Cookie Consent (OneTrust)
Brown-Forman uses OneTrust for cookie consent management, confirmed directly on herradura.com, and cross-checked against jackdaniels.com, which uses it too. Each brand has its own OneTrust project, confirmed by the different domain-script IDs below.
What we confirmed
herradura.com domain-script ID: 019953d4-9417-748d-9df0-b3eeb929b8e9
jackdaniels.com domain-script ID: 0196f30a-eb40-7350-952b-b1bc8de08c71
scripts (both sites):
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
https://cdn.cookielaw.org/scripttemplates/{version}/otBannerSdk.jsThe two brands use different IDs, exactly as expected for separate OneTrust projects; this confirms per-brand provisioning rather than one shared project with per-brand theming.
On jackdaniels.com specifically, the stub script also carries
data-nscript=beforeInteractive, a direct fingerprint of Next.js’s own
<Script strategy="beforeInteractive">. That site loads OneTrust through Next.js’s
built-in script-loading API, in the document head, before the page becomes
interactive: the pattern we replicate for our own Next.js build rather than
hand-rolling a <script> tag. (Herradura’s current site is WordPress-based, so this
specific attribute doesn’t apply there, but the OneTrust integration itself, and the
category structure below, match.)
Confirmed directly on a Herradura cocktail recipe page
(/en-us/blog/cocktail/horseshoe-margarita/): a “How to Make It” video section
rendered the literal text “Targeting Cookies are required to view this
content” with a “Cookie Settings” link, instead of the embed, when Targeting
wasn’t granted. This is exactly the gating behavior the warning below describes:
seen live, not just recommended.
Consent categories, read from the live Privacy Preference Center modal:
| Category | Default | Toggleable |
|---|---|---|
| Strictly Necessary | On | No (“Always Active”) |
| Functional | On | Yes |
| Performance | On | Yes |
| Targeting | On | Yes |
Floating re-open control: a #ot-sdk-btn-floating element, custom-styled with the
brand’s own circular logo badge (not OneTrust’s default cookie icon) in the bottom-left
corner; clicking it reopens the Privacy Preference Center at any time.
Custom branding: on jackdaniels.com, the preference center modal itself shows the brand’s logo in its header, confirming OneTrust supports per-brand visual customization within the consent UI, not just category labels. (Not independently re-verified on Herradura’s modal specifically; reasonable to assume it matches, worth a quick visual check before relying on it.)
Approach
Published as @brown-forman/p1-onetrust: a thin wrapper around the same
next/script beforeInteractive pattern, parameterized per brand:
// app/layout.tsx
import { OneTrustConsent } from "@brown-forman/p1-onetrust";
<OneTrustConsent
domainScriptId={process.env.NEXT_PUBLIC_ONETRUST_DOMAIN_ID!}
floatingButtonLogo="/images/herradura-seal.svg"
/>domainScriptId is an env var, not a hardcoded value: each brand has its own
OneTrust domain/project registered in Brown-Forman’s OneTrust account. The
integration pattern is shared; the identifier is not.
This gates more than cookie banners. Analytics (GA4/GTM) and any embedded video
(YouTube, etc.) should only initialize after the relevant consent category is
granted: check window.OnetrustActiveGroups or subscribe to OneTrust’s
OptanonWrapper/consent-changed event before firing tracking scripts, rather than
loading them unconditionally. This needs to be threaded through wherever analytics
gets added to a brand site, not just handled once in the OneTrust package itself.
Open questions for this page now live on Outstanding Questions, tracked centrally across all pages rather than repeated per page.