Cross-Domain and Cross-Device Consent

Premier-Only Feature

As of 2025, most major browsers no longer support Cross-Site Scripting. Due to that, Osano's legacy "cross-domain support" option (available in-app) will not function on Google Chrome browsers operating on version 115 or newer, or other relevant browsers with restrictions. If cross-domain support is enabled, users will be prompted to provide consent on all listed domains individually.

Due to the nature of cross-domain support, browser restrictions may apply (e.g., Safari's default settings, Firefox default settings, Chrome v115).

Alternatively, Osano's cross-device consent capability allows you to associate a user's consent choices with a unique identifier, enabling those preferences to follow them as they interact with your brand across different domains and devices. This feature, which can only be enabled by contacting Osano Support, uses the userData API string to link consent behavior to a specific user without ever transmitting raw identifiers to Osano servers.

What is Cross-Device Consent?

Normally, a user who visits your properties from multiple devices or browsers must provide consent on each one individually. With cross-device consent enabled and configured, Osano uses your provided userData identifier to:

• Store a user's consent choices locally.

• Associate that data with a hashed user identifier.

• Retrieve those preferences when the same identifier is seen again.

With this in place, users don't have to re-confirm their choices on every device, and your brand delivers a more consistent, respectful experience.

Note that cross-device consent does not transmit user identifiers to Osano, and does not automatically merge anonymous and known user sessions.

How It Works

Step 1: Identify the user. As soon as a user logs in or is otherwise identified, assign a unique, consistent identifier using the userData property.

Step 2: Store consent locally. When a user makes a consent decision, it's stored locally along with a one-way hashed version of the identifier.

Step 3: Retrieve consent elsewhere. If that same identifier is used on another site or device, Osano automatically checks local storage and syncs the previously recorded preferences -- no banner required unless new purposes are introduced.

Implementation Example

This snippet sets the user's ID before Osano loads:

<script>
window.Osano = window.Osano || {};
window.Osano.cm = window.Osano.cm || {};
window.Osano.cm.userData = 'user-12345'; // Unique, consistent identifier
</script>
<script src="<https://cmp.osano.com/XXXXXXXX.js>"></script>

Example usage:

console.log(window.Osano.cm.userData); // Output: 'user-12345'

This value can be a string or a number (automatically converted to a string) and must be 128 characters or fewer.

Want help setting it up? Visit the developer docs for more.

Requirements

• Cross-device consent must be enabled by Osano Support for your individual Osano configurations. Please reach out with the osano.js associated with the configurations you want to enable userData usage on.

• The identifier must be unique, consistent, and non-personally identifiable, unless processed in a compliant manner.

Common Scenarios

Visitor consents before logging in or creating an account

Preferences made before a user identity is established are stored anonymously and cannot be associated with an account after the fact. Once the visitor logs in or creates an account, Osano will apply any existing remote record for that user, or prompt them to re-consent if none exists.

Returning user on the same device

If the visitor has previously consented in this browser and their remote record is more recent (for example, because they updated preferences on another device), Osano updates the local record to match. No re-prompt is shown.

Returning user whose local record is more recent

If the local record is newer than the remote one, Osano uses the local version. This typically means the remote record failed to update previously. No re-prompt is shown.

Different user on a shared device

If the user identifier provided does not match the one attached to the local consent record, Osano treats them as a different user. It will apply that user's remote record if one exists, or clear the local record and prompt them to re-consent.

When will the banner reappear?

Even with cross-device consent configured correctly, the banner will reappear if the identifier is not recognized (e.g., the user is anonymous), new consent purposes or vendors have been introduced on a property, or the userData value is set after the CMP loads rather than before.

Privacy & Compliance Notes

• The userData value is hashed before storage and never sent to Osano servers.

• You are responsible for ensuring any identifier used complies with applicable privacy laws.

• Do not use this feature to track users across properties without clear legal justification.

FAQ

Will a visitor ever lose their consent preferences?

Not permanently. If Osano cannot match a local record to the current user identity, it will prompt the visitor to re-consent. Once they do, those preferences are saved against their user identifier and will sync across devices going forward.

Why is my visitor being prompted to re-consent after logging in?

This is expected behavior when no remote consent record exists for that user yet. It typically happens the first time a visitor logs in after CDC has been enabled, or if they previously consented anonymously before their account was created. After re-consenting, their preferences are tied to their identity and they should not be prompted again.

Do anonymous consent selections carry over when a user logs in?

No. Preferences captured before a user identity is established are stored without a user ID and cannot be linked to an account after the fact. Once the user is identified, Osano looks for a remote record tied to their user identifier instead.

What happens if the same user is on multiple devices?

Osano compares the local and remote records by timestamp and applies whichever is more recent. If a visitor updated their preferences on another device, those preferences will be applied the next time they visit in this browser, with no re-prompt required.

What happens if two different users share a device?

Osano detects the mismatch between the stored user identifier and the one currently provided. It will not apply one user's preferences to another. The new user will either have their remote record applied or be prompted to re-consent if no remote record exists.

Is CDC enabled by default?

No. CDC must be enabled by Osano Support for your individual Osano configurations. If you are unsure whether it is enabled for one of your configs, or if you’d like it to be enabled for one of your configurations, contact Osano Support.