OneTrust banners, rejected and verified gone
OneTrust is the enterprise CMP you meet on corporate sites and large portals. The autopilot presses its reject-all handler, falls back to the RejectAll API, and counts the action only when the banner element has left the page.
Why OneTrust gets its own recogniser
Two surfaces, one decision
OneTrust shows a banner and a preference centre. The recogniser knows both reject handlers, so a site that opens the preference centre first is still declined in one step.
Verified by absence
For OneTrust the recogniser names what must disappear: the banner element. A click that fired but left the banner standing is not counted as consent handled.
API when the button is not rendered
OneTrust.RejectAll() is the documented SDK call. It is used when the handler button is missing, which happens on layouts that defer rendering.
No stealth, no hiding
The choice goes through OneTrust’s own record. Nothing is masked with CSS and no script is blocked, so the page behaves exactly as it would for a visitor who declined.
Reject the banner as part of observe
import { Browserberg } from '@browserberg/sdk';
const bb = new Browserberg({
apiKey: process.env.BROWSERBERG_API_KEY,
baseUrl: 'https://browserberg.com',
});
const session = await bb.sessions.create();
// A corporate site running OneTrust.
await session.act({ steps: [{ action: 'navigate', value: 'https://corporate.example.com/' }] });
const page = await session.observe({ consent: 'reject' });
// The banner was answered before candidates were collected.
console.log(page.url, page.candidates.length);
Recogniser facts
| Detected by | #onetrust-banner-sdk or #onetrust-consent-sdk |
|---|---|
| Reject path | #onetrust-reject-all-handler, the preference-centre refuse-all handler, or OneTrust.RejectAll() |
| Accept path | #onetrust-accept-btn-handler or OneTrust.AllowAll(), only with consent: accept |
| Considered done when | #onetrust-banner-sdk is gone |
| Fallback | Silent on signature mismatch; the heuristic runs next |
| Where it runs | In the browser, inside observe, before candidates are collected |
As of 2026-09-04
Questions engineers ask
Our OneTrust setup has no reject-all button, only "manage preferences".
Then the preference-centre refuse-all handler or the RejectAll API is used. If neither exists on your configuration, the recogniser stays silent and observe reports the banner still present.
Does rejecting break the site?
It behaves as it does for any visitor who declined: analytics and marketing tags stay off. If the content you need is gated behind consent, pass consent: accept deliberately.
Can I audit which choice was made on which page?
The action log records each observe with its session and URL. The consent value used is part of the request your code made, so it is yours to log alongside.
What about sites that load OneTrust late?
Detection runs after the page settles. A banner that appears after observe returned is handled by the next observe on that page.
Run it against your corporate site
Five browser hours, no card. The banner is answered inside the first observe.