Step-by-Step Onboarding Guide: Mobile & OTT CTV App Consent

Getting up and running with your Mobile & OTT/CTV App Consent solution

Thank you for choosing the OneTrust Mobile & OTT/CTV App Consent solution to help manage your privacy, security, and governance program needs.

The solution is designed to be intuitive and easy to configure, and this guide will take you through the implementation process.

And if you have questions along the way, or at the end of your implementation, you can reach out to the team who will be happy to help.

This solution allows organizations to implement consent preference options for users on mobile devices and streaming services regarding data that is collected through an application’s SDK. When users access content or services through a mobile or connected TV application, SDKs implemented for the application can be used to track user behavior, preferences, and more. With this solution, you can collect consent from application users and use this to action SDK behavior to ensure user choices are being respected.

This solution incorporates support for a variety of platforms and frameworks. For an overview of the platform support available, we recommend that you first review the link to the developer portal here. The information in the link will provide you with an overview of exactly what features and functionality are available for each platform.

Before you begin

Before you get started with your implementation, complete the following key-activities which will help you accelerate your implementation:

  1. Assign Key Decision Maker

    It is important to identify who will be the owner of the OneTrust tool as well as the development work required on your mobile or CTV application.

    The tool owner will scan the scoped applications, categorize the SDKs, and design the banner and preference center.

    The development decision maker will oversee the integration of the OneTrust SDK into your applications, and ensure the correct actions are taken when consent is received.

  2. Identify Applications, Operating Systems, and Application Frameworks

    Before implementing the OneTrust banner or preference center, it's important to compile a list of all applications where deployment is planned. This helps both technical and business teams align effectively. In addition to identifying the applications, having a preliminary overview of the target platforms—such as iOS, Android, tvOS, and the development frameworks they use (e.g., native development, React Native) will be highly valuable for planning and integration.

  3. Review Mobile & OTT/CTV App Consent User Guide

    Look at our mobile consent user guide, here. This document outlines every step that is required to implement a OneTrust mobile Banner and Preference Center. For the most up-to-date guidance, review the documentation in the Developer Portal.

  4. Define SDK Application Notice Verbiage

    OneTrust offers pre-configured verbiage for both the banner and the preference center, available in multiple languages. You can choose to use this default wording or customize it to better align with the brand and guidance from your legal team. It is recommended to review these options with your team to determine the approach that best meets your organization’s needs before implementation.

Let’s get you started

Follow the steps below to implement your solution. Each stage of the process is covered by comprehensive guidance and support collateral on the my.onetrust.com online resource platform as well as developer.onetrust.com. This guide provides all the information you need.



Mobile & OTT/CTV App Consent Configuration

You can access all our knowledge base articles at the link here, as well as the OneTrust Developer Portal, which contains technical documentation that may be of use during your implementation.

The steps below direct you to the most relevant way to get you started as quickly as possible.

Step 1: Add or scan your application

Scanning your applications allows  you to identify which SDK libraries are in use. You can scan either Android or iOS/tvOS applications by uploading an .apk or .ipa file specific to the platform you want to support to the OneTrust application.

OneTrust does not support scanning for other platforms, such as Fire TV, Roku, Samsung TV or LG TV today. In this scenario, you can skip the Upload step (for scanning) and manually add SDKs to this application. Your development team will be able to provide a list of SDKs that are being used by the application, which can then be added manually in OneTrust.

Use the below articles to help you get started:

Step 2: Categorize SDKs

Next, you will need to designate what type of category best describes the SDK and its intended purpose, which may include categories such as strictly necessary, analytical, functional, advertising, or social media. You can also identify the vendor that the SDK originated from.

Use the following articles for further information and instruction:

Step 3: Configure your User Interface (UI)

The OneTrust application allows users to create templates for their user interfaces (UI), including banners, preference centers & → prompts to easily collect consent and preferences within the application.

You can customize the layout, styling, content, and behavior of templates, allowing you to create a look and feel that aligns with your organization's branding style and behavior preferences.

Step 4: Configure Geolocation Rules

Geolocation Rules allow the application to determine which consent experience to display based on a user’s location. The geolocation rule controls the consent model, behaviors, and content that will be shown to site visitors in different locations.

Geolocation Rules do require at least one rule that defines the default behavior when no other rules apply.

Organizations can also identify the frameworks and vendors they would like to enable for the geolocation rule. For rules that use the Custom consent model, you can select the default status for each category of SDK. The status indicates the behavior of category and the conditions under which the SDKs will be set.

Once you have created rules for a geolocation group, you will need to assign the group to an application. In this way, you can share geolocation rules (and thus templates) across applications and web properties.

Use the following articles for more information:

Step 5: Publish SDKs

Once you have finished categorizing your SDKs, created consent templates, and assigned geolocation rule groups to applications, you can now publish the mobile data and begin implementing the OneTrust SDK in your applications.

Navigate to Integrations > App SDKs in OneTrust to select the application that should be prepared for publishing. The publish screen will outline the necessary guidelines for publishing and implementing the SDK into your application.

Once you have published the SDK, you can import the unzipped SDK file into your application project to begin SDK implementation. The OneTrust SDK is also available through several popular package managers, such as Cocoapods and Maven.

Step 6: Implement the OneTrust SDK in your application

After you have published the OneTrust SDK, you are ready to integrate the SDK within your application. The key steps are listed below and are consistent across the various platforms, and the recommendation would be to follow the steps per the developer portal documentation for each platform.

  1. Downloading the OneTrust SDK

    Depending on your operating system or application framework, you will have different options for downloading and integrating the SDK. This can range from manually downloading the SDK from the OneTrust application to using package managers and repositories such as Maven, CocoaPods, npm, and pub.dev.

  2. Initialize the OneTrust SDK

    The OneTrust SDK retrieves an object containing all the data necessary to display a user interface (UI) for collecting consent. The data returned is determined by the configuration set in the OneTrust application. To start retrieving the configuration data necessary before showing the UI, use the relevant method listed in the developer documentation for your platform, which will generally be the OneTrust startSDK method.

  3. Displaying the User Interface

    After successfully initializing the SDK, you can call a method to display the relevant UI, whether it’s the banner or the preference center. The setupUI() method determines whether the UI should be shown by evaluating the shouldShowBanner logic and then displays the banner or preference center accordingly.

  4. Action consent changes

    When an application user updates their consent choices through the OneTrust UI, the application needs to be made aware of consent changes so that it can allow or restrict the processing of third-party SDKs based on how the SDKs are categorized. To help with this, the OneTrust SDK offers two options to detect user consent changes: observing broadcast events or querying for consent.

If you would like to introduce the CMP to a device that does not currently support a  OneTrust SDK today, you can use the CMP Server Side API solution. As the name entails, CMP functions will be computed on the server and the response handed back to the client. This was done to improve performance for web-based CTV platforms as some of these lower-end devices have limited storage and computing power. Today, this is a headless solution, and you will be responsible for creating the user interface (UI) for the banner and preference center. For more information on how to implement this solution, please refer to the Server-side CMP API documentation.

For more information on this step, use the below documentation links:

For Non-Native Implementations, please use the below documentation links:

Complete!

Congratulations on completing your implementation.