Overview

Global Opt-Out helps bridge the gap between a device-level consent choice and a broader privacy rights request.

A standard CMP consent is stored locally and applies only to the specific app installation or device where the user made their choice. While this allows the application to immediately honor the user's preferences, it does not automatically extend that decision to downstream systems that may process the user's personal information.

Several U.S. privacy regulations, including California CPRA/CCPA, recognize an individual's right to opt out of the sale or sharing of personal information beyond a single device context. As a result, users may reasonably expect that opting out within an app applies more broadly than the local device consent alone.

Global Opt-Out addresses this gap by allowing users to convert a local opt-out action into a formal Privacy Rights Request (DSAR) without leaving the consent experience. The SDK applies the local consent change immediately and, when requested by the user, submits a broader privacy request that can be reviewed and processed through Privacy Rights Automation (PRA).

This approach provides several benefits:

• Allows local consent preferences to be honored immediately on the current device.
• Enables users to submit a broader privacy request without navigating away from the consent flow.
• Creates an auditable Privacy Rights Request (DSAR) for downstream privacy operations.
• Supports privacy teams in reviewing, tracking, and fulfilling requests through PRA.
• Reduces the risk of users assuming that a device-level opt-out automatically applies across all systems and devices.

In short, Global Opt-Out combines a streamlined user experience with the operational workflows and auditability required to support broader privacy rights management.

How It Works

1. An admin enables Global Opt-Out on a supported template.
2. One or more purposes are linked to Global Opt-Out.
3. User-facing messaging is configured.
4. An end user opts out of a linked purpose from the Banner or Preference Center.
5. The SDK immediately applies the local consent change.
6. The SDK evaluates Global Opt-Out eligibility.
7. The SDK displays the Global Opt-Out prompt.
8. The user enters an email address and submits the request.
9. The SDK creates a privacy rights request (DSAR) in the background.
10. The SDK displays a success or failure toast message after the request is processed.

Privacy Rights Automation (PRA) serves as the system of record for submitted privacy rights requests. The SDK does not retrieve or reconcile request status across sessions or devices.

Requirements and Limitations

• Global Opt-Out is supported on eligible non-IAB TCF mobile and CTV templates.
• IAB TCF templates are not supported.
• The feature must be enabled and published on the template used by the application's geolocation rule.
• Global Opt-Out requests support a single user identifier: an email address.
• The linked purpose must resolve to a valid purpose displayed in the Preference Center.
• Local consent actions are not blocked while the privacy rights request (DSAR) is processed.

Configure Global Opt-Out

Global Opt-Out is configured from templates.

Navigation

Mobile App Consent
└── Templates
    └── Select a non-TCF template
        └── Preference Center
            └── Content
                └── Global Opt-Out Settings

Configuration Steps

1. Open the template assigned to the application's geolocation rule.
2. Navigate to Preference Center under the Web Browser platform tab.
3. Open Content > Global Opt-Out Settings.
4. Enable Global Opt-Out.
5. Select one or more purposes to link to Global Opt-Out.
6. Configure the message displayed in the Global Opt-Out prompt.
7. Save the template.
8. Publish the SDK data.

Purpose Selection

The linked purpose determines when the Global Opt-Out prompt becomes eligible to display.

Supported configurations include:

• A standalone purpose.
• A bundle group or parent purpose.

The Global Opt-Out section is hidden when either of the following applies:

• No linked purpose is configured.
• The configured purpose cannot be resolved to a valid purpose displayed in the Preference Center.

When the Global Opt-Out Prompt Appears

The prompt is associated with a linked purpose transitioning from ON to OFF. The transition can occur through direct user interaction or a broader consent action, such as Reject All.

Mobile App Trigger Scenarios

CTV Trigger Scenarios

The prompt is displayed only once per eligible consent decision flow during the current session. After the user responds, it is not displayed again for that decision flow.

Preference Center UI Layout

Linked purposes are displayed in a dedicated section above Manage Consent Preferences, separated from the standard purpose list. The default section title is Opt Out Across Devices.

The dedicated section is hidden when either of the following applies:

• Global Opt-Out is not configured.
• No linked purpose resolves to a valid purpose displayed in the Preference Center.

If every Preference Center purpose is linked to Global Opt-Out, the Manage Consent Preferences section and its associated dividers are hidden to avoid displaying an empty purpose list.

Toggling a purpose in the dedicated section follows the same consent behavior as toggling it in the main purpose list, with an additional eligibility check for the Global Opt-Out prompt.

User Experience

Prompt Input

The Global Opt-Out prompt collects only an email address. No additional user-entered information is required.

The email field automatically receives focus when the prompt is displayed. After a valid submission, the prompt closes immediately while the privacy rights request (DSAR) continues asynchronously in the background.

User-Facing Feedback

After the background request is processed, the SDK displays a toast message indicating whether the request was submitted successfully or an error occurred.

Request Processing

When the user submits a valid email address, the SDK packages the following information into a Global Opt-Out request:

• The email address.
• The linked purpose identifiers.

The SDK sends the request to the Server-Side CMP API DSAR endpoint:

POST https://mobile-data.onetrust.io/cfw/cmp/v1/dsar

The request is processed asynchronously. After the prompt is dismissed, the SDK resumes the consent flow and manages request delivery in the background. No direct integration with the DSAR endpoint is required.

For offline or transient network failures, the SDK automatically retries the request up to three times before considering the submission unsuccessful.

