How to Handle Consent Across Multiple Domains and Subdomains

How to Handle Consent Across Multiple Domains and Subdomains

Managing cookie consent on one website is already easy to get wrong. Managing consent across multiple domains and subdomains is harder.

A business might have a main website, a blog, a checkout domain, a customer portal, landing pages, regional sites, and product subdomains. From a user's point of view, these may all feel like one brand experience. From a technical and legal point of view, they may behave like separate websites.

That difference matters. If a user accepts analytics on your main site, does that consent apply to your app subdomain? If they reject marketing cookies on a landing page, should that rejection follow them to the checkout domain? If a user changes their consent in one place, how do you update the rest?

---

Why multi-domain consent is complicated

Consent depends on context, purpose, and technology.

The UK Information Commissioner's Office explains that cookie rules require organisations to tell people cookies are there, explain what they do and why, and get consent before storing or accessing information on a user's device, unless an exemption applies. You can read the ICO guidance here: Cookies and similar technologies.

That sounds simple until your website is split across different domains.

Common examples include a marketing site on one domain and checkout on another, a SaaS website with a separate app subdomain, a blog hosted on a different platform, regional domains, support portals, and campaign landing pages built in a separate tool.

Each place may load different scripts, set different cookies, and use different vendors. If consent is handled separately on each site, the user experience can become messy. If consent is shared too broadly, compliance risk increases.

---

Domains vs subdomains

A domain is the main website address, such as example.com.

A subdomain is a section under that domain, such as app.example.com or blog.example.com.

Subdomains often belong to the same organisation, but they can still have different technical setups. One may run on a CMS, another on an ecommerce platform, and another on a SaaS app. Do not assume consent works across them automatically.

A cookie set on one domain or subdomain may not be available everywhere. Some tools can share consent across subdomains, but this must be configured properly. Separate root domains are more complicated and may require separate consent storage or explicit cross-domain logic.

---

The main rule: consent must match the purpose

The safest way to think about multi-domain consent is purpose first.

If a user accepts analytics on your main website, that may be relevant to analytics on your blog or landing pages if the purpose is clearly explained and the sites are part of the same brand journey.

Consent should be:

• Specific
• Informed
• Freely given
• Unambiguous
• Easy to withdraw

The European Data Protection Board's Guidelines 05/2020 on consent explain the standard for valid consent under GDPR.

Users should understand what they are agreeing to. If consent covers tracking across multiple sites, domains, or services, your banner and policy should make that clear.

---

Common multi-domain consent scenarios

1. Main website and blog subdomain

If a company runs a main site and a blog subdomain, and both use the same tracking purposes, it may make sense to share consent across them. Still, test that the banner, categories, and blocking rules behave the same way on both.

2. Marketing site and app subdomain

A SaaS app subdomain may contain logged-in user data and more sensitive account activity. It may also use product analytics, support tools, or session monitoring. Do not assume the same consent categories should apply automatically.

3. Website and checkout domain

Many ecommerce journeys move from the main site to a separate checkout or payment domain. This is risky if ad tags, affiliate scripts, or conversion tracking fire on checkout without respecting the user's earlier choice.

If you use cross-domain measurement, consent still matters. Google explains cross-domain measurement for Google tags here: Measure activity across multiple domains. That guide explains the measurement side, but it does not remove the need to respect user consent.

4. Regional domains

Regional domains may have different language requirements, legal frameworks, cookie categories, and consent expectations. A single banner copied across all sites may not be enough.

CookiePal's consent management page highlights support for consent banners, cookie scanning, and regional consent handling, which can help when a business operates across multiple markets.

---

Should consent be shared across domains?

Sometimes yes, sometimes no.

Sharing consent can improve user experience. Nobody wants to reject cookies on one page and be asked again five seconds later on another page from the same brand.

But consent should only be shared where it makes sense.

Before sharing consent across domains or subdomains, ask whether the domains are controlled by the same organisation, whether the purposes and categories are the same, whether users are told where consent applies, whether withdrawal works everywhere, and whether regional rules differ.

---

How Google Consent Mode fits in

If your multi-domain setup uses Google Analytics, Google Ads, or Google Tag Manager, you may also need to configure Google Consent Mode correctly.

Google Consent Mode lets Google tags adjust behaviour based on consent choices. Google's setup guide is here: Set up consent mode on websites.

For multiple domains, you need to check that consent signals are present wherever Google tags fire.

That means:

• Default consent is set before tags fire
• The user's choice is passed to Google tags
• Consent is respected on subdomains
• Consent is respected on checkout or booking domains
• Reject choices are not lost during redirects
• Tags do not fire differently on landing pages

If consent is correct on the homepage but missing on checkout, the setup is not complete.

---

Cookie categories should stay consistent

When possible, use consistent cookie categories across connected domains.

For example:

• Strictly necessary
• Preferences
• Analytics
• Marketing
• Functional

This makes the user experience clearer and implementation easier. However, do not force every domain into the same model if the purposes are different. The important thing is that the category names, purposes, and scripts are accurate for each domain.

A CMP like CookiePal can help businesses manage consent banners, cookie categories, and auto-blocking across websites. CookiePal's features page highlights auto-blocking, scheduled scanning, auto-categorisation, multilingual banners, and Google Consent Mode v2 support.

---

Common mistakes to avoid

Assuming subdomains are automatically covered

A subdomain may look like part of the same website, but it may use different scripts, platforms, and cookies. Test it separately.

Sharing consent without explaining it

If consent applies across multiple sites or services, users should understand that.

Losing consent during redirects

This often happens in booking, checkout, or login flows. A user rejects tracking on the main site, then tracking starts again on the next domain.

Letting third-party tools bypass the CMP

A separate landing page builder, checkout tool, or support platform may include scripts that are not controlled by your main CMP.

Forgetting withdrawal

Users must be able to change or withdraw consent. If consent is shared, withdrawal should be shared too.

---

Multi-domain consent checklist

Before launching a multi-domain consent setup, check:

• Every domain and subdomain has been mapped
• Every cookie and script has been scanned
• Cookie categories are clear and consistent
• Consent wording explains where consent applies
• Non-essential scripts are blocked before consent
• Consent is respected after redirects
• Reject choices work across the full journey
• Consent withdrawal works across relevant properties
• Google Consent Mode is configured wherever Google tags run
• Regional differences are handled correctly
• The privacy policy explains multi-domain tracking
• The cookie policy reflects the actual setup

---

Conclusion

Handling consent across multiple domains and subdomains is not just a technical detail. It affects compliance, analytics accuracy, advertising performance, and user trust.

The main principle is simple: consent should follow the data flow. If tracking follows the user from one domain to another, your consent setup needs to follow too.

Start by mapping every domain, subdomain, script, and cookie. Then decide where consent should be shared, where it should stay separate, and how withdrawal should work.

A clean multi-domain consent setup helps users avoid repeated banners, while still giving them clear control over how their data is used.