Migrating from OneTrust to CookieScript involves more than replacing your Cookie Banner. You need to preserve your existing consent records, recreate your cookie categories and blocking rules, update Google Tag Manager (GTM) and Google Consent Mode where applicable, and remove OneTrust without disrupting tracking. The safest approach is to prepare and test CookieScript before switching production.

Follow these six steps:

1. Audit your OneTrust setup. Identify where OneTrust is installed, how it blocks scripts, and which GTM triggers, consent events, regional rules and custom functions depend on it.
2. Preserve records and map categories. Save your historical consent data and configuration, then review how your existing cookie categories and technologies should be classified in CookieScript.
3. Configure CookieScript in staging. Set up your banner, categories, languages and regional settings in a test environment, and plan consent recording for production.
4. Rebuild consent controls. Replace OneTrust's script-blocking logic and, where applicable, its GTM dependencies, custom consent events and Google Consent Mode configuration with the appropriate CookieScript mechanisms.
5. Test the complete consent lifecycle. Verify acceptance, rejection, category preferences, consent changes, script execution and tracking behaviour across relevant pages and regions.
6. Complete the production cutover. Remove OneTrust scripts and obsolete integrations, activate CookieScript, update your Cookie Settings links and verify that everything works correctly.

A saved OneTrust choice is not automatically a CookieScript preference, and historical OneTrust consent records remain separate from those generated after launch.

Avoid running OneTrust and CookieScript as independent consent management platforms (CMPs) controlling the same production tags, as this can create conflicting blocking rules and consent signals.

Can You Transfer OneTrust Settings and Consent Preferences to CookieScript?

There is no documented automatic transfer of OneTrust settings to CookieScript. OneTrust values such as data-domain-script, category IDs and GTM conditions can guide your audit, but you must recreate the relevant configuration in CookieScript.

Existing visitor choices are a separate issue. OneTrust stores them through OptanonConsent and category/group state, while CookieScript maintains its own consent state. There is no documented conversion path between them, so do not treat an old OneTrust cookie as an active CookieScript preference. Decide how CookieScript will handle returning visitors.

That does not mean every returning visitor must automatically consent again. Changing CMPs alone does not create a universal legal obligation to request consent again. If the purposes or scope of consent have changed, review your compliance requirements before deciding whether to request a new choice.

Step 1: Audit and Document Your OneTrust Setup

Audit both the installation points and the code that relies on OneTrust. You will need this inventory when rebuilding consent controls in Step 4.

Find Every OneTrust Installation Point

OneTrust’s publishing documentation distinguishes testing and production domain scripts. Check these installation points:

• HTML source, rendered pages and the global website header
• Themes, page templates and CMS script-injection settings
• GTM containers and other tag-management configurations
• Regional and language-specific pages
• Other domains, subdomains and cached page versions
• Locally hosted OneTrust scripts

Search your codebase, HTML and GTM for otSDKStub.js, OtAutoBlock.js, data-domain-script, OptanonWrapper, OnetrustActiveGroups and OptanonConsent. Check preference links for ot-sdk-show-settings and cookie lists for ot-sdk-cookie-policy.

This is a documented OneTrust CDN pattern; XXXXXX is a placeholder. Auto-Blocking installations may also load OtAutoBlock.js (OneTrust installation example):

<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js"          type="text/javascript" charset="UTF-8"          data-domain-script="XXXXXX"></script>  <script type="text/javascript">    function OptanonWrapper() { }  </script>

Record Blocking, GTM, Regional and Custom Dependencies

Your site may use OneTrust Auto-Blocking, GTM controls or JavaScript type-rewriting. Identify which governs each technology. If OtAutoBlock.js is active, record source-URL classifications, exceptions and GTM rules.

You may find OneTrust type-rewritten scripts like this. Verify the category ID in your tenant:

<script type="text/plain" class="optanon-category-C0002">    // Existing consent-dependent code  </script>

OneTrust’s client-side documentation describes consent-dependent helper methods such as OneTrust.InsertScript. Inspect every function OptanonWrapper() for these methods, SDK calls and category checks, and record what they control before replacing them.

