Consent synchronization involves recording a user's permission and managing their messaging subscription state. Insider One provides the Upsert User Data API for profile consent attributes and channel-specific Unsubscribe and Resubscribe APIs for subscription management.
For outbound updates, Insider One Webhook (Data Stream) sends selected user attribute changes or events to an endpoint managed by your organization.
This guide outlines a proposed consent synchronization flow between your consent management platform (CMP) and Insider One, with OneTrust as an example. It focuses on consent records and messaging preferences, not cookie banner settings that control tag loading.
Before you start
Define the following requirements before configuring your integration:
Consent scope: Identify the messaging channels and data-processing permissions you need to synchronize.
User matching: Decide how to match each CMP consent record to the correct Insider One user. Review the identifier requirements of each API you plan to use.
Field mapping: Map each CMP preference to the relevant Insider One profile attribute or subscription operation.
Update ownership: Decide which system takes precedence when the two systems hold different consent values.
Integration access: Identify the API credentials and receiving endpoint required for your implementation.
Choose the correct API
Select the API based on the user's action. Updating a profile permission and changing a channel's subscription state are separate operations.
User action | API operation |
|---|---|
A new user grants messaging consent. | Use the Upsert User Data API to create or update the profile with the relevant opt-in attribute. |
An existing user withdraws permission to receive Email, SMS, or WhatsApp messages. | Use the channel-specific Unsubscribe API. |
A previously unsubscribed user grants messaging consent again. | Update the profile permission through Upsert API if needed, and use the channel-specific Resubscribe API. |
A user withdraws permission for personal-data processing. | Update the applicable consent state and follow the required data-governance or deletion process. Do not treat a messaging unsubscribe operation as a substitute for this process. |
Use v2 for new Unsubscribe and Resubscribe integrations when a v2 endpoint is available.
Opt-in and reachability represent different states. Opt-in records the user's permission. Reachability indicates whether Insider One can currently send messages to the user through that channel. Setting an opt-in attribute to
truedoes not guarantee reachability because other blocking states may still apply.
Sync changes from your CMP to Insider One
Use the following proposed flow to process consent changes from your CMP:
Capture the consent change in your CMP.
Match the consent record to the correct Insider One user.
Map the changed preference to the relevant profile attribute and subscription operation.
Send the required Insider One API request.
Check the API response and verify the resulting profile permission and subscription state.
Define how your integration handles failed requests, duplicate updates, and changes received out of order. Verify these behaviors during implementation rather than assuming that synchronization handles them automatically.
Sync changes from Insider One to your CMP
Insider One Webhook supports the following outbound streams:
Attribute Stream: Sends changes to selected user attributes.
Event Stream: Sends selected user events.
After confirming which consent changes your integration can monitor, use the following proposed flow:
Identify the consent attributes or events to monitor.
Configure the appropriate stream and receiving endpoint.
Match the webhook data to the corresponding CMP consent record.
Apply the update through the CMP's supported interface.
Verify that both systems reflect the intended consent state.
Define how the integration prevents repeated updates between the two systems. An update received from one system should not trigger an unnecessary update back to that system.
Example: Manage email consent with OneTrust
The following example illustrates a proposed flow for a user whose email preference is managed in OneTrust. It does not represent a verified OneTrust setup procedure.
Scenario | Proposed action | What to verify |
|---|---|---|
A new user grants email consent in OneTrust. | Send the user's profile and | The permission is recorded on the correct Insider One profile. |
The user withdraws email consent in OneTrust. | Call the Email Unsubscribe API. Confirm whether the implementation also requires a profile permission update. | The user is unsubscribed from email in Insider One, and the profile permission reflects the intended state. |
The user grants email consent again in OneTrust. | Update the profile permission through Upsert API if needed, and call the Email Resubscribe API. | The renewed permission and resulting subscription state are checked separately. |
The user unsubscribes through Insider One. | Send the confirmed attribute change or event to the integration endpoint, then update the matching OneTrust record. | OneTrust reflects the change without sending an unnecessary update back to Insider One. |
Test the integration
Before go-live, test the following scenarios:
A new user grants consent in the CMP.
An existing user withdraws consent in the CMP.
A previously unsubscribed user grants consent again.
A supported consent change originating in Insider One reaches the CMP.
A record with missing or unmatched identifiers does not update the wrong user.
A failed or duplicate request does not produce an incorrect consent state.
An older update does not overwrite a newer consent decision.
An update received from one system does not create a repeated synchronization loop.
Check profile consent values and channel reachability separately. Record any failed checks and resolve them before enabling production traffic.
Limitations
No native OneTrust connector: Insider One does not provide a preconfigured OneTrust connector for this consent synchronization flow. Your organization must build and maintain the integration that receives consent changes, maps user identifiers and consent fields, calls the required APIs, and updates OneTrust through its supported interface.
Channel scope: The channel-specific Unsubscribe and Resubscribe APIs described in this guide support Email, SMS, and WhatsApp. This flow does not update the native App Push or Web Push subscription state through equivalent Unsubscribe or Resubscribe APIs.
Permission and reachability remain separate: Updating an opt-in attribute through the Upsert User Data API does not remove an existing unsubscribe or other blocking status. When a previously unsubscribed user grants consent again, use the applicable Resubscribe API in addition to updating the profile permission when required.
Outbound updates depend on the configured stream: Webhook (Data Stream) sends only the user attribute changes or events selected in its configuration. A subscription-state change does not automatically reach the CMP unless the implementation represents that change through a supported and configured attribute or event.
Synchronization is not automatic: Insider One does not manage consent mapping, conflict resolution, update ordering, duplicate prevention, or synchronization-loop prevention between the CMP and Insider One. Your integration must define and implement these behaviors.
OneTrust configuration can vary: The OneTrust example illustrates an integration pattern only. Confirm the available OneTrust APIs, consent model, identifiers, authentication requirements, and update behavior for your OneTrust configuration before implementation.
Cookie consent is outside this guide: This integration manages profile consent records and messaging subscription states. It does not configure the OneTrust cookie banner or determine whether Insider One tags load on a website.