Most modern websites use at least one tracking tool. Analytics platforms, advertising pixels, social media embeds, form tools, and session recording software are common, useful. They are often installed without thought given to their data-collection behavior. That's not a criticism; it reflects how the web was built for a long time.

What's changed is the legal and regulatory environment. Visitors to Penn websites have a right to know what data is being collected about them and to make a meaningful choice about whether they consent. A consent management platform, the technology at the center of this program, is the mechanism that makes that possible.
 

Penn is addressing web consent through a centrally managed program, with Information Systems & Computing (ISC) owning the platform infrastructure and Web Compliance Officers serving as the local stewards for their school, center, or department's web presence.

The goal isn't to audit or restrict how units use their websites. It's to build a durable, sustainable compliance posture that doesn't create an unreasonable burden on the people closest to the sites. Centralizing complexity (the platform, the configuration, the policy decisions) means units can focus on what they actually control: understanding their web properties and connecting the right people when implementation/guidance/consultation is needed.
 

If you've visited a website recently and seen a banner asking whether you accept cookies, you've encountered a consent management platform in action. Here's what's happening under the hood, and what it means for how Penn's websites will work.

The problem consent management solves

Most tracking tools (analytics platforms, advertising pixels, social media embeds) are implemented as scripts that load automatically when a visitor arrives at a page. By default, they start collecting data immediately, before the visitor has any opportunity to know that's happening or indicate whether they're comfortable with it.

That's the gap a consent management platform closes. Rather than letting those scripts run on arrival, the platform intercepts them, presents the visitor with a meaningful choice, and executes the scripts only based on the visitor's response. The visitor's decision is recorded, creating an auditable record of consent.

What OneTrust does at Penn

OneTrust is the consent management platform Penn has centrally deployed. When a visitor arrives on a Penn website with OneTrust installed, they see a consent banner. The banner explains which tracking categories are in use and lets visitors accept, decline, or make granular choices by category.

Scripts associated with accepted categories fire normally. Scripts associated with declined categories do not fire unless the visitor changes their preferences. Visitors can update their preferences at any time.

Behind the scenes, OneTrust maintains a record of each visitor's consent decisions. That record is what makes the program legally defensible.

What it doesn’t mean

A common concern from marketing/communication/site owners/units about consent management is that it will break their analytics or force them to stop using their marketing tools. That's not what's happening.

Google Analytics, Meta Pixel, LinkedIn Insight Tag, and similar tools can still be used. They continue to function normally for visitors who consent. What changes is that they no longer fire unconditionally. They fire based on visitor choice. For visitors who decline, you'll see a reduction in tracked activity, which is expected and appropriate. Consent management doesn't eliminate your data; it makes your data collection compliant.

This is also not a privacy policy update, a cookie audit, or a requirement to remove tools from your sites. If a tracking tool is running on your site and serving a legitimate purpose, it can stay. It just needs to be properly categorized and governed through OneTrust.
That said, if any of these technologies are not actively serving a purpose on your web properties, we strongly encourage you to uninstall and discontinue their use as part of this process.
 

You'll often hear consent management discussed in terms of cookies, which is the most familiar framing. In practice, the scope is broader; tracking pixels, browser fingerprinting, local storage, and other mechanisms can all fall under the same consent requirements. OneTrust handles this under a unified framework, so you don't need to think about each mechanism separately.