In GTM, review your tags, variables, triggers, lookup tables and custom JavaScript for:

• References to OnetrustActiveGroups or OptanonConsent
• Your OneTrust category IDs and related conditions
• Listeners for OneTrustGroupsUpdated or other consent events
• Code that needs a saved consent state or a new visitor action

OneTrust’s GTM guide documents OneTrustGroupsUpdated on page load and after preference updates, while OTConsentApplied follows an explicit action. Use those differences to choose new triggers for saved consent versus fresh user actions.

Record any OneTrust geolocation rules that change templates or consent models by region. The default banner may not show you what visitors in other locations see.

Step 2: Preserve Records and Map the New Configuration

Keep evidence of previous consent decisions, but rebuild CookieScript’s categories around the technologies your site uses. Preserving records and mapping categories are separate tasks.

Export the OneTrust Information You Need

Before disabling OneTrust, save the records you need for audits and rollback. You can export Cookie Consent dashboard data for reporting, but those reports are not individual consent receipts. If your account has the feature and permissions, use Cookie Consent → Bulk Export to export CMP receipts. OneTrust limits this feature to customers with solution packaging and applies export-credit limits; confirm access before removing the old deployment.

You can also export website and scan data. Keep copies of:

• Category definitions, assignments and blocking exceptions
• Custom JavaScript and consent-dependent helper methods
• Banner screenshots, preference text and translations
• Geolocation rules, covered domains and regional consent models
• GTM container versions, events and Consent Mode settings

Use screenshots or configuration notes for settings you cannot export.

Map OneTrust Categories to CookieScript by Purpose

Review OneTrust’s Strictly Necessary, Functional, Performance, Targeting and Social Media categories, plus any custom categories. Investigate cookies flagged Unknown during scanning; that is not a final consent category.

CookieScript has five underlying cookie categories. You can rename the four non-essential category labels, but not Strictly Necessary:

• Strictly Necessary (strict)
• Functionality (functionality)
• Performance (performance)
• Marketing (targeting)
• Unclassified (unclassified)

Classify each technology according to its purpose and consent behaviour. Review OneTrust Social Media technologies individually.

Step 3: Configure CookieScript in Staging

Prepare CookieScript on a test copy with OneTrust disabled there, leaving production unchanged. This differs from CookieScript’s named Staging Mode for existing CookieScript sites; its pre-production option applies to not-yet-live websites.

Choose a supported installation method for each CookieScript banner:

• Add the script tag in the website <head>
• Use the CookieScript GTM Community Template
• Install through a supported CMS or platform integration

Install each banner once. Rebuild its wording, categories, languages and preference links without OneTrust code.

Install geo-targeted banners directly in <head>, not GTM. Outside their target region, those banners are hidden and their blocked scripts activate. If you use a separate global banner, follow the geo-targeting instructions and test regional coverage and blocking.

Run a CookieScript scan and compare the results with your OneTrust inventory, GTM tags and hard-coded scripts. Another active CMP can hide cookies from the scanner, which is why OneTrust must be disabled on the test copy.

Check video embeds, chat widgets and authenticated forms manually, because the scanner cannot complete every interaction or access protected pages.

If your sites use the same cookies or tracking technologies, you can configure cross-domain consent on CookieScript Plus. Test each domain and browser, including Safari and iOS, accounting for sharing restrictions.

If you need consent records, use a plan that supports Consent Recording; CookieScript lists this feature under Plus. Enable it in Main settings, then check and download new records from Consents after launch. CookieScript’s named Staging Mode does not record logs or statistics.

Step 4: Rebuild Script Blocking, GTM, and Google Consent Mode

Use the OneTrust audit to decide how each script or tag should respond to consent in CookieScript. Start with blocking, then replace GTM dependencies and Google Consent Mode settings where applicable.

Give Every Technology One Clear Control Path

Choose one consent-control path per technology: CookieScript automatic blocking, manual blocking or GTM. Automatic blocking is disabled by default and requires Standard or Plus.

