> How the Osano CMP records cookie consent under the GDPR, ePrivacy and CCPA, which cookies it sets and what to check on its free and paid plans. > > Canonical: https://www.flowconsent.com/en/services/consent-management/osano Consent management # Osano Essential Osano is a US data privacy platform headquartered in Austin that includes a consent management platform (CMP), a vendor risk module, a data subject request portal and a free open source banner library widely used by SaaS and e commerce sites. [Block Osano until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=consent) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Consent management](https://www.flowconsent.com/en/services/consent-management) - Consent Essential - Prior consent Not required - Documented cookies 7 - Third-party domains 7 - Servers United States (Amazon Web Services, primary). Osano Inc. is a Delaware company headquartered in Austin, Texas. Overview ## What does Osano do? Osano is a data privacy platform operated by Osano Inc., a Delaware company headquartered in Austin, Texas. The product suite combines a consent management platform, a vendor risk module, a data subject request portal and the popular open source Cookie Consent banner library acquired from Silktide. Osano is particularly common on SaaS and e commerce sites because of its free tier and its native integrations with Salesforce and HubSpot. ## **What Osano does** The Osano script scans the website on a recurring schedule, classifies every cookie and tag, renders a banner that asks the visitor to opt in per category and stores the granular decision. Other scripts read the choice through the Osano global API or through the standard IAB TCF v2.2 signal that Osano can expose. The Business plan adds a vendor risk register that tracks the sub processors used by the controller. ## **Data and cookies collected** Osano sets two strictly necessary first party cookies: osano\_consentmanager (the consent decision, up to 12 months) and osano\_consentmanager\_uuid (a hashed visitor identifier). It also stores a server side consent record that contains the truncated IP for geolocation, the timestamp, the consent string and the browser language. No advertising identifier is processed by Osano itself. ## **GDPR and ePrivacy implications** Because Osano is the layer that gates every other tracker, its own cookies fall under the strictly necessary exemption of Article 5(3) ePrivacy. Consent is therefore not required for the banner itself, but the controller still must demonstrate consent for the downstream services. Osano provides exportable consent logs that satisfy Article 7(1) GDPR and the EDPB Guidelines 05/2020. ## **Data transfers** Osano hosts consent records primarily on AWS US East (Virginia) with replication to AWS EU West (Dublin). The transfer relies on the EU US Data Privacy Framework decision of 10 July 2023 (Osano Inc. is certified) and, as a fallback, on Standard Contractual Clauses with a Transfer Impact Assessment included in the Osano DPA. EU controllers may prefer a fully EEA based CMP if they want to avoid US transfers entirely. ## **Practical compliance steps** Sign the Osano DPA, place the Osano script before any non essential tag, enable default deny on all categories, activate Google Consent Mode v2 from the dashboard, embed the automated cookie declaration and review the weekly scan report. Keep the consent log accessible for at least 12 months to meet Article 7(1) GDPR. Document Osano Inc. in the privacy notice as a recipient and the US transfer in the record of processing. Compliance ## Osano and the GDPR - Legal basis Legitimate interest under Article 6(1)(f) GDPR. The first party CMP cookies are strictly necessary to record and document consent for other trackers and are exempted by Article 5(3) ePrivacy. - Risk level low - Applicable regulations GDPR, ePrivacy Directive, TTDSG (Germany), LIL (France), UK GDPR, CCPA, CPRA, VCDPA, LGPD ### Impact assessment (DPIA) A standalone DPIA is rarely required because Osano processes only the minimal data needed to record consent (truncated IP, hashed identifier, timestamp, browser metadata). The DPIA should however document the US transfer leg under the EU US Data Privacy Framework decision of 10 July 2023 (Osano is certified), the choice between the free and Business plans, and the vendor and DSAR modules that may expand the processing footprint. ### Sample text for your banner > We use Osano to record your cookie preferences. The Osano cookies are strictly necessary and store your decision for up to 12 months. By clicking Accept you consent to the non essential cookies described below; you can withdraw or change your consent at any time via the Cookie settings link served by Osano. Cookies and trackers ## What Osano sets and contacts - Tracking method Embedded JavaScript banner served from