Monitor Submitted Privacy Rights Requests

Submitted Global Opt-Out requests are created as privacy rights requests (DSARs) and can be reviewed in the Privacy Rights Automation (PRA) area of the OneTrust admin console.

Each request includes:

• The email address entered by the user.
• The linked purpose identifiers associated with the opt-out.

Privacy teams can use PRA to review, process, and audit Global Opt-Out requests alongside other data subject requests.

Supported Platforms

All SDKs and platforms support the Global Opt-Out feature.

Styling and Accessibility

Color Inheritance

The Global Opt-Out prompt inherits colors from the surface that launched it, such as the Banner or Preference Center. Color values are applied at runtime, while the prompt layout uses neutral defaults.

CTV Focus Behavior

On CTV platforms, focus styling uses the following primary button colors from the parent screen:

• focusBgColor
• focusTextColor

Focus styling behaves as follows:

• When launched from the Banner, focus styling follows the primary Banner action, such as Reject All.
• When launched from the Preference Center, focus styling follows the primary confirmation action, such as Confirm My Choices.

RTL and Accessibility

• The layout automatically switches to right-to-left (RTL) when required by the device locale.
• Enter and D-pad center can activate Submit, Cancel, and Close.
• Accessibility behavior is provided by the native platform accessibility framework.

Accessibility labels, announcements, terminology, and screen reader output may vary by platform.

Platform-Specific Behavior

Email Validation

On most platforms, email validation occurs when the user selects Submit. On iOS, validation may also occur when the email field loses focus. Validation timing can therefore vary by platform.

Session and Device Behavior

Prompt eligibility is evaluated for the current consent decision and session.

Submitting a request on one device:

• Does not prevent the prompt from appearing on another device.
• Does not affect future eligible consent decision flows.
• Does not synchronize request status across devices.

Request monitoring and fulfillment workflows are managed through PRA.

Testing Checklist

Use the following scenarios to validate a Global Opt-Out implementation.

Configuration Validation

• Verify that Global Opt-Out is enabled on the template assigned to the application's geolocation rule.
• Verify that the template is non-TCF.
• Verify that SDK data has been republished.
• Verify that each linked purpose is configured correctly and displayed in the Preference Center.

Prompt Triggering

• Toggle a linked purpose from ON to OFF and verify that the Global Opt-Out prompt is displayed.
• Select Reject All from the Banner and verify the expected prompt behavior.
• Select Reject All from the Preference Center and verify the expected prompt behavior.
• Verify that eligible consent decision flows trigger the prompt when a linked purpose is disabled.
• Verify that the prompt is not displayed again after the user responds during the same eligible consent decision flow and session.

Prompt Interaction and Validation

• Verify that focus is automatically placed on the email field when the prompt is displayed.
• Submit an invalid email address and verify that validation feedback is displayed.
• Submit a valid email address and verify that the prompt closes immediately.
• Verify that the consent flow continues without waiting for the network request to complete.
• Verify that the request is submitted asynchronously to the DSAR endpoint.

Network and Retry Behavior

• Simulate an offline or transient network failure.
• Verify that the SDK retries the request up to three times.
• Verify that the consent flow continues after the prompt is dismissed, regardless of the request delivery status.

Privacy Rights Request (DSAR) Processing

• Verify that a successful submission creates a corresponding privacy rights request (DSAR).
• Confirm that the request appears in Private Rights Automation (PRA) for review and processing.
• Verify that the email address and linked purpose identifiers are included in the request.

Dismissal Behavior

• Verify that Cancel, Close, and Back dismiss the prompt on supported platforms.
• Verify that the original consent action continues after the prompt is dismissed.
• Verify that dismissing the prompt without submitting an email address does not create a privacy rights request (DSAR).

Platform and Accessibility Validation

• Validate colors and focus states on each supported platform.
• Validate RTL layouts where applicable.
• Validate keyboard and D-pad navigation.
• Verify expected screen reader announcements and accessibility labels.
• Confirm platform-specific email validation behavior, including iOS validation when the email field loses focus.

Troubleshooting

Global Opt-Out Prompt Does Not Appear

Verify the following:

• Global Opt-Out is enabled in the assigned template.
• The assigned template is non-TCF.
• The template is associated with the application's active geolocation rule.
• The linked purpose is configured correctly and displayed in the Preference Center.
• The linked purpose transitioned from ON to OFF during the current consent decision flow.
• The user has not already responded to the prompt during the current session and consent decision flow.
• The SDK has retrieved the latest published configuration.

Dedicated Global Opt-Out Section Does Not Appear

Verify the following:

• Global Opt-Out is configured.
• At least one linked purpose resolves to a valid purpose displayed in the Preference Center.

The dedicated section is intentionally hidden when no valid linked purposes are available.

Local Opt-Out Succeeds but No Privacy Rights Request (DSAR) Is Created

Local consent updates and privacy rights request (DSAR) submissions are processed independently. Verify the following:

• A valid email address was submitted.
• The request was not canceled or dismissed before submission.
• The device had network connectivity when the request was submitted or reconnected during the retry period.
• The SDK successfully delivered the request after any retry attempts.
• The request is visible in Privacy Rights Automation (PRA).

Prompt Appearance Differs Across Platforms

Some platform-specific differences are expected. Native accessibility frameworks and operating system behavior can affect:

• Focus handling.
• Validation timing.
• Accessibility labels.
• Announcements.
• Terminology.
• Screen reader output.

These differences do not necessarily indicate a problem with the Global Opt-Out implementation.