# Switch from OneTrust to Cookiequiet

> Move a site from OneTrust cookie consent to Cookiequiet: map the C0001 to C0005 groups, convert optanon-category tags and data-src iframes, swap the scripts.

Source: https://cookiequiet.com/guides/switch-from-onetrust
Published: 2026-10-21
Publisher: Cookiequiet

## Steps

1. **Check the TCF question** If OneTrust serves as your IAB TCF CMP for Google AdSense, Ad Manager or AdMob in Europe, keep a Google-certified CMP for those ads.
2. **Add the site and scan it** Create the website in Cookiequiet and run the scan to fill the cookie table and list trackers.
3. **Convert blocked scripts** Replace optanon-category classes with data-cq-category: C0002 to analytics, C0003 to functional, C0004 and C0005 to marketing, keeping type text/plain.
4. **Convert blocked iframes** Rename data-src to data-cq-src and add data-cq-category.
5. **Rewire the settings button and code** Replace ot-sdk-show-settings with data-cq-show-preferences, and OptanonWrapper logic with the cq:consent event.
6. **Swap the scripts in one release** Remove otSDKStub.js, OptanonWrapper and any OneTrust auto-blocking script, and paste the Cookiequiet snippet first in the head.
7. **Verify** Check the three paths in a private window, run a scan, and regenerate the cookie policy.

Switching a website from OneTrust's cookie consent to Cookiequiet means removing OneTrust's script stub and its `OptanonWrapper` function, adding one Cookiequiet script tag first in the head, converting the tags you blocked with `optanon-category-C000X` classes to Cookiequiet's `data-cq-category` attribute, renaming `data-src` to `data-cq-src` on blocked iframes, and pointing the "Cookie Settings" button at the new preferences centre. One check comes first: if OneTrust is your IAB TCF CMP for Google AdSense, Ad Manager or AdMob ads in Europe, stay on a certified CMP for those ads, because Cookiequiet is not one.

## Should you switch?

OneTrust is a broad privacy platform. Sites that use it only for a cookie banner on one or a few websites often find that a lighter tool covers the same ground: blocking until consent, Google Consent Mode v2, a preferences centre, a consent log and a cookie policy. Cookiequiet is free for one website and costs €3 per website per month on Starter, with no pageview limit; the [cost calculator](/tools/cookie-banner-cost-calculator) compares totals for your sites and traffic, and the [comparison page](/vs/onetrust) lists the differences.

Stay on a TCF CMP if you serve programmatic ads to visitors in the EEA, the UK or Switzerland. Google requires a Google-certified CMP integrated with the IAB TCF for AdSense, Ad Manager and AdMob there, and Cookiequiet is not a Google-certified CMP for the TCF. [TCF for publishers](/guides/tcf-for-publishers) explains when it applies.

## How do OneTrust's groups map?

OneTrust identifies cookie categories by group IDs. Its documentation uses C0002 for performance cookies, C0003 for functional cookies and C0004 for targeting cookies; in most setups C0001 is strictly necessary and C0005 social media, but check the IDs under Categorizations in your OneTrust admin, since custom groups get other IDs.

| OneTrust group | Cookiequiet category |
|---|---|
| C0001, Strictly necessary | necessary (leave the tag unmarked) |
| C0002, Performance | analytics |
| C0003, Functional | functional |
| C0004, Targeting | marketing |
| C0005, Social media | marketing |

OneTrust's performance group holds analytics tools such as Google Analytics, which is why it maps to analytics rather than functional.

## What changes in the markup?

OneTrust's client-side cookie management article describes JavaScript type rewriting: the script gets `type="text/plain"` and a class naming its group, and OneTrust activates it after consent. Several groups can be listed in one class, such as `optanon-category-C0002-C0003-C0004`. Cookiequiet does not read the class, so add its own attribute and drop the class:

A script blocked for OneTrust:

```html
<script type="text/plain" class="optanon-category-C0002"
  src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
```

The same script for Cookiequiet:

```html
<script type="text/plain" data-cq-category="analytics"
  src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
```

For a tag listed under several groups, pick the strictest one (marketing if C0004 or C0005 is among them), since Cookiequiet uses one category per tag.

