Consent Across Subdomains: Should One Choice Follow the Visitor?
Most real web properties are not one site. The marketing pages live on the root, the store on a shop subdomain, help on another, and the product itself somewhere else again. A visitor who set careful cookie choices on the homepage and meets a fresh banner on the store reads that as either incompetence or a trick, and both readings cost you.
This guide explains when sharing consent across subdomains is defensible, when a subdomain needs its own choice, and the technical setup that keeps the shared state accurate.
Same controller, same notice, shared choice
The legal logic of consent follows the controller and the notice, not the hostname. If every subdomain is run by the same organization, presents the same categories and vendor list, and the banner wording says the choice applies across the property, one recorded choice can govern them all. What breaks the logic is difference: a subdomain with extra trackers, a different operator such as a franchise or a white labeled helpdesk, or a separate privacy notice. Any of those means the original choice did not describe that processing, and the subdomain needs its own ask or an explicit extension of the notice.
Set the sharing up deliberately
Technically, sharing usually means writing the consent state in a cookie scoped to the parent domain, or keying it to the account for signed in users. Test the flow in both directions: a refusal on the store must hold on the blog, not just the other way, because teams test the happy path from the homepage and miss the reverse. Watch for consent tools that default to per subdomain storage, a setting buried in configuration that silently fragments records. Whatever mechanism you choose, the consent record should note that it is a cross subdomain choice and which property list it covered.
The exceptions that need their own banner
A few subdomains should ask separately even inside one organization. An app or portal with its own analytics SDKs and data flows processes differently from the marketing site. A regional subdomain operating under a stricter local regime may need different categories or wording. An acquisition running on your domain during transition has its own trackers and often its own controller questions. For these, a separate, clearly explained prompt is not friction, it is accuracy, and visitors generally accept a second ask when the reason is visible instead of mysterious.
Audit the estate, not just the homepage
Subdomain consent fails by neglect: a new subdomain launches for a campaign, nobody mirrors the consent setup, and it runs trackers with no banner at all for a quarter. Keep a register of subdomains with their consent configuration owner, include new subdomain launches in the same checklist as analytics setup, and run your scanner across the full list monthly. The homepage will always be the best maintained page you own; compliance is judged on the forgotten campaign subdomain too, and that is where an audit earns its keep.
Related reading
These earlier guides cover connected questions in more depth: Consent and Age Verification Overlays: Two Gates, Two Different Jobs, Cookie Consent on Shopify After Checkout Extensibility: What Changed for Tracking, and What Your Consent Banner Costs in Page Speed, and How to Get It Back.
Frequently asked questions
Does a choice on the main site legally cover the store subdomain?
It can, provided the same controller runs both, the categories and recipients are genuinely the same, and the notice told the visitor the choice covers the whole property. If the store adds payment, fraud, or advertising tools the main site lacks, those need to be inside the shared notice or separately asked.
Why does our banner reappear on every subdomain?
Usually the consent cookie is scoped to the individual host rather than the parent domain, or the tool is configured per subdomain. Check the cookie domain attribute and the tool sharing setting, then test a refusal in both directions before calling it fixed.
Should staging and test subdomains share consent?
They should run the same configuration so you can test faithfully, but keep their records and reporting separate from production. A staging banner that writes to the live consent store will corrupt the records you may need to defend.
What about a blog hosted by a third party platform?
If a vendor hosts the subdomain under their own terms, read the data arrangement carefully. You may remain the controller while they process, which keeps shared consent possible, but their platform level trackers must appear in your notice or be disabled.