Osano

Osano sets the osano_consentmanager first party cookie plus a few support cookies that store the categories accepted and a consent identifier. Server side, a truncated IP and timestamp are stored as proof of consent.

Osano sets two strictly necessary first party cookies: osano_consentmanager, which stores the granular consent decisions (default 12 months), and osano_consentmanager_uuid, which contains a hashed visitor identifier used to retrieve the corresponding server side consent record. No advertising or analytics cookies are set by Osano itself.

No. Osano qualifies as strictly necessary under Article 5(3) ePrivacy. The third party trackers it manages still require valid consent.

No. The Osano cookies fall under the strictly necessary exemption of Article 5(3) ePrivacy because they store the visitor consent decision that has been explicitly requested. Consent is required only for the third party services governed by Osano, not for the consent layer itself.

Legitimate interest under Article 6(1)(f) GDPR and the proof of consent obligation under Article 7(1). The US transfer is covered by SCCs and the Data Privacy Framework.

Osano is deployed under legitimate interest pursuant to Article 6(1)(f) GDPR for the controller, combined with the legal obligation under Article 5(3) ePrivacy and Article 7(1) GDPR to obtain and document consent for any non essential trackers. The platform itself processes only the limited data needed to evidence that consent.

Yes. Osano processes consent metadata on US infrastructure. The transfer is covered by SCCs and the EU US Data Privacy Framework, and a transfer impact assessment is recommended.

Yes. Osano Inc. is a Delaware company that processes consent records on AWS US East (Virginia) with replication to AWS EU West (Dublin). The EU US Data Privacy Framework decision of 10 July 2023 covers the transfer because Osano is certified, supplemented by Standard Contractual Clauses in the Osano DPA.

A DPIA is recommended because of the systematic US transfer. Document the data flows, the SCC or DPF safeguards and the residual risk for European visitors.

A standalone DPIA is rarely required because Osano processes only the minimum data needed to record consent. If the deployment includes the Vendor Risk module or the DSAR module, document those broader processing activities in the DPIA and reference the US transfer leg in any case.

Insert the loader in the head, classify each script, block non essential tags before consent, mirror accept and reject buttons, sign the SCC addendum, and expose a preference link in the footer.

Sign the Osano DPA, place the Osano script before any non essential tag, enable default deny on all categories, activate Google Consent Mode v2 from the dashboard, embed the automated cookie declaration on the privacy policy page and review the weekly scan report. Configure the GeoLocation feature so the banner adapts to EU and California audiences.

Comparable consent management platforms include Cookiebot, OneTrust, Iubenda, CookieFirst, CookieHub, Didomi, Sourcepoint, Usercentrics, Axeptio and Klaro. CookieHub and CookieFirst are EU based and closer to Osano on price; Didomi and Sourcepoint are better suited to large publishers with TCF v2.2 needs.

Cookiebot, CookieFirst, CookieHub, Axeptio, Didomi, Complianz, OneTrust, Sourcepoint, Klaro. EU based vendors avoid the Schrems II overhead.

Use the Osano scanner to refresh the inventory, document purpose and duration for each cookie, and version the policy when scripts change.

Enable the automated cookie declaration block in the Osano dashboard and embed it on your privacy policy page. Osano rescans the site automatically and republishes the updated declaration. Subscribe to the Osano release notes and review the weekly scan summary before each release to catch newly added vendors or sub processors.