Version: 1.4
Last Updated: July 15, 2026
TrustArc's Cookie Consent Manager ("CCM") is served via a few lines of JavaScript ("JS") embedded in the HTML of any webpage where a CCM user chooses to require end users' consent. While most choose to implement the JS in the footer, it can be placed anywhere within the HTML.
Once implemented, the CM utilizes a geo-based IP address library to do a reverse lookup on the location of the end user arriving on the page. No full user IP address data is stored; it is translated to country codes aggregated for reporting purposes only.
The TrustArc platform is able to apply location-based logic to the CM to allow the appropriate notice behavior, such as an Implied Consent Banner or an Expressed Consent Window (described more fully below), based on the end user's locale. What this means is that a site owner can implement the same script across their site, and the CM backend logic will determine which version of the notice should be displayed based on the end user's IP/locale.
In addition to behavior by location, language can be loaded by location, or set to dynamically translate based on the end user's browser language setting.
The CM can be integrated with a Tag Management System such as Google Tag Manager, Tealium or Adobe DTM to control the firing of tags based on the level of consent provided by the end user. Similarly, a Consent Manager API can be used to determine whether a particular vendor domain is approved or denied, which in turn can be used to control firing of tags that sit outside a Tag Management System. Finally, instead of a tag manager or API integration, there is also the option of integrating with and firing a vendor's opt-out mechanism. Each is discussed further in this guide.
Note that because of the nature of the vendor opt-outs method, using that integration--in contrast to a tag manager or the Consent Manager API--does not allow for cookies or tracker scripts to be suppressed when a new end user accesses a website. Instead, that method allows for opting out of cookies that were initially loaded onto the end user's browser.
Upon detection of an end user from a country where Implied Consent behavior has been configured, a Cookie Banner can be shown to provide a form of disclosure and consent. "Implied consent," for CM purposes, denotes an uninterrupted end user experience, such that a consent selection is not required in order for a visitor to access a site. Although the end user has the option to make a consent selection, if they do not wish to do so they may still freely access and navigate the site and the banner will continue to show. At this point no consent is recorded because the end user took no affirmative action.
A user can click Accept or Decline All to close the banner, or click on More Information to open the Consent Manager pop-up window. This is an example language; CM supports customizing this verbiage.
A Cookie Preferences button or link is available to allow the user to make a subsequent form of consent, or to revoke consent.
TrustArc can hold styling of the Banner or Cookie Preferences element. CM users are also able to override styling using inline CSS styling.
CM is capable of supporting customized verbiage for the Cookie Banner, Cookie Preferences element, and the popup configuration window. Where out-of-box verbiage is used, TrustArc has translations available in 40+ languages.
The Consent Manager Deployment Guide provides additional guidance on implementation as well as options for visual and functional adjustments.
Upon detection of an end user from a country where Expressed Consent behavior has been configured, a modal window overlay will popup. The user can opt in/out to Functional or Advertising categories. "Expressed consent," for CM purposes, denotes an interrupted end user experience, such that upon the webpage loading, the visitor must make a consent selection in order to further access the site.
On submission, CM will save the end user's setting/preferences in their browser using first-party cookies and local storage objects. TrustArc's cookies can be read by a tag manager (e.g., Google, Adobe, Tealium) to control firing of non-essential tags. This can be used to hold back firing of tags if the end user is visiting from an EU IP address, such as until they consent. Once their consent choice is made, on the next page load, the approved tags can fire and related cookies can drop.
Alternatively, a Consent Manager API is available to retrieve end user consent preferences. We can also support firing third-party vendor opt-out mechanisms.
Under Detailed Settings, the end user can view a list of the different cookies and related tracking technologies ("Cookies") found on the Website. Once the end user makes a consent choice, the CM by default will not show again for a period of 13 months, although CM users may optionally set a specific date/time on which all end users will be prompted to re-consent (see the Re-Consent section). This backend operation may also be used if, for example, a processing purpose changes and new consent is required.
TrustArc's CM supports different default opt-in or opt-out statuses for a site's bucketed cookie categories depending on the IP address location of the end user.
For example, if CM detects the end user is from the EU, it can show the Functional/Advertising buttons as de-selected and disable the submit button until a selection is made, or it can show a default of NO.
For non-EU end users, for instance, CM can show a default of YES for Functional/Advertising.
TrustArc utilizes a Maxmind GeoIP2 database to determine what country a user is from. This database is stored on TrustArc servers to improve performance and is generally updated weekly.
