OneTrust Cookie Consent vs Usercentrics CMP

OneTrust Cookie Consent

The developer documentation shows accept and reject-all buttons alongside a purposes layer and a vendor list on the banner, per-country geolocation rules, and reason codes for reconsent, expiry and authenticated-user re-prompting, while the mobile preference centre lets users change choices later and stacks offer consent by purpose and feature. I found no public information on reject and accept of equal weight stated as a default, a named accessibility standard for the web banner, or dark-pattern limits and regulator-mapped templates, and the product pages instead emphasise maximising opt-in rates.

Usercentrics CMP

Their own guidance puts accept and decline fully and equally visible and rejects pre-ticked boxes as failing explicit consent, all five layouts are stated to preserve granular purpose disclosure and withdrawal at any time, and the widget carries Accept All and Deny as core buttons. EU and US rule sets apply per detected visitor location, WCAG 2.2 AA is named, 60 banner languages are supported with the language preference remembered, and A/B testing is documented as running without processing personal data. We found no public information mapping banner templates to named regulator guidance such as the German DSK or CNIL, or on banner versions archived per consent.

OneTrust Cookie Consent

Cookie auto-blocking is offered and is documented as capable of blocking Google Tag Manager itself, and the tag-manager instructions are thorough: blocking and exception triggers, category groups in the data layer, tags firing without a page reload, and Google Consent Mode behaviour when advertising or analytics storage is denied. I found no public information on content blockers with placeholders for embedded videos and maps, consent passed to forms and CAPTCHAs, server-side tagging, or a documented way for the site owner to verify on the live site that nothing loads before consent.

Usercentrics CMP

Automatic blocking of non-essential services until consent via an extensive repository, a Google Tag Manager template with Consent Initialization triggers so only tags for consented purposes fire, and server-side tagging with server-side filters described to stop non-consented data reaching third parties. The scanner monitors live users' domain calls and flags any technology triggered outside the CMP as a data breach, which gives the site owner a real check. We found no public information on placeholders for embedded videos or maps, a manual blocking mode, or coverage of local storage and fingerprinting.

OneTrust Cookie Consent

The product pages confirm detection of cookies, tags, trackers, pixels and beacons with automatic categorisation and automated scans, and mobile apps can be audited for hidden tracking technologies and rescanned programmatically via the integrations module. Scheduled rescan depth, a maintained classification database with purposes, providers and lifetimes, alerts on new or changed trackers and a self-updating cookie declaration are not described in the captured pages.

Usercentrics CMP

Scans run at stated intervals (monthly in the paid web plans, weekly for Corporate), and the DPS scanner monitors live user sessions, matching detected third-party requests against a database of more than 2,200 vendors and aggregating every 24 hours. New trackers are automatically added and categorised into the cookie notice and privacy policy, gaps are flagged as a data breach, risk levels are reported, and the scanner's user agent is published. We found no public information on email alerts for new trackers, a change history, or audit-ready export of scan reports.

OneTrust Cookie Consent

Consent receipts and cookie receipts exist and can be bulk-exported through an API for compliance reporting, the banner logic evidences reconsent, consent expiry and cross-device synchronisation, and a mobile global opt-out becomes a formal privacy request reviewed in the admin console. I could not find the retention period for consent logs, records tied to the exact banner version and texts shown, a consent ID the visitor can look up, or any tamper-evidence — the pieces I would need to answer a supervisory authority or a consumer group.

Usercentrics CMP

Consent logging automatically records the date and time consent was given or updated, what each individual agreed to, and where the visitor came from, held in a centralised repository usable for a regulatory audit or a data subject request. Proof of consent is a named feature alongside multi-factor authentication, cross-domain and cross-device consent sharing is documented, and an analytics export API exists for app plans. We found no public information on banner versions or texts tied to each record, a visitor-lookup consent ID, retention periods for consent logs, consent expiry, or tamper-evident storage.

OneTrust Cookie Consent

IAB TCF 2.2 templates, Google Consent Mode with consent status and conversion pings, iOS and Android SDKs, and connected TV across Roku, tvOS and Android TV are documented, alongside a catalog of 112 integrations, OAuth-secured REST APIs and cross-domain deployment. I found no public information on a registered IAB Europe CMP ID, Microsoft UET consent mode, GPP support, agency accounts managing many client sites, or the vendor being named a Google-certified CMP.

Usercentrics CMP

Google Consent Mode v2 comes with Google Gold Tier and App-Ready certification, Microsoft UET and Microsoft Clarity consent modes and the Amazon consent signal are named, Global Privacy Control is recognised automatically, and the captured pages give different figures for the TCF version, 2.3 and 2.4. Native iOS and Android SDKs plus Flutter, React Native and Unity, connected-TV support from tvOS to Xbox, CMS plugins from WordPress and Shopify to TYPO3, and configuration via API on the top app plan are all documented. We found no public information on a registered IAB Europe CMP ID number or the Global Privacy Platform.

OneTrust Cookie Consent

The contracting entity is a US company headquartered in Atlanta relying on the Data Privacy Framework, EU standard contractual clauses and transfer impact assessments, with a published data processing agreement, a published subprocessor list and ISO 27001 and SOC 2 attestations. No EU hosting or EU contracting entity for the banner script and the consent logs is documented and the subprocessor locations are not given in the captured pages, so a chain that sees every one of our visitors rests on transfer mechanisms rather than EU residency.

Usercentrics CMP

The contracting entity is Usercentrics GmbH in Munich with a commercial register number at the Munich court, hosting runs on Google Cloud EMEA with servers in Germany and Belgium, a data processing agreement is published, ISO 27001 is stated, and subprocessors are listed with their addresses. The privacy policy itself discloses that transfers to the USA subject to FISA 702 access cannot be ruled out, and support (Zendesk, San Francisco) and payments (Stripe, USA) run through US providers. The chain is visible, but the certification scope is not published and the pages do not separate out where the banner script and consent logs sit within it.

OneTrust Cookie Consent

The only pricing-related items on the captured pages are a free trial and a demo request; we found no public information on tiers, price per domain, page-view or consent limits, or what TCF, app SDKs and multi-domain use cost. A buyer cannot compute an annual cost from the public pages, so for us this would be a procurement negotiation rather than a published price.

Usercentrics CMP

Every web tier is public with its scaling rule, from €7 a month for one domain and 1,500 sessions to a ladder of €100 for 100,000 sessions and ten domains up to €750 for a million sessions and a hundred domains, with monthly or annual billing, automatic upgrade when limits are exceeded, subdomains counted, the session defined, and VAT treatment stated. App pricing is public too, based on average daily active users from €50 a month to custom pricing from 500,000 DAU. The captured pages give different figures for the currency (euro prices and dollar prices on different pages), and we found no public information on agency or reseller terms.