Cross-domain and cross-subdomain consent sharing

All about cross-domain and cross-subdomain consent sharing within the Consent Studio Web CMP

The state of this feature

Cross-domain sharing can be divided into two distinct areas:

• Cross-domain consent sharing: sharing consent across different top level domains

• Cross-subdomain consent sharing: sharing consent within the same top level domain

Currently, only the cross-subdomain feature is offered.

How does cross-subdomain consent sharing work?

Scenario

Consider a domain example.com with a main website plus two subdomains: app.example.com and docs.example.com. To ensure seamless user experience, displaying a new consent banner on each subdomain is not ideal.

Solution

When a user first interacts on app.example.com and later visits example.com, the consent provided on the subdomain automatically transfers across all example.com domains, preventing duplicate banners.

For known domains, Consent Studio creates or updates consent cookies when consent is granted. The consent cookie is our client-side storage of a user's consent, enabling efficient script loading. This operates automatically, though specific requirements and limitations apply.

Requirements

• Consent Studio must recognize domains. The top-level domain requires registration, and subdomains must either be registered as separate domains (for automatic cookie discovery) or as domain aliases (using the parent domain's cookie list).

• An active Consent Studio subscription is necessary on each domain (unless using aliases).

• Domain alias requirements include:

  • Cannot start with www.

  • Must contain two periods

  • Cannot be claimed by another top-level domain

  • Must end with its parent top-level domain

Subdomain Consent Isolation

By default, Consent Studio shares consent cookies across all subdomains of a parent domain. However, some organisations need their subdomains to be treated as completely separate entities, each with their own independent consent state.

When to use isolation

• Your subdomains serve different audiences or purposes (e.g. europe.example.com and us.example.com)

• You have different privacy policies or consent requirements per subdomain

• Data hygiene requires that consent granted on one subdomain does not affect another

How to enable isolation

Navigate to your domain's banner settings under Advanced > Consent Sharing > Subdomain Consent Isolation and disable the "Share Consent Studio cookies across subdomains" toggle.

When disabled:

• For subdomains (e.g. app.example.com): consent cookies are scoped exclusively to that subdomain. They will not be shared with the parent domain or any other subdomain.

• For top-level domains (e.g. example.com): consent cookies become host-only, meaning they are invisible to all subdomains. This is enforced at the browser level per RFC 6265.

Important notes

• This setting must be configured on each domain individually. If you want full isolation between example.com, app.example.com, and docs.example.com, disable sharing on all three.

• When switching from shared to isolated mode, returning visitors will be prompted for consent again. This is expected behavior — their original consent was granted under a shared scope that no longer applies.

• Domain aliases are not affected by this setting. Aliases always share the consent state of their parent domain.