OneTrust is installed.
Does it block?

The most common causes

The banner shows, the choice is saved, and data still goes out. Usually the script carries no OneTrust category.

1. 01

   Script tag without a category

   The browser runs a normal script tag right away. OneTrust only holds it back once it has type="text/plain" and the category class, for example class="optanon-category-C0002" for performance.

   Art. 5(3) Directive 2002/58/EC

2. 02

   Auto-blocking does not know the service

   Automatic blocking (OtAutoBlock.js) only holds back addresses OneTrust assigns to a category. A service the OneTrust scan did not find keeps loading.

   Art. 5(3) Directive 2002/58/EC

3. 03

   iframes without a category

   YouTube and maps load as soon as the iframe has a src. It is held back with data-src instead of src and the category class, usually optanon-category-C0004.

   Art. 5(3) Directive 2002/58/EC

4. 04

   Tag in Google Tag Manager

   A tag without “Require additional consent” (Advanced settings) fires whatever was chosen in the banner.

   Art. 5(3) Directive 2002/58/EC

Step by step

1. Measure

   Open the page without consenting and note which services load; then click “Reject” and look again. The report does this for you, with the place each service is added.

2. Mark script tags

   Change every tracker tag to type="text/plain" with class="optanon-category-C0002" (performance), C0003 (functional) or C0004 (targeting). Custom categories have their own numbers; OneTrust shows them on the category.

3. iframes

   For YouTube and maps, rename src to data-src and add class="optanon-category-C0004".

4. Measure again

   Check again without consent and after “Reject”. Only when the service is gone in both runs is it held back.

Questions