Search

Unified Consent Setup Flow

From provisioning to live cross-domain consent — five stages, end to end.

S T A G E   0 1
Prepare
Gather what you need from TrustArc and confirm prerequisites.
1
Receive credentials
From TrustArc:
• CCM_SECRET_KEY (base64)
• CCM_KEY_ID

Store the secret in your secret manager — never commit it.
→
2
Confirm authentication
Each user needs a stable ID:
✅ Internal user ID
✅ Hashed username / email
❌ IP, session ID, temp tokens

Anonymous users still see banners.
→
3
Align CCM instances
All grouped instances must share:
• Identical consent categories
• Synchronized configuration

Mismatched categories will break synchronization.
↓
S T A G E   0 2
Backend
Generate the HMAC signature server-side so the secret key is never exposed.
Server-side signature generation
Run on every page render where unified consent is needed. The secret key never leaves your server.
4
Resolve user identity
Read the authenticated user's stable ID from your auth layer.
const userId =
  req.user.uuid;
→
5
Compute HMAC-SHA256
Sign the user ID with the secret key, output as base64.
crypto.createHmac(
  'sha256', secretKey)
→
6
Pass to template
Hand userId, authMac, and keyId to the page renderer.
res.render('index',
  { ccmUserId, ... })
↓
S T A G E   0 3
Frontend
Inject user context into the page before the CCM script loads.
Inject user context, then load CCM
Order matters: window.truste.eu.user must exist before the consent.trustarc.com script runs.
7
Set window.truste.eu.user
window.truste.eu.user = {
  id: ccmUserId,
  authMac: ccmAuthMac,
  authSecretId: ccmKeyId };
→
8
Load CCM notice script
<script src=
  "https://consent.trustarc.com
  /notice?domain=...&js=bb"
></script>
↓
S T A G E   0 4
Test
Verify consent syncs across domains for the same user.
End-to-end verification
Same authenticated user, two domains. Confirm the second visit is silent.
9
Consent on Site A
Sign in as user X. Accept or customize preferences on the first domain.
→
10
Visit Site B
Open the second grouped domain while signed in as the same user X.
→
11
Confirm sync
Verify: no banner appears, preferences from Site A are applied automatically.
NO — debug
signature / config
All checks pass?
YES →
S T A G E   0 5
Go Live
Unified consent is now active across domains and devices.
Unified Consent is live
Cross-domain sync
Immediate on first visit to a new domain.
Preference updates
Propagate within 24 hours across devices.
Reduced banner fatigue
Authenticated users skip repeated prompts.
Key considerations
Security
Generate authMac server-side only. Never expose CCM_SECRET_KEY in client code or version control.
Sync Timing
First visit: immediate sync. Updates: within 24 hours. Manual: clear consent_sync cookie.
Disclosure
Update banner copy and privacy policy to disclose unified consent across browsers, apps, and sites.
Scope
Authenticated users only. Designed for CCPA/CPRA — check with legal for region-specific use.

Consent retention: 1–13 months, configurable in CCM. Anonymous users continue to see banners on each domain/device.
Source: TrustArc Unified Consent Configuration Guide.