cmp.osano.com that places strictly necessary first party cookies (osano\_consentmanager, osano\_consentmanager\_uuid) to record granular consent and exposes a Consent API to gate other tags. - Server location United States (Amazon Web Services, primary). Osano Inc. is a Delaware company headquartered in Austin, Texas. - Data transferred outside the EU Osano Inc. processes consent records on AWS US East and replicates them to AWS EU West (Dublin). Transfers rely on the EU US Data Privacy Framework (Osano is certified) and on Standard Contractual Clauses in the Osano DPA. ### Cookies set (7) | Name | Type | Duration | Purpose | | ------------------------------ | ------------ | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | osano\_consentmanager | first\_party | 12 months | Stores the visitor consent choices, the consent identifier and the version of the cookie policy. | | osano\_consentmanager | http\_cookie | 12 months | Strictly necessary first party cookie that stores the visitor granular consent decisions across categories so the banner does not reappear while the consent is valid. | | osano\_consentmanager | first\_party | 13 months | Stores the visitor consent decision per cookie category as a JSON string. | | osano\_consentmanager\_uuid | first\_party | 13 months | Pseudonymous identifier mapping the visitor decision to the centralised consent log on the Osano dashboard. | | osano\_consentmanager\_uuid | first\_party | 12 months | Anonymous identifier used to retrieve the visitor consent record on subsequent visits. | | osano\_consentmanager\_uuid | http\_cookie | 12 months | Strictly necessary first party cookie that stores a hashed visitor identifier used to retrieve the corresponding server side consent record for audit purposes. | | osano\_consentmanager\_expdate | http\_cookie | 12 months | Strictly necessary first party cookie that stores the expiry date of the consent decision so the banner is re displayed when the consent window closes. | ### Third-party domains contacted (7) - `osano.com` - `cmp.osano.com` - `cmp.osano.com` - `osano.com` - `cookieconsent.osano.com` - `consent.api.osano.com` - `app.osano.com` Questions ## Frequently asked questions about Osano Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Osano set? Osano sets the osano\_consentmanager first party cookie plus a few support cookies that store the categories accepted and a consent identifier. Server side, a truncated IP and timestamp are stored as proof of consent. ### Which cookies does Osano set? Osano sets two strictly necessary first party cookies: osano\_consentmanager, which stores the granular consent decisions (default 12 months), and osano\_consentmanager\_uuid, which contains a hashed visitor identifier used to retrieve the corresponding server side consent record. No advertising or analytics cookies are set by Osano itself. ### Do I need consent to use Osano? No. Osano qualifies as strictly necessary under Article 5(3) ePrivacy. The third party trackers it manages still require valid consent. ### Do users have to consent to Osano? No. The Osano cookies fall under the strictly necessary exemption of Article 5(3) ePrivacy because they store the visitor consent decision that has been explicitly requested. Consent is required only for the third party services governed by Osano, not for the consent layer itself. ### What is the legal basis for Osano? Legitimate interest under Article 6(1)(f) GDPR and the proof of consent obligation under Article 7(1). The US transfer is covered by SCCs and the Data Privacy Framework. ### What is the legal basis for using Osano? Osano is deployed under legitimate interest pursuant to Article 6(1)(f) GDPR for the controller, combined with the legal obligation under Article 5(3) ePrivacy and Article 7(1) GDPR to obtain and document consent for any non essential trackers. The platform itself processes only the limited data needed to evidence that consent. ### Are any data transferred to the United States? Yes. Osano processes consent metadata on US infrastructure. The transfer is covered by SCCs and the EU US Data Privacy Framework, and a transfer impact assessment is recommended. ### Does Osano transfer data to the United States? Yes. Osano Inc. is a Delaware company that processes consent records on AWS US East (Virginia) with replication to AWS EU West (Dublin). The EU US Data Privacy Framework decision of 10 July 2023 covers the transfer because Osano is certified, supplemented by Standard Contractual Clauses in the Osano DPA. ### Is a DPIA needed for Osano? A DPIA is recommended because of the systematic US transfer. Document the data flows, the SCC or DPF safeguards and the residual risk for European visitors. ### Is a DPIA required for Osano? A standalone DPIA is rarely required because Osano processes only the minimum data needed to record consent. If the