OneTrust Cookie Consent vs Usercentrics CMP

OneTrust Cookie Consent

The banner API returns a first layer with accept, reject all and a purposes layer that includes a list of partner vendors, and in the captured configuration accept and reject carry identical colour, font size and position — though we found no public statement that this equal weight is the default design. Geolocation rules, re-consent on republished data, template changes and consent expiry are documented down to numeric reason codes. We found no public information on an accessibility standard for the banner, a language count, or limits on what the opt-in-rate optimisation may change.

Usercentrics CMP

Five banner layouts are documented down to the compact widget carrying both Accept All and Deny buttons, every layout stated to preserve granular purposes and the ability to withdraw, WCAG 2.2 AA named, sixty-plus languages, and EU and US rule sets applied automatically per visitor location. What holds me back: equal visibility of accept and reject appears only as best-practice advice in a blog post rather than a stated product default, and I found no public information on regulator-mapped templates or a list of dark patterns prevented. A/B testing is documented, with the statement that tests run without processing personal data.

OneTrust Cookie Consent

Auto-blocking is offered and documented as capable of blocking Google Tag Manager itself, and the Google Tag Manager path is documented in real depth: blocking triggers, exception triggers, trigger group logic, the data layer key repopulated on every page load, tags firing without reload after consent, and the edge cases that break it. Both an automatic mode and a manual per-tag mode are described. We found no public information on placeholders for embedded videos, maps and social content, server-side tagging, or a documented way to check that nothing loads before consent.

Usercentrics CMP

Automatic blocking of non-essential services until consent is stated on more than one page, a Smart Data Protector is named, a Google Tag Manager template exists with consent types wired so only consented tags fire, and server-side tagging with consent filters is described. But "automatic" is a claim until the test steps are published: I found no instructions to verify in the browser or tag-manager preview that nothing loads before consent, and no public information on embed placeholders, manual versus automatic modes with their limits, or consent passed to forms and CAPTCHAs through a JavaScript API.

OneTrust Cookie Consent

The product page states scanning for cookies, tags, trackers, pixels and beacons with automatic categorisation, scans can be automated with records kept, and apps can be scanned and rescanned programmatically through an API. We found no public information on rescan schedules and scan depth, the classification database behind the automatic categorisation, alerts on new or changed trackers, or a cookie declaration generated from the scan.

Usercentrics CMP

Scans run at stated intervals per plan (once at setup, monthly, weekly on the top tier), new trackers are automatically categorised into the cookie notice and privacy policy, and a database of more than 2,200 services backs the matching. The Data Processing Service scanner is the interesting part: it watches real user traffic instead of crawling, aggregates every 24 hours, flags third-party technology that fires but is missing from the configuration, and publishes its user agent. I found no public information on local storage or pixel scanning, email alerts on new trackers, scan depth, or a change history.

OneTrust Cookie Consent

Consent receipts with continuous monitoring are named, and bulk export jobs for data subjects, consent receipts and cookie receipts can be created, tracked, downloaded and cancelled through an API. Re-asking is documented precisely — reason codes cover republished configurations, expired consent, expired TC strings and authenticated users — and consent persists across sessions and syncs across devices without third-party cookies. We found no public information on how long consent records are kept, where they are stored, a consent ID the visitor can look up, or withdrawal recorded as its own event.

Usercentrics CMP

Each consent is logged with date, time, what the individual agreed to and where they came from, in a central repository pitched at audits and data-subject requests, and consent decisions can be synced to the customer's own server — that last part I like, because the evidence leaves with you. For a dispute I would want more: I found no public information on the banner version or texts tied to each record, a consent ID a visitor could quote, retention for consent logs, withdrawal recorded as its own event, or asking again when the configuration changes.

OneTrust Cookie Consent

Google Consent Mode is documented in depth — default and update commands, consent, conversion and analytics pings, cookieless pings under denied analytics storage, and ad-click redaction — and the IAB TCF EU v2.2 consent string flows through the banner API with a TCF 2.2 compliance offering alongside it. Mobile and connected-TV SDKs are documented to an unusual level of detail: iOS, Android, tvOS, Roku, Fire TV, Samsung and LG, React Native, Flutter, Cordova, Unity and MAUI, with REST and OAuth for configuration. We found no public information on a registered IAB Europe CMP ID, Microsoft UET consent mode, Global Privacy Platform support, or the vendor named as a Google-certified CMP.

Usercentrics CMP

Google Consent Mode v2 with Google certification and Gold Tier partner status, Microsoft UET, Amazon and Clarity consent signals, Global Privacy Control, sixteen-plus CMS plugins, iOS, Android, Flutter, React Native and Unity SDKs, eight TV platforms, and configuration plus data-export APIs are all documented. The captured pages give different figures for the TCF version (2.3 and 2.4), and I found no public information on a registered IAB Europe CMP ID, GPP for US states, or the distinction between basic and advanced Consent Mode.

OneTrust Cookie Consent

The headquarters and certified entity is in Atlanta, Georgia, and the whole transfer story is built on the EU-US Data Privacy Framework with FTC enforcement and US-based BBB dispute resolution; a privacy policy, a DPA with SCCs, a subprocessor list and ISO 27001 and SOC 2 Type II are published on the trust pages. We found no public information on where the banner script, consent logs and scan results are hosted or stored, on subprocessor locations, or on an EU hosting option — so residency stays open, and so does the question of what leaving would cost.

Usercentrics CMP

A German GmbH with Munich address and commercial register number, a published data processing agreement, ISO 27001, and hosting on Google Cloud EMEA with servers named in Germany and Belgium — plus an unusually frank disclosure that data may still reach the USA and be exposed to FISA 702 access. The chain shows US links regardless: support through Zendesk in San Francisco, payments through Stripe, the vendor's own website on WP Engine in Texas; I found no public information on where the banner script and consent logs are served, and nothing on ownership.

OneTrust Cookie Consent

The captured pages offer a demo request and a free trial, and beyond that no price figure at all: no tiers, no per-domain licence, no traffic or consent limits, no add-on or agency pricing. No buyer can compute an annual cost from public pages when the product is sold through a demo call; the only priced items found are the training courses, free online and paid in person.

Usercentrics CMP

Four web tiers are priced in euros with domains, session limits and languages each, scaling tiers are listed up to a million sessions and a hundred domains, packages upgrade automatically when limits are crossed, a session is defined as thirty minutes, monthly versus annual billing is a stated choice, VAT is stated as possibly added, and the trial runs fourteen days without a credit card; the app product is priced per daily active user with the definition published. The top tiers are custom-priced, and I found no public information on setup fees or agency and reseller terms.