tags take their signals from Consent Mode, which the Cookiequiet snippet from the dashboard sets with data-consent-mode="1"; see the Consent Mode guide.
• Records. Export the consent records OneTrust keeps before closing the account; they prove choices made under the old banner.

Removing OneTrust

OneTrust's documentation shows its loader as a script from your OneTrust CDN location ending in otSDKStub.js, with a data-domain-script attribute holding your domain ID, followed by an empty OptanonWrapper function. Remove both, and the auto-blocking script if you enabled it, in the same release that adds the Cookiequiet snippet in their place. OneTrust's own cookies (such as OptanonConsent and OptanonAlertBoxClosed) stop being set and expire on their own.

After the switch

In a private window, confirm that no analytics or advertising request is sent before a choice, nothing new after Reject all, and everything after Accept all. A scan should show Cookiequiet as the only consent tool and Consent Mode detected. Setup is one script tag before your other scripts, with Reject all on by default and the cookie table filled from the scan; Starter adds a one-year consent log with CSV export, weekly rescans and an extra domain, and Pro keeps the log five years with up to 5 extra domains (see pricing).