• For page scripts, enable automatic blocking under Scripts, assign a category and mark each script for blocking. Load CookieScript first; rescan if needed.
• For hard-coded scripts, you can use the manual blocking attributes such as type="text/plain", data-cookiescript="accepted" and data-cookiecategory.
• For tags loaded by GTM, you can use consent-related triggers or conditions to control when they fire.

Avoid independently applying automatic blocking to the same tag already controlled by GTM. Rebuild old optanon-category-... markup using CookieScript syntax.

For a script classified as Functionality, CookieScript documents this manual blocking syntax. Set the file path and category based on the technology’s actual purpose:

<script type="text/plain"          data-cookiescript="accepted"          data-cookiecategory="functionality"          src="/js/myscript.js"></script>

Review server-set cookies separately: browser blocking cannot prevent cookies set by HTTP response headers. Requests for blocked remote scripts may still occur.

Replace OneTrust GTM Variables and Custom Events

For GTM tags using OnetrustActiveGroups, OptanonConsent or OneTrustGroupsUpdated, distinguish stored consent, an accepted category on page load and a new visitor action.

Use the Consent State variable for GTM conditions, or category GTM events such as CookieScriptCategory-performance when a category becomes available. Saved state alone does not indicate new acceptance.

For code responding to user actions, use events such as CookieScriptAccept, CookieScriptAcceptAll and CookieScriptReject. CookieScriptLoaded means readiness, not consent.

For example, a Performance tag should run when a returning visitor has already accepted that category. A trigger listening only for a new consent click could miss that visit. Conversely, category events can fire again on later page loads; check that they do not repeat actions intended only for a new choice.

These documented events distinguish category availability, accepting selected categories (when categories are enabled) and accepting all categories. Use the listener that matches the behaviour you need:

window.addEventListener('CookieScriptCategory-functionality', function() {    // Functionality category is accepted, including on a return visit.  });    window.addEventListener('CookieScriptAccept', function(event) {    // Selected categories: event.detail.categories lists those accepted.  });    window.addEventListener('CookieScriptAcceptAll', function() {    // Visitor accepted all categories.  });

When migrating code from OptanonWrapper(), distinguish helpers that load scripts from functions that update the page interface. Script-loading helpers need an appropriate consent-control path; interface updates may require a different event listener. Remove unused functions and test each retained dependency after the OneTrust wrapper is gone.

Configure Google Consent Mode Again

If your site uses Google Consent Mode, record its OneTrust integration: mappings, regional rules, tag defaults and Basic or Advanced behaviour.

Enable Google Consent Mode v2 in CookieScript. For the GTM Community Template, configure default consent and use Consent Initialization - All Pages.

For a direct gtag.js installation, put the default consent commands first in <head>, followed by gtag.js, the CookieScript banner code and your other scripts, in that order.

If you use direct gtag.js installation, the manual Consent Mode guide provides this initialisation pattern. It defines gtag() and sets consent defaults before gtag.js loads; you still need the Google tag and CookieScript banner code. Do not add this snippet to a GTM Community Template installation:

<script>    window.dataLayer = window.dataLayer || [];      function gtag() {      dataLayer.push(arguments);    }      gtag('consent', 'default', {      ad_storage: 'denied',      analytics_storage: 'denied',      ad_user_data: 'denied',      ad_personalization: 'denied',      wait_for_update: 500    });      gtag('set', 'ads_data_redaction', true);    gtag('set', 'developer_id.dMmY1Mm', true);  </script>

Check the Google consent signals relevant to your site:

• analytics_storage
• ad_storage
• ad_user_data
• ad_personalization

CookieScript’s dashboard validation covers its GTM Community Template and direct gtag.js installation. Remove obsolete OneTrust-specific consent commands, but retain unrelated Google configuration. Consent Mode does not control every non-Google script.

