Debug OneTrust in Chrome DevTools

What OneTrust traffic looks like

OneTrust loads in stages (stub, banner SDK, per-site config) while the consent state itself lives client-side.

Endpoint pattern

otSDKStub.js from cdn.cookielaw.org or regional hosts (cdn-ukwest.onetrust.com, cdn-apac.onetrust.com, cdn-au.onetrust.com); older and white-labeled deployments use optanon.blob.core.windows.net or CookiePro hosts

Transport

Script loads plus a per-site JSON config keyed by the data-domain-script GUID; with receipts enabled, banner interactions POST to privacyportal-*.onetrust.com/request/v1/consentreceipts

Key parameters

OptanonConsent cookie's groups field, e.g. C0001:1,C0002:1,C0003:0,C0004:0, where C0002 is Performance/Analytics, C0003 Functional, C0004 Targeting; :1/:0 is granted/denied

Data layer objects

window.OnetrustActiveGroups (comma-separated active group IDs); OneTrustLoaded, OptanonLoaded, and OneTrustGroupsUpdated dataLayer pushes

Debugging OneTrust with Event Watcher

• Script loads, config fetches, and consent-receipt POSTs appear in the live stream with the OneTrust name, icon, and Consent Management badge.
• No dedicated payload parser: you get parsed query and body parameters plus cookies sent and set per hit, enough to inspect a receipt or confirm the regional CDN in use.
• The Script Tree view shows what the OneTrust stub loaded downstream.
• OneTrustGroupsUpdated pushes appear in the stream with source attribution.

OneTrust and consent

OneTrust is consent infrastructure, not a tracker. Event Watcher runs no check against it. It reads OneTrust as the source of consent truth: the OptanonConsent cookie, window.OnetrustActiveGroups (cross-checked with OneTrust.IsAlertBoxClosed()), and the OneTrustGroupsUpdated push.

The standard C-series groups map deterministically to the unified analytics / marketing / functional categories, so every other captured event gets marked granted, denied, or pre-consent against OneTrust's state.

Common debugging scenarios

• GA4 fires before the banner is answered. Filter to pre-consent events and check the violations counter. See GA4 fires before consent.
• Site uses custom group IDs instead of C000x. Event Watcher deliberately skips non-standard groups rather than guessing; the cookies section shows OptanonConsent with the raw IDs the site defined.
• Tags still fire after "Reject all". Grouping events by Consent Category shows exactly which platforms ignored the denied state. Then check whether they are gated by OneTrust auto-blocking or only by GTM triggers.
• Consent receipts missing. The stream shows the consentreceipts POST after a banner interaction; its absence usually means receipts are disabled in the template.
• Which CDN and version is live? The raw request view shows the exact cdn-* host and script paths, useful mid-migration between regions or to CookiePro.