Cross-Domain and Cross-Device Consent

Premier-Only Feature

As of 2025, most major browsers no longer support Cross-Site Scripting. Due to that, Osano's legacy "cross-domain support" option (available in-app) will not function on Google Chrome browsers operating on version 115 or newer, or other relevant browsers with restrictions. If cross-domain support is enabled, users will be prompted to provide consent on all listed domains individually.

Due to the nature of cross-domain support, browser restrictions may apply (e.g., Safari's default settings, Firefox default settings, Chrome v115).

Alternatively, Osano's cross-device consent capability allows you to associate a user's consent choices with a unique identifier, enabling those preferences to follow them as they interact with your brand across different domains and devices. This feature, which can only be enabled by contacting Osano Support, uses the userData API string to link consent behavior to a specific user without ever transmitting raw identifiers to Osano servers.

What is Cross-Device Consent?

Normally, a user who visits your properties from multiple devices or browsers must provide consent on each one individually. With cross-device consent enabled and configured, Osano uses your provided userData identifier to:

• Store a user's consent choices locally.
• Associate that data with a hashed user identifier.
• Retrieve those preferences when the same identifier is seen again.

With this in place, users don't have to re-confirm their choices on every device, and your brand delivers a more consistent, respectful experience. Accepting, rejecting, and withdrawing consent all sync across devices the same way.

Note that cross-device consent does not transmit user identifiers to Osano, and does not automatically merge anonymous and known user sessions.

How It Works

Step 1: Identify the user. As soon as a user logs in or is otherwise identified, assign a unique, consistent identifier using the userData property.

Step 2: Store consent locally. When a user makes a consent decision, it's stored locally along with a one-way hashed version of the identifier.

Step 3: Retrieve consent elsewhere. If that same identifier is used on another site or device, Osano automatically checks for the user's saved preferences and applies them. No banner is shown unless new purposes are introduced.

Step 4: Clear the identifier on sign-out. When the user signs out, set userData to an empty string ('') or reload the page without setting userData. This clears the consent stored on the device so the next person who uses it is not treated as the previous user.

What Visitors See

Cross-device consent affects what your visitors see in two places. Both are shown automatically on every configuration where cross-device consent is enabled, on every banner template and in every region, and neither can be turned off or edited. They exist so that your consent experience meets the multi-device transparency requirements of the IAB Transparency & Consent Framework (Policy v5.0.b) and CNIL's recommendation on multi-device consent.

Multi-device disclosure on the banner

The first layer of your consent banner includes a sentence letting visitors know that their choices may apply across the devices where they're signed in:

Your preferences are saved across the devices where you're signed in, and may differ from the choices you make here.

It appears in the banner body text, after the category list and before the Privacy Policy links, on every banner load. The rest of your banner text is unchanged. The sentence is translated through the same localization as the rest of your banner.

Cross-device notice

If a visitor makes a consent choice before signing in, and their account already has a different saved choice, the saved choice is applied when they sign in (see "Visitor consents before logging in" below). Because the visitor just chose something different, Osano shows a short notice so they know which preferences are in effect and how to change them:

Your account's saved preferences now apply, replacing the choices you just made here. Manage Preferences

The Manage Preferences link opens the preference center, where the visitor can make a new choice. A new choice saved there becomes the account's record and syncs to the visitor's other devices.

The notice:

• Appears in the same corner of the page as your Osano widget (left or right, following your Opt-Out Widget Position setting), above the widget, if it is enabled.
• Closes on its own after a timer runs out. There is no close button. A progress bar along the bottom shows the time remaining.
• Pauses while the visitor hovers over it or focuses it with the keyboard, then resumes.
• Shows again, for the full duration, on the next page if the visitor navigates away before the timer ends. Once it has been shown for the full duration, or the visitor opens Manage Preferences, it doesn't show again for that conflict.
• Is shown in both directions: whether the account's saved choice is more permissive (visitor chose Reject All, account says Accept All) or less permissive (visitor chose Accept All, account says Reject All).
• Is not shown when the saved choice matches what the visitor just chose, when the account has no saved choice yet, or when a different person signs in on the same device (see "Different user on a shared device" below).

