Consent Banner
University websites will implement a consent banner that asks visitors for permission before running non-essential tracking. The consent management solution is provided by OneTrust, a centrally funded resource managed by ISC.
A Centralized Platform
Effective consent management requires consistent configuration, defensible record-keeping, and ongoing maintenance as the legal landscape evolves. If every school, center, and department were responsible for selecting, configuring, and maintaining their own consent management solution, the result would be a patchwork of implementations at varying maturity levels, with no shared institutional posture.
A centrally managed platform solves that. ISC manages the OneTrust configuration and keeps it up to date, easing the administrative and cost burden for local areas.
This is the same logic behind Penn's approach to other shared infrastructure such as the network, email, and identity management: ISC handles the platform complexity so that units can focus on their own work.
Where Units Come In
Central ownership of the platform doesn't mean ISC can or will manage every website at Penn. The web presence across Penn's schools, centers, and departments is immense and too varied for a single team to administer directly. More importantly, one of the University's values is the breadth and depth of its expertise and the autonomy with which local areas operate.
The local stewards of the various areas are web compliance officers, who are identified by their school's deans, vice provosts, or vice presidents. WCOs are the local stewards of their unit's web presence within this program. They know their sites, their people, and their vendors. ISC provides the platform and the policy; WCOs provide the unit-level context that enables implementation.
Compliance is a shared responsibility model, not a delegation model. The expectation is an ongoing partnership: ISC supports WCOs with tools, training, and direct access for support, and WCOs keep their unit's web presence in good standing and communicate changes back to ISC.
Rollout Structure
Penn is rolling out this program in phases, beginning with units whose web properties meet Tier 1 criteria — those with the highest visibility or the most sensitive data collection activity. This phased approach reflects a deliberate choice to learn from early implementations and refine the process before scaling.
If your unit is in an early phase, you'll be among the first to go through onboarding and implementation. ISC will be most directly engaged with early cohorts, and your experience will help shape guidance for subsequent units.
If your unit is in a later phase, you still have a role now: get familiar with the program, understand your web property inventory, and identify your implementation contacts before your onboarding date.
[Rollout timeline — phases and dates to be inserted here]
A Penn Community Collaboration
Compliance programs can feel adversarial. Penn Web Compliance is designed for collaboration, maintaining the University's vast width and breadth of web content, design, and purposes. ISC's role is to give units what they need to succeed for good web governance: clear guidance, accessible tools, and a support structure that's practical and responsive.
The network of web compliance officers is also a peer resource. As more units go through onboarding, shared knowledge and solutions will make each subsequent implementation easier.
This is compliance as a community effort. Penn's web presence is a collective asset, and the people closest to it, the WCOs, are essential partners in keeping it in good shape.
The WCO Network can add their feedback and suggest program improvements -- what works well and what can be improved.