When an end user visits the website where the TrustArc script runs, the Consent Manager displays behavior based on their IP address location and how that country was configured by the CM user on the TrustArc backend.
On a per country basis, CM may be configured to suppress or hide the Consent Manager--for instance, by providing an Implied Consent experience via a Cookie Banner--or show the CM by providing an Expressed Consent experience such as via a modal window popup.
CM also drops a notice_behavior cookie that can be used by the tag manager to determine firing rules based on whether the end user is from the EU or not (for example, setting up a "zero-cookie load" with a tag manager or Consent API integration where non-essential tags are not immediately fired on first page load if the end user is in the EU and has not yet consented to some or all non-essential trackers). For more details on how the notice_behavior cookie works, see the description of this cookie in the TrustArc Cookies section.
Example GEO IP Lookup Flow Chart:
Below is a decision flow chart based on a new end user first encountering the CM when integrated with a tag manager (e.g., Google, Adobe, Tealium), where the tag manager is blocking or controlling the firing of tags and the dropping of Cookies based on the end user's level of consent in the CM.
Where a Tag Management System like Google Tag Manager is not available to control firing of tags based on consent, the Consent Manager API can be used to determine if a particular vendor domain is approved/denied.
Companies may first use TrustArc's Website Monitoring Manager to crawl their websites to capture all tracking technologies and the related vendor domains, which can then be listed in the categories within the Consent Manager (i.e., Functional or Advertising Cookies).
Code can then be developed to wrap the tags in a page template which would either leverage a Subscription (Method 1) or a Specific Call (Method 2) to control firing of the tag.
See the Cookie Consent Manager - API Integration Guide for more details.
Method 1 — Subscribe for automatic notifications
TrustArc can automatically notify a third-party on the publisher's site, the publisher itself, or the tag management company a publisher works with when an end user sets his/her privacy preferences or updates a previously expressed one. To receive this notification, pass a Javascript callback function in the following way:
var apiObject = {PrivacyManagerAPI:
{ action:"getConsent",
timestamp: new Date().getTime(),
self: "domainThatIsAsking.com" }};
var json = JSON.stringify(apiObject);
window.top.postMessage(json,"*");
window.addEventListener("message", yourMessageHandler, false);
where yourMessageHandler is the javascript function that handles PostMessage events.
Method 2 — Determine whether a particular type of tracking would be allowed on a specific domain. Make the following call:
var json = truste.cma.callApi("getConsent",
"domainThatIsAsking.com",
"targetDomain.com",
"authorizingBodyDomain.com",
"type1,type2,type3,...");
Cookie objects store data locally within the end user's browser. Below is a sample of TrustArc Cookies dropped on the end user's browser when the end user opted YES for Advertising and Functional with the "Granular UI Version" of Cookie Consent Manager on www.trustarc.com:
This cookie drops the behavior configured for the country from which the end user's IP address originates. The cookie value corresponds to the actual configuration for the country in the TrustArc Consent Manager Admin portal and indicates if the country is set to be Implied or Expressed mode. The second value corresponds to which visual layout will be displayed (values are either EU or US). For example, "EU" might denote the end user is from the EU region and will see the EU layout, and "US" might denote the user is from the U.S. region and will see the US layout. An EU layout could also be assigned to a non-EU region, for example if we need to show a banner for non-EU countries. This is a value that is configured on the TrustArc back end as well. These configurations are determined by the CM user and provided to TrustArc to implement per the CM user's instructions.
These are the possible values for this cookie:
This cookie indicates the user's preference level selection specifically on the legacy "Slider UI" version of Consent Manager. The slider combines levels in an inclusive manner. For example, when one has the slider set to Advertising, this includes consent for Functional.
Cookie expiration: 13 months
These are the possible values for this cookie:
For example, if a user sets the slider to Advertising, then the value returned would be 2.
This cookie indicates the end user's preference level selection.
Cookie expiration: 13 months
These are the possible values for this cookie:
Since there are individual YES/NO options for each bucketing category in the Granular UI approach, we indicate a number value if YES has been selected.
For example, if an end user selects YES to Advertising Cookies level, but NO to Functional Cookies level, then the value returned would be [0,2]. 0 is always present for Required Cookies. In this example, 1 for Functional does not show in the cookie value because the end user chose NO for Functional, and 2 exists because the end user chose YES for Advertising.
This cookie is used for Google Tag Manager only and indicates the end user's preference level. It will work for both Slider or Granular UI versions of the Consent Manager.
