Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
CookiePro is a consent management platform (CMP) developed by OneTrust, one of the most widely deployed cookie consent tools in Europe. It scans your website for cookies and trackers, displays a customisable consent banner, automatically blocks non essential scripts until the visitor opts in, and stores a timestamped record of each choice. The free tier targets small sites while larger publishers use it with IAB TCF 2.2. Because OneTrust is a US company, the main compliance question is the international transfer of consent and geolocation data.
CookiePro is the free and small business edition of the OneTrust consent management platform, and one of the most widely deployed cookie banners in Europe. A single JavaScript snippet, otSDKStub.js, loads a customisable banner and preference centre, applies geolocation rules so that European visitors see an opt in experience, scans the site to discover and categorise cookies, and records every decision. OneTrust also offers paid tiers that add IAB TCF 2.2, Google Consent Mode and multi domain management.
To remember a choice, CookiePro writes the OptanonConsent cookie, which encodes the categories and vendors that were accepted or refused, and the OptanonAlertBoxClosed cookie, which stores when the banner was dismissed. With the IAB framework enabled it also sets the eupubconsent-v2 cookie holding the TCF consent string. These cookies store preference flags and a consent identifier rather than a name. On the server, OneTrust keeps a timestamped consent log with a pseudonymous identifier, the banner version and the choices made, which serves as proof that consent was collected.
The cookies CookiePro sets to operate the banner are strictly necessary to deliver the preference recording service the user asked for, so they fall under the exemption of article 5(3) of the ePrivacy Directive and do not themselves require consent. The purpose of the tool is precisely to enforce the rule that analytics and advertising trackers stay blocked until the visitor opts in. The accountability principle of GDPR article 5(2) and the consent conditions of article 7 require you to keep evidence of consent, which the OneTrust log provides.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You do not need consent to run CookiePro itself, but you must enable auto blocking so that every non essential script is genuinely prevented from executing before the matching category is accepted. CookiePro is operated by OneTrust LLC in the United States, and the banner and geolocation scripts are served from the cookielaw.org and onetrust.com domains, so consent and geolocation data can be transferred to the US. OneTrust relies on the EU US Data Privacy Framework and the European Commission standard contractual clauses, and a European data region can be selected for consent storage.
Re run the cookie scanner regularly so that newly added tags are categorised and blocked, because an outdated scan is the most common reason trackers fire without consent. Keep the cookie descriptions in the preference centre aligned with your privacy policy, set a reasonable consent lifetime, and test the banner with developer tools to confirm nothing non essential loads on first visit and that refusing is as easy as accepting. Enable the consent log export to answer supervisory authorities, and connect CookiePro to Google Consent Mode if you use Google tags.
Websites using CookiePro must obtain user consent under GDPR regulations.
DPIA considerations
CookiePro enforces consent rather than acting as a tracker, so a standalone DPIA is rarely required. A DPIA at the level of overall tag governance is recommended when CookiePro is paired with IAB TCF 2.2 and many advertising vendors, because large scale behavioural advertising can be high risk under GDPR art. 35. Document the OneTrust data region, the transfer mechanism, the cookie scan frequency and the retention applied to consent logs.
Sample consent text
This website uses CookiePro by OneTrust to manage your cookie choices. The banner stores two strictly necessary cookies, OptanonConsent and OptanonAlertBoxClosed, that remember your preferences for up to one year and keep a record of your consent. CookiePro is operated by OneTrust LLC in the United States under the EU US Data Privacy Framework and standard contractual clauses. No advertising or analytics cookie is set until you accept it, and you can change or withdraw your choice at any time from the cookie settings link in the footer.
Third-party domains contacted
cdn.cookielaw.orggeolocation.onetrust.comcookie-cdn.cookiepro.comonetrust.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| OptanonConsent | First party, persistent | 1 year | Stores the visitor consent state per cookie category and per vendor so the banner can apply and remember the choices. |
| OptanonAlertBoxClosed | First party, persistent | 1 year | Records the date and time the consent banner was dismissed so it is not shown again unnecessarily. |
| eupubconsent-v2 | First party, persistent | 1 year | Holds the IAB TCF 2.2 consent string shared with advertising vendors when the Transparency and Consent Framework is enabled. |
CookiePro is an essential service, but transparency matters. Manage all your consent with FlowConsent.
CookiePro sets the strictly necessary cookies OptanonConsent and OptanonAlertBoxClosed to store your category and vendor choices and remember that the banner was closed, both for up to one year. When the IAB Transparency and Consent Framework is enabled it also sets eupubconsent-v2 to hold the TCF consent string. These cookies store preference flags and a consent identifier, not your name.
No. The cookies CookiePro uses to run the banner are strictly necessary to provide the consent service the visitor implicitly requested, so they are exempt under article 5(3) of the ePrivacy Directive. CookiePro exists to collect consent for other trackers, so you must still configure it to block analytics and advertising until the visitor opts in.
Operating the banner relies on the ePrivacy exemption for strictly necessary cookies, while storing proof of consent relies on your accountability and legal obligations under GDPR articles 5(2), 7 and 6(1)(c). The non essential trackers that CookiePro gates require the visitor consent of GDPR article 6(1)(a) and ePrivacy article 5(3).
It can. CookiePro is operated by OneTrust LLC in the United States and serves its scripts from cookielaw.org and onetrust.com, so geolocation lookups and consent records may be processed in the US. OneTrust relies on the EU US Data Privacy Framework and standard contractual clauses, and a European data region can be selected for consent storage. Document the mechanism in your records and privacy policy.
A standalone DPIA is rarely required because CookiePro enforces consent rather than profiling visitors. A DPIA at the level of your overall tag governance is recommended when CookiePro is combined with IAB TCF 2.2 and many advertising vendors, since large scale behavioural advertising can be high risk under GDPR article 35.
Enable auto blocking so non essential scripts cannot run before consent, run the cookie scanner regularly so new tags are categorised, make refusing as easy as accepting, and give visitors a persistent link to reopen the preference centre and withdraw consent. Keep the cookie descriptions aligned with your privacy policy and enable consent log export.
European alternatives that keep consent data in the EU include Axeptio, Didomi, Cookiebot, CookieYes, Usercentrics and Complianz, as well as the open source Klaro and Orejime. They offer similar scanning, auto blocking and IAB TCF support while reducing the international transfer question.
Schedule the CookiePro scanner to re crawl your site regularly, review the discovered cookies, and publish the generated cookie list in your policy. Whenever you add a new tag, re scan, categorise the cookie, and confirm the auto blocking rule before the change goes live.