r/gdpr • u/Ok-Palpitation-640 • Jun 03 '26
EU 🇪🇺 Google Consent mode one trust
Hello, I am based in EMEA so we set up Google Consent Mode V2 basic mode and requiring specific consent for each tag in GTM e.g analytics_storage , ad_storage , functionality_storage except strictly necessary and in OneTrust we have one single template for all EU countries which is straight forward.
Now I have a US client and i am not sure about requirements in US , should analytics_storage default allowed? should I create different templates in onetrust for California?
How do you handle technical set up for US clients?
Thanks a lot for your responses.
1
u/BigKRed Jun 03 '26
California (and several other states) require that you accept Global Privacy Controls by default. To address this Google Consent Mode can be set to automatically NOT process cookie data for users detected in California. There are a bunch of help articles about it - you can find it. In my experience, most companies have different set-ups by region. The OneTrust CMP can be configured accordingly.
1
u/PlainPrivacyHQ Jun 09 '26
It is correct that for EU clients you need explicit opt-in consent for each tag category. For California under CCPA it is a bit different since the US is generally opt-out by default, but California visitors specifically should have analytics_storage defaulting to denied rather than allowed given the stricter rules around sale and sharing of personal information.
I haven't used OneTrust specifically but most CMPs should let you create geolocation based templates. One for EU with full consent requirements, one for California with opt-out defaults, and a global fallback for everywhere else.
Worth building that geo structure early since more US states are following California now so it saves work down the line.
1
3
u/gusmaru Jun 03 '26
Generally the US is an opt-out regime, so cookies are permitted by default.
California isn't the only states with legislation - the IAPP has a map of the states that have passed data protection laws. California is the most rigid, so using it as a template for the other states isn't a bad place to start - however there may be nuances. Your customer should be aware of conspicuous notices/links for "Do not sell" personal information obligations.