OneTrust Cookie Consent vs Usercentrics CMP

OneTrust Cookie Consent

The developer documentation shows a first layer with I Accept, Reject All and Show Purposes, and the captured configuration gives accept and reject the same colour and font size; consent runs by category and by vendor, geolocation rules decide which banner appears per country, and re-consent triggers such as expired consent or an updated template are documented with reason codes, alongside consent-rate monitoring. We found no public information naming an accessibility level for the banner, a supported language count, or limits on what may be A/B tested, and the marketing copy openly promotes maximising opt-in rates.

Usercentrics CMP

Five documented layouts each carry Accept All and Deny as core action buttons alongside granular purpose disclosure and the ability to withdraw or change consent at any time, with EU and US rule sets applied automatically by visitor location, WCAG 2.2 AA certification, 60+ banner languages with remembered preference, and A/B testing stated to run without processing personal data. Equal prominence of accept and decline is published as design guidance rather than stated as a product default, and we found no public information tying each stored consent to the banner version and texts the visitor saw.

OneTrust Cookie Consent

Cookie auto-blocking is offered and is documented as capable of blocking Google Tag Manager itself, and the tag-manager documentation goes deep into manual blocking triggers, exception triggers and their limits, with a JavaScript callback for reading consent state. We found no public information on placeholders for embedded videos or maps, server-side tagging, or a documented way for the site owner to verify on the live site that nothing loads before consent.

Usercentrics CMP

Automatic blocking of non-necessary services until consent is documented and backed by a large service repository, a Google Tag Manager integration where Consent Initialization triggers apply consent settings before other tags fire, and a server-side tagging solution that filters data forwarding by consent choice. A live-user scanner flags third-party technology that fires outside the configured CMP, which is the monitoring check I look for; we found no public information on placeholders for embedded videos or maps, a manual blocking mode, or consent passed to forms and CAPTCHAs.

OneTrust Cookie Consent

The product scans for cookies, tags, trackers, pixels and beacons, categorises them automatically, and supports automated scanning and programmatic rescans of apps via API. We found no public information on a maintained vendor database behind the classification, a cookie declaration generated from the scan result, or alerts when new or changed trackers appear.

Usercentrics CMP

Scans run on a stated schedule (monthly on the paid web tiers, weekly on Corporate), detected third-party requests are matched against a database of more than 2,200 classified services and vendors, and the cookie notice and privacy policy are updated automatically with new trackers. The scanner monitors live users rather than crawling and publishes its user agent, and gaps where technology fires outside the CMP are flagged for action rather than silently classified; we found no public information on local storage and pixel coverage or email alerts on new trackers.

OneTrust Cookie Consent

Consent receipts are described for demonstrating compliance, bulk export jobs for data subjects, consent receipts and cookie receipts can be created, monitored and downloaded through an API, and the documented consent string carries a data subject identifier across devices with expiry and re-consent reason codes, while withdrawal is converted into a formal privacy rights request in the mobile global opt-out flow. We found no public information tying each record to the banner version the visitor saw, on retention and storage location for the consent log, or on a consent ID the visitor could look up.

Usercentrics CMP

The consent log automatically registers the date and time consent was given or updated, what each individual agreed to, and where they visited the site from, synced to the customer's server and held as a centralized repository usable for audits and data subject requests. However, we found no public information on a retention period for consent records, an export of the log itself, or a record of which banner version the visitor saw — the exact points a supervisory authority asks about first.

OneTrust Cookie Consent

IAB TCF 2.2 is documented through a dedicated compliance solution and the IAB template type, Google Consent Mode is described with Google's consent API and its signals, and the mobile and connected-TV SDKs cover an unusually wide set of platforms from iOS and Android to Roku, tvOS, Unity and MAUI, with an OAuth-secured REST API and a catalog of 112 integrations. We found no public information on a registered IAB CMP ID, Microsoft UET consent mode, or GPP and GPC handling within the product itself.

Usercentrics CMP

Consent signals are broad: IAB TCF (named at v2.3 and v2.4) in a Google-certified CMP, Google Consent Mode v2, Microsoft UET and Clarity consent modes, an Amazon consent signal, Google Additional Consent, GPC recognition, and a Meta signals gateway, plus native iOS and Android SDKs with Flutter, React Native and Unity, and TV platforms from tvOS to Xbox. Sixteen CMS and shop plugins including WordPress, Shopify and TYPO3, multi-domain management from the Pro tier, cross-device consent sharing, and configuration via API are documented; we found no public information on a registered IAB Europe CMP ID number or Global Privacy Platform support.

OneTrust Cookie Consent

The contracting side of the chain sits in the United States, with the headquarters address in Atlanta and a US entity certified under the Data Privacy Framework, while transfers are covered by the framework, standard contractual clauses and a published DPA. A subprocessor list is published and ISO 27001, ISO 27701 and SOC 2 Type II are stated with statements of applicability, but we found no public information on where the banner script is served from or where consent logs and scan results are stored.

Usercentrics CMP

The contracting entity is Usercentrics GmbH in Munich with a German register entry, a named German data protection officer, a published data processing agreement, ISO 27001 certification, and cloud hosting contracted through Google Cloud EMEA Ltd. with servers in Germany and Belgium. The same privacy policy discloses that data may be transferred to the USA and exposed to FISA 702 access and names US providers in the chain (Zendesk for support, Stripe, Zapier, WP Engine), and we found no public information confirming where the banner script and the consent logs are stored.

OneTrust Cookie Consent

The captured product pages offer a free trial and a demo request, and the training programme notes free online courses alongside paid in-person options. We found no public information on prices, tiers, per-domain fees, traffic limits, add-ons or minimum terms, so a buyer cannot compute an annual cost from what is public.

Usercentrics CMP

All five web tiers are public from €7 per month with their domain counts, session limits and language counts, a scaling table runs up to 100 domains and 1,000,000 monthly sessions for 750€, the session is defined as 30 minutes, packages auto-upgrade when limits are exceeded, VAT treatment is stated, and the app plans price by daily active users at €50 / month up to 6,000 DAU with unlimited apps at no extra cost. For full computability we found no public information on setup fees, agency or reseller terms, or a minimum term.