> OneTag header bidding and SSP: how the wrapper works, the cookies it sets, why GDPR and ePrivacy require consent and how to pass the TCF string. > > Canonical: https://www.flowconsent.com/en/services/advertising/onetag Advertising # OneTag Marketing · [Official website](https://onetag.com) OneTag is a UK based programmatic advertising platform offering header bidding, supply side and demand side capabilities. It is a registered IAB TCF v2.2 vendor that runs in browser auctions, syncs cookies with DSP partners and shares bid stream data with the broader programmatic ecosystem. As a behavioural advertising vendor, it requires prior consent under the GDPR and the ePrivacy Directive and a properly forwarded TCF consent string. [Block OneTag until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=advertising) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Advertising](https://www.flowconsent.com/en/services/advertising) - Consent Marketing - Prior consent Required - Documented cookies 3 - Third-party domains 4 - Servers OneTag Software Ltd. (London, UK) infrastructure on AWS in EU and US regions, with global edges. Overview ## What does OneTag do? ## **What is OneTag?** OneTag is a London based programmatic advertising platform founded in 2017 by ex Yahoo and AppNexus engineers. It offers a header bidding wrapper, an in browser SSP and demand side capabilities, and is registered as IAB TCF v2.2 vendor. Many European publishers rely on OneTag to monetise display, video and native inventory, sometimes inside Prebid configurations alongside other adtech partners. ## **Cookies and identifiers** OneTag sets the onetag\_uid cookie on onetag-sys.com (and matching pixels on onetagads.com) for cross site recognition and bid optimisation. During cookie sync calls, partner DSP cookies (Trade Desk, Xandr, OpenX) are also dropped, and the IAB TCF and Additional Consent strings are read from the publisher CMP. ## **GDPR and ePrivacy implications** OneTag and its DSP partners process IP addresses, device identifiers, advertising IDs and inferred interests, all of which are personal data. Article 5(3) ePrivacy requires prior consent before any cookie is read or written, and the Belgian APD ruling on the IAB TCF (2022) confirmed that publishers participating in TCF auctions are joint controllers with their adtech partners. ## **Consent and TCF v2.2** Block the OneTag wrapper through your CMP until the visitor accepts the marketing category. Use a TCF v2.2 certified CMP, ensure OneTag is listed as a vendor and that the consent string is forwarded with every auction call. If consent is refused, the wrapper must not run or must run in a strictly cookieless mode without bid stream data sharing. ## **Data transfers** Bid stream data is shared with DSPs, many of them established in the United States. OneTag itself is established in the UK (covered by the EU UK adequacy decision) and runs production in EU and US regions. US transfers to DSPs rely on the EU U.S. Data Privacy Framework or Standard Contractual Clauses, listed in the OneTag vendor sheet. ## **Implementing OneTag compliantly** Sign the OneTag DPA, gate the wrapper on the TCF consent signal, document OneTag and its DSP partners in your records of processing, formalise the joint controllership under Article 26 GDPR, set retention on bid logs and update the privacy policy with the list of programmatic vendors. Compliance ## OneTag and the GDPR OneTag is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Prior consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy: OneTag is a programmatic advertising vendor registered on the IAB TCF v2.2 GVL that performs cross site profiling and shares bid stream data with DSPs. - Risk level high - Applicable regulations GDPR, ePrivacy Directive, IAB TCF v2.2, EU U.S. Data Privacy Framework ### Impact assessment (DPIA) A DPIA is recommended because OneTag enables real time auctions involving large numbers of DSPs, transfers bid stream data to third countries and uses unique identifiers across publishers. The Belgian APD ruling on the IAB TCF directly affects this kind of vendor. ### Sample text for your banner > We use OneTag for programmatic advertising. With your consent, OneTag and its DSP partners may store advertising cookies on your device, build profiles of your interests and transfer bid stream data to partners established in the United States and other countries. You can refuse or withdraw your consent at any time from the cookie settings. Cookies and trackers ## What OneTag sets and contacts - Tracking method Header bidding wrapper and supply side platform JavaScript (onetag-sys.com, onetagads.com) loaded by publishers via Prebid or directly, that runs in browser auctions, syncs DSP partner cookies and forwards bid request data to OneTag servers. - Server location OneTag Software Ltd. (London, UK) infrastructure on AWS in EU and US regions, with global edges. - Data transferred outside the EU Bid stream data (IP, device identifiers, page URL, IAB taxonomy) is shared with DSP partners established in the United States and other third countries, under Standard Contractual Clauses or the EU U.S. Data Privacy Framework. ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------ | ------------ | --------- | ---------------------------------------------------------------------------------------------------------------------- | | onetag\_uid | third\_party | 13 months | Persistent identifier set on onetag-sys.com to recognise the visitor across publishers and optimise programmatic bids. | | onetag\_sid | third\_party | session | Session identifier used by OneTag to correlate page views and auctions during the same browsing session. | | onetag\_sync | third\_party | 90 days | Records the cookie sync state with partner DSPs to avoid repeating the synchronisation calls on every page view. | ### Third-party domains contacted (4) - `onetag-sys.com` - `onetagads.com` - `cdn.onetag-sys.com` - `sync.onetag-sys.com` Questions ## Frequently asked questions about OneTag Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does OneTag set? OneTag sets the onetag\_uid third party cookie on onetag-sys.com for cross site recognition, plus partner DSP cookies (Trade Desk, Xandr, OpenX) during cookie sync calls. ### Does OneTag require consent? Yes. OneTag is a registered IAB TCF v2.2 vendor performing behavioural advertising; prior, specific and informed consent is required under Article 5(3) ePrivacy and Article 6(1)(a) GDPR before any auction is fired. ### What is the legal basis? Consent is the only suitable legal basis. The Belgian APD ruling on the IAB TCF expressly rejected legitimate interests for cross site programmatic advertising. ### Are data transferred outside the EU? Yes. Bid stream data is shared with DSPs based in the United States and other countries. Transfers rely on the EU U.S. Data Privacy Framework or Standard Contractual Clauses listed in the OneTag vendor sheet. ### Do I need a DPIA for OneTag? A DPIA is recommended due to the scale of programmatic auctions, the data sharing with multiple DSPs and the use of unique identifiers. The joint controllership with OneTag and its partners must also be assessed. ### How do I deploy OneTag compliantly? Sign the OneTag DPA, gate the wrapper on the TCF signal, document the joint controllership under Article 26 GDPR, set retention on bid logs and update the privacy policy with the vendor list. ### Are there alternatives to OneTag? Other header bidding wrappers include Prebid.js native, OpenWrap (PubMatic), Sovrn or simply direct Google Ad Manager auctions. Privacy first alternatives include contextual ad servers like Kevel. ### How do I update my cookie policy? Add a section that names OneTag, lists the cookie onetag\_uid with purpose and duration, mentions the cookie sync with DSP partners and discloses the transfers to United States based partners. Same category ## More services: Advertising [See the whole category](https://www.flowconsent.com/en/services/advertising) ### [Google Ads Conversion Tracking](https://www.flowconsent.com/en/services/advertising/google-ads-conversion-tracking) [Google Ads Conversion Tracking is a conversion rate optimization (CRO) platform that helps businesses increase the percentage of website visitors who take desired actions. It combines A/B testing, user behavior analysis, and personalization tools to identify and remove conversion barriers. Google Ads Conversion Tracking provides actionable insights through heatmaps, funnel analysis, and session recordings, enabling teams to implement data-driven improvements that boost revenue without increasing traffic costs.](https://www.flowconsent.com/en/services/advertising/google-ads-conversion-tracking) [Marketing](https://www.flowconsent.com/en/services/advertising/google-ads-conversion-tracking) · ### [CPABuild](https://www.flowconsent.com/en/services/advertising/cpabuild) [CPABuild is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. CPABuild integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, CPABuild helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/advertising/cpabuild) [Marketing](https://www.flowconsent.com/en/services/advertising/cpabuild) · ### [Kevel](https://www.flowconsent.com/en/services/advertising/kevel) [Kevel is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Kevel enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Kevel empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/kevel) [Marketing](https://www.flowconsent.com/en/services/advertising/kevel) · ### [OpenWeb](https://www.flowconsent.com/en/services/advertising/openweb) [OpenWeb is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. OpenWeb enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, OpenWeb empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/openweb) [Marketing](https://www.flowconsent.com/en/services/advertising/openweb) · ### [Blue Corona](https://www.flowconsent.com/en/services/advertising/blue-corona) [Blue Corona is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Blue Corona enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Blue Corona empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/blue-corona) [Marketing](https://www.flowconsent.com/en/services/advertising/blue-corona) · ### [SM Sold](https://www.flowconsent.com/en/services/advertising/sm-sold) [SM Sold is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. SM Sold provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, SM Sold helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/advertising/sm-sold) [Marketing](https://www.flowconsent.com/en/services/advertising/sm-sold) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)