Cookie expiration: 13 months
These are the possible values for this cookie:
This cookie is used for Google Tag Manager only and uses specialized codes to indicate a preset list of tags that should be blacklisted.
Cookie expiration: 13 months
If only Required Cookies are approved, then an example value might be: ga-ms-ua-ta-asp-b zi-sp-awct-cts-cs m-img-flc-fls-mp m-mpr-m6d-tc-td.
This cookie is used to prevent repeated GPC-based opt-outs after a user has previously opted in. This is relevant for CPRA compliance and honoring Global Privacy Control (GPC) signals. If a user has previously opted in (for example, to a financial incentive program) and then later enables a GPC signal, the site honors the GPC opt-out only once. After that, the system respects the user's decision to stay opted in and does not reapply a GPC-driven opt-out on future visits. This cookie only drops if the GPC setting is marked as "Apply and Override."
Cookie expiration: 13 months
This cookie stores the last pop-up date and time of the Consent Manager. It is used to determine if Consent Manager should be shown again when the re-consent feature is activated in the Consent Manager Admin Portal. Read more about this feature in the Re-consent section.
Cookie expiration: 13 months
User Unique Identifier (cookie only drops if Consent UID feature is enabled). Read more about this feature in the Consent User Identifier (UID) section.
Cookie expiration: 13 months
Used to distinguish between different sessions for Consent Manager reporting.
Cookie expiration: 30 minutes
This cookie contains domain values that may differ in consent from the notice_gdpr_prefs cookie. The optout_domains local storage value is updated when the CCM script loads. This ensures consistent consent tracking across different parts of the site.
This cookie makes the local storage entry optout_domains consistent between parent and subdomain(s) when pcookie feature is enabled. The value is all the differences between tracker level and category level consent (i.e. tracker level opt-outs when category level is opted in) in the form of category order and tracker domains.
Please note that this is subject to the 4KB cookie size limit, and the optout_domains_pc cookie logic does not run on unprovisioned locations. The value will be "skip" if the difference is more than 4096 bytes. Data above 4KB is not yet supported.
Example:
{"1":{"d":["lh3.googleusercontent.com","www.taboola.com"]},"2":{"d":["www.1und1.de"]}}
If notice_gdpr_prefs is 0,1,2, where the setup is the default (0 - required, 1 -functional, 2 - advertising). This indicates that in functional category, all trackers are opted in except for the vendor associated with lh3.googleusercontent.com and www.taboola.com, and in advertising category all trackers are opted in except for the vendor associated w/ www.1und1.de.
Instead of parsing this cookie directly, we recommend using CM API's getConsentCategory to get the domain level consent values instead.
Cookie expiration: 13 months
Used to test if the browser allows third party cookies.
Used to notify the Consent Manager if the browser allows third-party cookies.
Used to distinguish between different sessions of the Consent Manager.
By default, TrustArc cookies are scoped to the domain of the website being visited. For example, if visiting blogs.trustarc.com, the TrustArc cookies will be scoped to this domain. This means if our script is also deployed on www.trustarc.com, the user will also need to consent there. To avoid having users consent multiple times on sites with the same root domain, the pcookie parameter can be used in the TrustArc script. This causes the TrustArc cookies to then be scoped to the parent domain (i.e., trustarc.com) which can then be read from any subdomain site.
_gd[0-9] cookies are dropped and checked to determine the top level domain where cookies are allowed. This is used for the pcookie (parentCookie) feature.
LocalStorage objects store data locally within the end user's browser. Below is a sample of localStorage objects when an end user Opted YES for both Advertising and Functional with the Granular Version of Cookie Consent Manager when visiting from a non-EU country to www.trustarc.com:
This object shows a granular view of approval for each vendor. The values can be retrieved through the use of our API or directly from the localStorage object. This is useful if one needs to determine which tags to fire based on the level of consent given by the user.
Example from www.trustarc.com where only Required Cookies is approved:
Example from www.trustarc.com where Required, Functional, and Advertising Cookies are approved:
Same logic as notice_preferences cookie where there can be a single value of either 0, 1, or 2.
Sample from www.trustarc.com where both Advertising and Functional Cookies were set to YES:
{name: "truste.eu.cookie.notice_preferences", value: "2:", path: "/", expires: 1581147964127}
expires: 1581147964127
name: "truste.eu.cookie.notice_preferences"
path: "/"
value: "2:"
Same logic as notice_gdpr_prefs cookie where there can be separate values of 0, 1, 2 separated by a comma, where if one of these values exists, it indicates that the related bucket category is approved.