Step 5: Test the Migration Before Launch

Use a clean browser and developer tools to inspect scripts, network requests, cookies and console errors as you work through these scenarios:

1. First visit: Check the regional banner, initial consent state and requests sent before a choice.
2. Accept All: Make sure the scripts permitted by that choice can load.
3. Reject All: Check that non-essential scripts remain controlled.
4. Granular choice: Accept selected categories and verify that unrelated tags stay inactive.
5. Change or withdraw consent: Reopen settings, alter your choice and inspect the resulting tag behaviour.
6. Reload and return: Check that your site handles the saved preference across pages and later visits.
7. Private browsing: Repeat your first-visit tests without an existing consent state.
8. Regional and language variants: Test the domains and configurations your visitors actually use.

Where you use GTM, open Preview to verify CookieScript triggers and find any leftover OneTrust conditions. If Google Consent Mode is configured, inspect its initial and updated signals using the Consent Mode troubleshooting instructions.

Test login, form submission, checkout, embedded media and chat. These checks catch functionality that a cookie inventory cannot verify.

Step 6: Remove OneTrust and Complete the Production Cutover

Publish the site and GTM changes as one coordinated cutover:

1. Confirm that your OneTrust exports and configuration snapshots are safely stored.
2. Save the current site build and published GTM version as rollback points.
3. Prepare a site build that removes the old OneTrust scripts and Auto-Blocking, installs the tested CookieScript configuration and replaces old preference links.
4. Prepare the matching GTM changes, removing obsolete OneTrust conditions and configuring CookieScript consent controls and Consent Mode where applicable.
5. Deploy the site and GTM changes together so you do not leave production tags without their intended consent controls.
6. Clear relevant CMS, application and CDN caches so visitors receive the new implementation.
7. Immediately test the live banner, blocking rules, consent updates and critical tags; if Consent Recording is enabled, also check new CookieScript records.

Replace old OneTrust links in your footer, privacy pages and mobile navigation. The documented csconsentlink class opens settings:

<button class="csconsentlink">Cookie Settings</button>

You can also use the csconsentlink ID or CookieScript.instance.show() where appropriate.

Search live HTML, network requests, GTM, templates, plugins, local files and caches for otSDKStub.js, OtAutoBlock.js, OptanonWrapper and old OneTrust triggers.

Removing OneTrust does not itself erase its cookies. By default, CookieScript deletes existing non-essential cookies before consent; enabling Keep cookies until consent changes this. Check how OptanonConsent and OptanonAlertBoxClosed are classified and whether old code still uses them.

After launch, monitor:

• Your analytics traffic and important conversions
• Advertising requests, duplicate events and Consent Mode signals
• JavaScript errors and Cookie Settings controls
• Regional banner behaviour and user reports

On Standard or Plus, enable automatic monthly cookie scanning to keep your cookie declaration updated as the website changes. Review new scan results and run a manual scan after significant changes instead of waiting for the next scheduled scan.

On Plus, you can enable Cookie Banner Analytics in Main settings to review acceptance, rejection and cookie-category selections. These figures measure consent-banner interactions, not whether analytics or advertising tags work correctly.

If rollback is necessary, restore your previous site and GTM versions together instead of running both CMPs indefinitely.

Common OneTrust-to-CookieScript Migration Problems

1. Two banners appear: Look for an old OneTrust injection or a second CookieScript installation in your templates, plugins or GTM.
2. Tags fire before consent: Check your script order, blocking rules, GTM triggers and Consent Mode defaults.
3. Tags stay blocked after acceptance: Look for overlapping GTM and automatic blocking or a leftover OneTrust category condition.
4. Analytics or conversions change unexpectedly: Compare your triggers, mappings and Basic or Advanced Consent Mode behaviour.
5. Cookie Settings won’t open: Check whether the link still calls OneTrust rather than the CookieScript preference control.
6. The wrong regional banner appears: Review your geo-targeting and confirm that geo-targeted code is in the site header.
7. Some pages still load OneTrust: Inspect alternate templates, other domains, locally hosted scripts and cached HTML.

Conclusion

Your migration is complete when CookieScript governs consent, critical tags and site functions pass production checks, no obsolete OneTrust code controls tracking, and historical records remain available.

CookieScript is a Consent Management Platform (CMP) that Google includes among the CMP partners available for Consent Mode setup. It is also a Google-certified CMP with Gold tier status.

A 14-day free trial of the Plus plan is available without requiring a credit card.