The notice is informational only. It does not ask for or record consent, and it does not re-open the consent banner.

Settings

Two settings for the cross-device notice are available in the Osano web app on configurations where cross-device consent is enabled. They are hidden on other configurations.

Cross-device notice duration

Where: Consent Management > your configuration > Styles tab, next to the Opt-Out Widget settings.

Sets how long the cross-device notice stays on screen, in whole seconds. The timer pauses while the visitor hovers over the notice, and if they leave the page first, the notice shows again on the next page.

• Accepts whole seconds from 5 to 30. Values outside that range can't be saved.
• If you haven't set a value, the notice uses the default of 10 seconds.
• This setting controls only the cross-device notice. It does not affect the banner timer or the Opt-Out Widget, and it cannot turn the timer off.

As with any configuration change, save and publish for the new duration to take effect.

Previewing the notice

Where: Consent Management > your configuration > Preview tab > Simulate cross-device consent conflict.

Shows the cross-device notice on your preview, using your saved duration, so you can see how it looks on your banner template and how long it stays up without creating a real conflict. The preview does not change any stored consent.

Implementation Example

This snippet sets the user's ID before Osano loads:

<script>
window.Osano = window.Osano || function () { Osano.data.push(arguments) };
Osano.data = Osano.data || [];
Osano('userData', 'user-12345');
</script>
<script src="https://cmp.osano.com/XXXXXXXX.js"></script>

Example usage:

console.log(window.Osano.cm.userData); // Output: 'user-12345'

On sign-out:

window.Osano.cm.userData = '';

This value can be a string or a number (automatically converted to a string) and must be 128 characters or fewer.

Want help setting it up? Visit the developer docs for more.

Requirements

• Cross-device consent must be enabled by Osano Support for your individual Osano configurations. Please reach out with the osano.js associated with the configurations you want to enable userData usage on.
• The identifier must be unique, consistent, and non-personally identifiable, unless processed in a compliant manner.

Choosing a userData Identifier

We recommend using a random, opaque identifier, such as a UUID that your system generates for each user, rather than an email address, name, customer number, or any other value that identifies a person on its own.

Although Osano one-way hashes the userData value before storing it and never receives the raw value, an opaque identifier is still the safer choice: it can't be reversed into personal data, and it keeps your consent records separate from your other customer data. For operators subject to CNIL's multi-device consent recommendation (Article 7.5), an identifier that does not itself reveal the user's identity is the expected approach.

Osano does not validate the format of the identifier you send. This is guidance, not enforcement.

Common Scenarios

Visitor consents before logging in or creating an account

Preferences made before a user identity is established are stored anonymously and cannot be associated with an account after the fact. Once the visitor logs in or creates an account, Osano applies the saved preferences for that user if any exist, even if the visitor's anonymous choice is more recent. If the saved preferences differ from what the visitor just chose, the cross-device notice is shown so the visitor knows which preferences are in effect and can change them. If no saved preferences exist for that user, the visitor is prompted to consent.

Returning user on the same device

If the visitor has previously consented in this browser and their remote record is more recent (for example, because they updated preferences on another device), Osano updates the local record to match. No re-prompt is shown.

Returning user whose local record is more recent

If the local record is newer than the remote one, Osano uses the local version. This typically means the remote record failed to update previously. No re-prompt is shown.

User rejects or withdraws consent on one device

A Reject All, or a withdrawal of consent the user previously gave, syncs to the user's other devices the same way an Accept All does. It is applied on the other device the next time the user loads a page there while identified. On IAB TCF configurations, the refusal is reflected in the TC string and purpose consents on that device as well.

Different user on a shared device

If the user identifier provided does not match the one attached to the local consent record, Osano treats them as a different user. It will apply that user's remote record if one exists, or clear the local record and prompt them to re-consent. The cross-device notice is never shown in this case, and nothing about the previous user's choices is displayed.