Sample from www.trustarc.com where both Advertising and Functional Cookies were set to YES:
{name: "truste.eu.cookie.notice_gdpr_prefs", value: "0,1,2:", path: "/", expires: 1581147964127}
expires: 1581147964127
name: "truste.eu.cookie.notice_gdpr_prefs"
path: "/"
value: "0,1,2:"
Same logic as notice_poptime cookie. See description in TrustArc Cookies section. An example value of object could be as follows:
{name :"truste.eu.cookie.notice_poptime", value: "1522979100000", path: "/", expires:
1576288683413}
Same logic as TAconsentID cookie. See description in TrustArc Cookies section. An example value of object could be as follows:
{name: "truste.eu.cookie.TAconsentID", value: "a962ddd1-fa8d-4065-989c-39a33aa1dd91", path: "/"
expires: 1576393941734}
Drops only when Cross-Domain Consent feature is enabled.
This stores the following:
Consent value is validated to be a number or comma separated numbers. Consent resolution is validated to have the allowable values (expressed|implied|eu|us).
Saved to consent.trustarc.com or consent.truste.com.
If an end user from a non-EU country (based on their IP address) visits a site and makes a consent choice using the Cookie Consent Manager, a company may want the end user to provide explicit consent if their physical location changes to an EU country and they revisit the site.
Consent Resolution is a feature that can be enabled on the TrustArc backend that enables this capability.
This feature uses the notice_gdpr_prefs cookie, which can have one of the following values:
If the previous value of cookie had "US" and our geolocation now detects the user is based in the EU when the Consent Resolution feature is enabled, then the Consent Manager will show again for that user and request the user to re-consent.
The Consent User Identifier (UID) is an optional feature that can be enabled on the TrustArc backend. It is disabled by default. Enabling this feature will set a cookie and localstorage object with a randomly generated unique identifier (UID) value to each end user's browser the first time a consent preference is submitted. These objects will expire automatically after 13 months.
The Consent UID is passed to TrustArc and stored in our database and on the end user's browser to tie the end user's consent to this unique parameter. Consent Manager users who wish to pass a unique identifier for their own more comprehensive internal auditing purposes may find this feature useful.
For instance, website end users that request a record of their consent history could be instructed to view their browser's cookie details and provide you with this UID value, thereby making it easier for you to download a report specific to their consent history.
The Consent UID can be viewed using the GDPR Compliance Reporting Widget on the Consent Manager Admin Portal, or in the downloaded spreadsheet.
See more information on the TAconsentID cookie and truste.eu.cookie.TAconsentID localStorage object under the TrustArc Cookies and Local Storage Objects section.
It is recommended that you consult with your legal counsel regarding incorporating disclosures about Consent UID practices into your Privacy Policy or Cookie Policy, as applicable.
The Consent Manager can be configured to force re-consent. Normally, after a user makes a consent choice, the Consent Manager by default will not show again for a period of 13 months--although end users should be able to withdraw or update their consent selections by accessing the Cookie Preferences button or link on your website, as described in this guide.
But if, for example, a processing purpose changes, or you wish to change the cookie "buckets" in your CM, or some other update occurs that you believe should prompt all previously consented end users to be requested for their consent again, then a configuration can be made in the TrustArc backend to trigger re-consent starting on a specific date/time by using this feature.
If this feature is enabled on the backend, when the user revisits the site, a notice_poptime cookie and localstorage object will be dropped on their browser after they Re-consent, indicating when they reconsented.
For users with Implied Consent Banner behavior, they will see the Cookie Banner again. For users with the Expressed Consent Window Popup behavior, they will see the popup again.
Depending on how the backend is configured, the message Pop-up Message may show in either the Cookie Banner or the Popup Window.
Generation of Aggregate and User Reporting indicating usage of the Consent Manager is available from the Consent Manager Admin Portal and is described in more detail (including column legends) in the TrustArc Cookie Consent Manager - Reporting Guide. The Reporting Widgets can be accessed to generate and download different reports.
Sample report of aggregate usage reporting showing number of visits and types of consent given:
Sample user report shows how a specific user (pseudonymized) consented to specific tracking vendors:
The load times for the Consent Manager will vary depending on if the Implied Consent Banner Experience is used versus the Expressed Consent Popup experience is used.
For Support on Cookie Consent Manager please contact your designated Technical Account Manager, or feel free to reach us at its@trustarc.com.