Debug TrustArc in Chrome DevTools

What TrustArc traffic looks like

TrustArc (formerly TRUSTe) spreads across notice, preference-manager, and measurement hosts, with consent state stored in two unusually formatted cookies.

Endpoint pattern

Notice from consent.trustarc.com: the classic notice? endpoint with the site's domain in the query string, the newer /v2/notice/ path, or script bundles via get?name=*.js; preference-manager iframe and saved choices from consent-pref.trustarc.com; legacy deployments still call consent.truste.com; TrustArc's measurement beacons go to collect.datas3ntinel.com

Cookies

cmapi_cookie_privacy holds comma-separated consented category numbers (1,2,3: 1 Required, 2 Functional, 3 Advertising/Targeting; presence means granted) · notice_gdpr_prefs holds the same numbers colon-delimited; the three-bucket model has no separate analytics category: Category 2 covers both analytics/performance and preferences

Consent signals

At runtime window.PrivacyManagerAPI.callApi('getConsent', …) answers per-category; the GTM integration pushes dataLayer events named GDPR Pref Allows <category>

Debugging TrustArc with Event Watcher

• Detects TrustArc from the notice, preference-manager, and datas3ntinel requests, badging each in the live stream.
• No dedicated payload parser: you get the raw request with parsed query parameters plus cookies sent and set per event, which is where the raw cmapi_cookie_privacy value shows up.
• The GDPR Pref Allows pushes are captured as dataLayer events with source attribution, historical pushes included.

TrustArc and consent

TrustArc is a consent source, not a checked tracker. The extension reads it through three mechanisms: parsing both cookies, querying window.PrivacyManagerAPI.callApi('getConsent', …) for the functional and advertising buckets, and detecting the GDPR Pref Allows pushes.

Mapping mirrors TrustArc's model: Category 3 / advertising means marketing; Category 2 / functional covers both analytics and functional: granting "Functional" grants analytics too. Every captured event is then marked granted, denied, or pre-consent against that state.

Common debugging scenarios

• Analytics fires with only Category 2 granted: violation or not? TrustArc's model says granted. Event Watcher applies the same mapping, so a flagged analytics event means Category 2 was denied (GA4 fires before consent covers pre-consent).
• Cookie shows 1 only but tags still fire. Group events by Consent Category to enumerate what ran against the denied state, commonly tags triggered by GTM without a TrustArc exception.
• Classic vs. v2 notice confusion. The raw request view shows which endpoint (notice? or /v2/notice/) the site actually loads. Mixed deployments after a migration are common.
• Iframe preference manager not persisting. Watch consent-pref.trustarc.com traffic and the resulting Set-Cookie direction badges to confirm the choice was written.
• What is datas3ntinel.com? It is TrustArc's own collection endpoint; Event Watcher attributes it to TrustArc so it does not sit in your unknowns pile during an audit of all tracking pixels.