After the OneTrust Consent system loads it will execute a global function named OptanonWrapper.  In this you can add necessary code to maintain cookie compliance.

function OptanonWrapper(){
    if( OnetrustActiveGroups.includes("C0004") ) {
        // ALLOW TRACKING
    }
    else {
        // DISALLOW TRACKING
    }
}

As an alternative you can use the following which will trigger automatically upon preference change

window.addEventListener('OneTrustGroupsUpdated',event =>{
    if( event.detail.includes( 'C0004' ) ) {
        // ALLOW TRACKING
    }
    else {
        // DISALLOW TRACKING
    }
});

We have a simple php class available that decodes the OneTrust cookie and can be used to easily determine a users preferred cookie preference.

if( UMOneTrust::get('targeting') ) {
    echo 'COOKIES ALLOWED';
}

OneTrust is configured to automatically integrate consent preferences with GA4, however it does require a specific implementation in order to work correctly.  First you will want to add the OneTrust implementation script after the GA4 code.  In addition you will need to configure the default consent preferences by adding a little bit of code to your GA4 script.

<script async src="https://www.googletagmanager.com/gtag/js?id=G-0000000000"></script>
<script>
    window.dataLayer = window.dataLayer || [];
    function gtag(){dataLayer.push(arguments);}

    // START: CODE TO ADD
    gtag("consent", "default", {
        ad_storage             : "denied", 
        analytics_storage      : "denied", 
        functionality_storage  : "denied", 
        personalization_storage: "denied", 
        ad_user_data           : "denied",
        ad_personalization     : "denied", 
        wait_for_update        : 500 
    });
    // END: CODE TO ADD

    gtag('js', new Date());
    gtag('config', 'G-0000000000');
</script>

After the OneTrust script you will want to add the following code.  This code will make sure the consent preferences are updated correctly:

<script type="text/javascript">
function OptanonWrapper(){
    // performance
    if( OnetrustActiveGroups.includes("C0002") ) {
        gtag( "consent", "update", {
            analytics_storage: "granted"
        });
    }
    // functional
    if( OnetrustActiveGroups.includes("C0003") ) { 
        gtag( "consent", "update", {
            functional_storage: "granted"
        });
    }
    // targeting
    if( OnetrustActiveGroups.includes("C0004") ) {
        gtag( "consent", "update", {
            ad_storage : "granted",
            ad_user_data : "granted",
            ad_personalization : "granted",
            personalization_storage: "granted"
        });
    }
    else {
        // remove google _ga* cookies as google doesn't remove them when tracking is declined
        document.cookie.split(';').forEach( (cookie) => {
            const [ name ] = cookie.split('=');
            if( name.trim().match( /^_ga(_.+)?$/ ) ) {
                document.cookie = name + '=;path=/;domain=.'+ window.location.host.replace(/^(.*\.)?(.+\..+)$/,'$2') +';expires=Thu, 01 Jan 1970 00:00:01 GMT';
            }
        });
    }
};
</script>

If you are using Google Tag Manager to manager your GA4 analytics you will need make changes to your configuration in order to be compliant.  OneTrust has some documentation surrounding these changes (NOTE: login required, can create account):

• Cookie Consent Integration with Google Consent Mode (see Using Tag Manager section)
• Using Google Analytics (GA4) with Cookie Consent

Alternatively you can simply add the following before your GTM script:

<script type="text/javascript">
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}

// Default ad_storage to "denied". 
gtag("consent", "default", { 
    ad_storage             : "denied", 
    analytics_storage      : "denied", 
    functionality_storage  : "denied", 
    personalization_storage: "denied", 
    ad_user_data           : "denied",
    ad_personalization     : "denied", 
    wait_for_update        : 500 
});
</script>

You will need to add the following:

AFTER:

var _paq = window._paq = window._paq || [];

ADD:

_paq.push(['requireConsent']);
_paq.push(['requireCookieConsent']);

Then add the following after the Matomo script:

<script type="text/javascript">
    window.addEventListener('OneTrustGroupsUpdated',event =>{
        if( event.detail.includes( 'C0002' ) ) {
            _paq.push(['setConsentGiven']);
        }
        else {
            _paq.push(['forgetConsentGiven']);
        }
        if( event.detail.includes( 'C0004' ) ) {
            _paq.push(['setCookieConsentGiven']);
        }
        else {
            _paq.push(['forgetCookieConsentGiven']);
        }
    });
</script>

For other integrations where you cannot use the above methods you will need to decode the cookie value.  The value is a URL query parameter string.  Within it is a parameter called groups whos value is a comma delimited string of group codes and values e.g. (groups=C0001:1,C0003:0,C0004:0,C0002:0).  The primary one to be concerned about here is the value for C0004 which is the code for Targeting cookies.  The value for the codes are either a “1” or a “0” for allow or deny.