Consent management for OneTrust integrations

If the store uses OneTrust as its cookie consent manager, the Ometria tag should only load after marketing consent has been granted.

The implementation below uses Shopify's Customer Privacy API to check whether marketing consent has been granted.

The first step is to check whether OneTrust is already connected to Shopify's Customer Privacy API.

1. Check the OneTrust and Shopify connection

Open the browser console on the storefront and run:

window.Shopify.customerPrivacy.marketingAllowed()

Test this with different consent choices in the OneTrust banner:

• Reject marketing cookies and run the command.
• Accept marketing cookies and run the command again.

Expected result

• The value changes between false and true: the OneTrust and Shopify connection is working. Proceed to Step 3.
• The value does not change: the OneTrust consent state is not being passed to Shopify. Proceed to Step 2 to add the required connection.

Important: The Ometria check in Step 3 relies on marketingAllowed() accurately reflecting the OneTrust consent state. Confirm this before proceeding to Step 3.

2. If needed, connect OneTrust to Shopify

If marketingAllowed() does not change when the consent choice changes, the OneTrust consent state needs to be passed to Shopify's Customer Privacy API.

Shopify provides the setTrackingConsent API for this. The following bridge reads the consent categories from OneTrust and updates Shopify with the corresponding consent state:

window.Shopify.loadFeatures(
  [{ name: 'consent-tracking-api', version: '0.1' }],
  (error) = {
    if (error) throw error;

    if (window.Shopify?.customerPrivacy && window.OnetrustActiveGroups) {
      const preferences = {
        analytics: window.OnetrustActiveGroups.includes('C0002'),
        marketing: window.OnetrustActiveGroups.includes('C0004'),
        preferences:
          window.OnetrustActiveGroups.includes('C0003') ||
          window.OnetrustActiveGroups.includes('C0001'),
        sale_of_data:
          window.OnetrustActiveGroups.includes('C0002') &&
          window.OnetrustActiveGroups.includes('C0004'),
      };

      window.Shopify.customerPrivacy.setTrackingConsent(
        preferences,
        () = {
          // Shopify now matches the OneTrust consent state
        }
      );
    }
  }
);

Where to put the bridge

OneTrust automatically calls a function named OptanonWrapper when the banner loads and whenever the consent choice changes.

Place the bridge code inside OptanonWrapper:

<script>
  function OptanonWrapper() {
    // Bridge code from above goes here
  }
</script>

After adding the bridge, return to Step 1 and repeat the test.

The value returned by marketingAllowed() should now change between false and true when the consent choice changes.

Once this is confirmed, proceed to Step 3.

3. Add the Ometria CMP check

Once marketingAllowed() has been confirmed to accurately reflect the OneTrust consent state, wrap the entire ometria.raw_data object and the Ometria tag loader in a check against Shopify's Customer Privacy API.

This ensures that:

• ometria.raw_data is only built when marketing consent has been granted.
• The Ometria tracking tag is only loaded when marketing consent has been granted.

<script>
  if (window.Shopify?.customerPrivacy?.marketingAllowed?.()) {
    if (typeof ometria == 'undefined') window.ometria = {};

    ometria.raw_data = {
      cart_count: {{ cart.item_count | json }},
      cart_total: {{ cart.total_price | json }},
      cart: [],
      collection_count: {{ collection.products_count | json }},
      collection_handle: {{ collection.handle | json }},
      collection_id: {{ collection.id | json }},
      current_page: {{ current_page | json }},
      customer_email: {{ customer.email | json }},
      customer_id: {{ customer.id | json }},
      customer_phone: {{ customer.phone | json }},
      is_combined_listing: true,
      locale_domain: true,
      page_handle: {{ page.handle | json }},
      product_id: {{ product.id | json }},
      search_count: {{ search.results_count | json }},
      search_terms: {{ search.terms | json }},
      shop_currency: {{ localization.country.currency.iso_code | json }},
      shop_locale: {{ shop.locale | json }},
      namespace: {{ localization.country.iso_code | json }} + ":",
      site: {{ localization.country.iso_code | json }},
      template: {{ template | json }},
    };

    {% for item in cart.items %}
      ometria.raw_data.cart.push([
        {{ item.product.id | json }},
        {{ item.variant.id | json }},
        {{ item.quantity | json }},
        {{ item.line_price | json }}
      ]);
    {% endfor %}

    (function() {
      var url = window.location.protocol + "//cdn.ometria.com/tags/4f685ebb475111de.js";

      setTimeout(function() {
        var sc = document.createElement('script');
        sc.src = url;
        sc.setAttribute('async', 'true');
        document.getElementsByTagName("head")[0].appendChild(sc);
      }, 15);
    })();
  }
</script>

4. Verify the final implementation

After adding the Ometria check, test the complete implementation using the OneTrust banner.

Marketing consent not granted

Confirm that:

window.Shopify.customerPrivacy.marketingAllowed()

returns:

false

Then confirm that the Ometria tag is not loaded and that ometria.raw_data has not been created.

Marketing consent granted

Confirm that:

window.Shopify.customerPrivacy.marketingAllowed()

returns:

true

Then confirm that the Ometria tag loads and ometria.raw_data is available.