deployment includes the Vendor Risk module or the DSAR module, document those broader processing activities in the DPIA and reference the US transfer leg in any case. ### How do I implement Osano correctly? Insert the loader in the head, classify each script, block non essential tags before consent, mirror accept and reject buttons, sign the SCC addendum, and expose a preference link in the footer. ### How do I implement Osano correctly? Sign the Osano DPA, place the Osano script before any non essential tag, enable default deny on all categories, activate Google Consent Mode v2 from the dashboard, embed the automated cookie declaration on the privacy policy page and review the weekly scan report. Configure the GeoLocation feature so the banner adapts to EU and California audiences. ### What are the alternatives to Osano? Comparable consent management platforms include Cookiebot, OneTrust, Iubenda, CookieFirst, CookieHub, Didomi, Sourcepoint, Usercentrics, Axeptio and Klaro. CookieHub and CookieFirst are EU based and closer to Osano on price; Didomi and Sourcepoint are better suited to large publishers with TCF v2.2 needs. ### What are the alternatives to Osano? Cookiebot, CookieFirst, CookieHub, Axeptio, Didomi, Complianz, OneTrust, Sourcepoint, Klaro. EU based vendors avoid the Schrems II overhead. ### How do I update the cookie policy? Use the Osano scanner to refresh the inventory, document purpose and duration for each cookie, and version the policy when scripts change. ### How do I keep my cookie policy up to date with Osano? Enable the automated cookie declaration block in the Osano dashboard and embed it on your privacy policy page. Osano rescans the site automatically and republishes the updated declaration. Subscribe to the Osano release notes and review the weekly scan summary before each release to catch newly added vendors or sub processors. Same category ## More services: Consent management [See the whole category](https://www.flowconsent.com/en/services/consent-management) ### [Clarip](https://www.flowconsent.com/en/services/consent-management/clarip) [Clarip is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Clarip integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Clarip helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/consent-management/clarip) [Essential](https://www.flowconsent.com/en/services/consent-management/clarip) · ### [VeraSafe](https://www.flowconsent.com/en/services/consent-management/verasafe) [VeraSafe is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. VeraSafe integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, VeraSafe helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/consent-management/verasafe) [Essential](https://www.flowconsent.com/en/services/consent-management/verasafe) · ### [AdOpt](https://www.flowconsent.com/en/services/consent-management/adopt) [AdOpt is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. AdOpt supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, AdOpt ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/consent-management/adopt) [Essential](https://www.flowconsent.com/en/services/consent-management/adopt) · ### [Legal Monster](https://www.flowconsent.com/en/services/consent-management/legal-monster) [Legal Monster is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Legal Monster supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Legal Monster ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/consent-management/legal-monster) [Essential](https://www.flowconsent.com/en/services/consent-management/legal-monster) · ### [Funding Choices](https://www.flowconsent.com/en/services/consent-management/funding-choices) [Funding Choices is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Funding Choices integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Funding Choices helps organizations maintain robust websites that meet user expectations and.](https://www.flowconsent.com/en/services/consent-management/funding-choices) [Essential](https://www.flowconsent.com/en/services/consent-management/funding-choices) · ### [Cookie Script](https://www.flowconsent.com/en/services/consent-management/cookie-script) [Cookie Script is a consent management platform (CMP) that helps websites comply with GDPR, CCPA, and global privacy regulations. It provides customizable cookie consent banners, preference centers, and automated compliance scanning. Cookie Script manages user consent across tracking technologies, generates compliance reports, and integrates with tag management systems. With geo-targeted policies and TCF 2.0 support, Cookie Script ensures worldwide privacy compliance.](https://www.flowconsent.com/en/services/consent-management/cookie-script) [Essential](https://www.flowconsent.com/en/services/consent-management/cookie-script) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)