For iframes, OneTrust moves the URL to `data-src` and adds the group class. Cookiequiet reads `data-cq-src`:

```html
<iframe data-cq-src="https://www.youtube-nocookie.com/embed/VIDEO_ID"
  data-cq-category="marketing" title="Video"></iframe>
```

Scripts that OneTrust's auto-blocking held without markup are covered by Cookiequiet's auto-blocker when the host is among the about 80 trackers in its provider database; mark the rest by hand, as described in [block scripts until consent](/guides/block-scripts-until-consent).

## What else needs rewiring?

- **The settings button.** OneTrust opens its preference centre from elements with the class `ot-sdk-show-settings` (often the button with id `ot-sdk-btn`). Replace it with an element carrying `data-cq-show-preferences`, or a link to `#cq-preferences`.
- **OptanonWrapper and OneTrust events.** Code inside `OptanonWrapper`, or listening for `OneTrustGroupsUpdated`, should listen to the `cq:consent` window event or use `window.Cookiequiet.on(callback)`; `window.Cookiequiet.get()` returns the stored choice.
- **Google Tag Manager.** Triggers built on OneTrust's dataLayer variables (the active groups) move to the `cq_consent` event and its `cq_analytics`, `cq_marketing` and `cq_functional` flags. Google tags take their signals from Consent Mode, which the Cookiequiet snippet from the dashboard sets with `data-consent-mode="1"`; see [the Consent Mode guide](/guides/google-consent-mode-v2).
- **Records.** Export the consent records OneTrust keeps before closing the account; they prove choices made under the old banner.

## Removing OneTrust

OneTrust's documentation shows its loader as a script from your OneTrust CDN location ending in `otSDKStub.js`, with a `data-domain-script` attribute holding your domain ID, followed by an empty `OptanonWrapper` function. Remove both, and the auto-blocking script if you enabled it, in the same release that adds the Cookiequiet snippet in their place. OneTrust's own cookies (such as OptanonConsent and OptanonAlertBoxClosed) stop being set and expire on their own.

## After the switch

In a private window, confirm that no analytics or advertising request is sent before a choice, nothing new after Reject all, and everything after Accept all. A scan should show Cookiequiet as the only consent tool and Consent Mode detected. Setup is one script tag before your other scripts, with Reject all on by default and the cookie table filled from the scan; Starter adds a one-year consent log with CSV export, weekly rescans and an extra domain, and Pro keeps the log five years with up to 5 extra domains (see [pricing](/pricing)).

## Questions

### Does Cookiequiet read OneTrust's optanon-category classes?

No. It reads its own data-cq-category attribute and a few attributes other banners use, but not OneTrust's classes. Keep type text/plain on each blocked script and add data-cq-category with the mapped category.

### Can I replace OneTrust if I show AdSense ads in Europe?

Not for those ads. Google requires a Google-certified CMP integrated with the IAB TCF for AdSense, Ad Manager and AdMob in the EEA, the UK and Switzerland, and Cookiequiet is not one. Keep a certified CMP on sites with those ads.

### What do I do with code inside OptanonWrapper?

Move it to a listener for the cq:consent window event, or to Cookiequiet.on, which runs when the visitor makes or changes a choice. Cookiequiet.get returns the stored choice on page load.

### Will visitors see the banner again?

Yes, once. OneTrust stored their choice in its own cookies, which Cookiequiet does not read, so returning visitors choose again and the new consent log records it.

## Sources

- [OneTrust, Client-side cookie management (JavaScript type rewriting and iFrame blocking)](https://my.onetrust.com/articles/en_US/Knowledge/UUID-518074a1-a6da-81c3-be52-bae7685d9c94)
- [OneTrust Developer Portal, Single page applications (otSDKStub.js, OptanonWrapper, ot-sdk-show-settings)](https://developer.onetrust.com/onetrust/docs/single-page-applications)
- [OneTrust Developer Portal, Google Tag Manager](https://developer.onetrust.com/onetrust/docs/google-tag-manager)
- [Google AdSense Help, Google consent management requirements for serving ads in the EEA, the UK, and Switzerland](https://support.google.com/adsense/answer/13554116?hl=en)