User signs out

When your site sets userData to an empty string (or reloads the page without userData), Osano clears the consent stored on the device and shows the banner again for the next visitor. Nothing is recorded to the signed-out user's account. If a cross-device notice was on screen at sign-out, it is hidden; it will show again if the same user signs back in.

When will the banner reappear?

Even with cross-device consent configured correctly, the banner will reappear if the identifier is not recognized (e.g., the user is anonymous), new consent purposes or vendors have been introduced on a property, or the userData value is set after the CMP loads rather than before.

Privacy & Compliance Notes

• The userData value is hashed before storage and never sent to Osano servers.
• You are responsible for ensuring any identifier used complies with applicable privacy laws. See "Choosing a userData Identifier" above.
• Do not use this feature to track users across properties without clear legal justification.
• The multi-device disclosure and the cross-device notice are shown automatically on every configuration with cross-device consent enabled. They can't be disabled or reworded, because they are how your consent experience meets the multi-device transparency requirements of IAB TCF Policy v5.0.b and CNIL's multi-device consent recommendation.
• The cross-device notice is a disclosure, not a consent action. It is not recorded as a consent record.
• Anonymous preferences made before sign-in are never linked to, merged into, or altered by the account's record.

FAQ

Will a visitor ever lose their consent preferences?

Not permanently. If Osano cannot match a local record to the current user identity, it will prompt the visitor to re-consent. Once they do, those preferences are saved against their user identifier and will sync across devices going forward.

Why is my visitor being prompted to re-consent after logging in?

This is expected behavior when no remote consent record exists for that user yet. It typically happens the first time a visitor logs in after CDC has been enabled, or if they previously consented anonymously before their account was created. After re-consenting, their preferences are tied to their identity and they should not be prompted again.

Why did my visitor see a notice about their saved preferences after logging in?

They made a consent choice before signing in, and their account already had a different choice saved. Osano applied the saved choice and showed the cross-device notice so the visitor knows which preferences are in effect and can change them through Manage Preferences. This is expected and required for multi-device transparency.

Why did the notice show up twice?

The visitor navigated to another page before the notice's timer ran out. The notice shows again on the next page, for the full duration, until it has been displayed in full once or the visitor opens Manage Preferences. You can adjust how long it stays up with the Cross-device notice duration setting on the Styles tab.

Can I turn the notice off, change what it says, or remove the Manage Preferences link?

No. The disclosure text, the notice text, and the Manage Preferences link are fixed. You can change how long the notice stays on screen and which side of the page it appears on (it follows your Opt-Out Widget Position setting).

The notice is overlapping another element on my page. What can I do?

The notice appears above the Osano widget on the side set by your Opt-Out Widget Position setting. Changing that setting moves the notice to the other side. If your site repositions the Osano widgets with custom CSS, the notice may still overlap them while it's on screen.

Do anonymous consent selections carry over when a user logs in?

No. Preferences captured before a user identity is established are stored without a user ID and cannot be linked to an account after the fact. Once the user is identified, Osano looks for a remote record tied to their user identifier instead. If one exists and it differs from the anonymous choice, the visitor sees the cross-device notice.

What happens if the same user is on multiple devices?

Osano compares the local and remote records by timestamp and applies whichever is more recent. If a visitor updated their preferences on another device, those preferences will be applied the next time they visit in this browser, with no re-prompt required.

What happens if two different users share a device?

Osano detects the mismatch between the stored user identifier and the one currently provided. It will not apply one user's preferences to another, and it will not show either user anything about the other's choices. The new user will either have their remote record applied or be prompted to re-consent if no remote record exists. To make sure this works, set userData to an empty string when a user signs out.

Is CDC enabled by default?

No. CDC must be enabled by Osano Support for your individual Osano configurations. If you are unsure whether it is enabled for one of your configs, or if you'd like it to be enabled for one of your configurations, contact Osano Support.