OneTrust Consent Rollout

The problem

Penn needed a single consent posture across schools running on completely different stacks — Drupal, WordPress, SIDEARM for Athletics, third-party embeds for video. OneTrust ties its script to the domain level, so “one banner” is never actually one banner.

The work

Rollout across Wharton, Penn Athletics, the Provost’s Office, and EVP communicators: banner configuration, per-site script management, embedded-content handling so a video player cannot fire trackers before someone consents, and the shift from implied consent to opt-in.

A large part of my side was verification. A scanner can only report what it is allowed to see, so we had to teach it to behave like a person: accept the banner, toggle the categories, then crawl — otherwise the scan shows a false picture of what a real visitor’s browser loads.

The detail that mattered

Consent banners are easy to install and hard to get right. Most of the work was the unglamorous part — what loads before the banner appears, what happens when someone says no, and whether the record of that choice is worth anything.