Consent Management (CMP)
OneTrust Cookie Consent
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by OneTrust LLC · www.onetrust.com
Compare with Usercentrics CMP → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
OneTrust Cookie Consent at a glance
- Vendor
- OneTrust LLC
- Headquarters
- Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 29 Oct 2026
- Panel verdict
- The AI panel rates OneTrust Cookie Consent 3/5, the mean of 6 judges. OneTrust Cookie Consent is the cookie consent product of OneTrust LLC's OneTrust platform, used on more than 750,000 websites by the vendor's count. how scores are made
- As of
- Vendor pages captured 29 Oct 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
OneTrust Cookie Consent is the cookie consent product of OneTrust LLC's OneTrust platform, used on more than 750,000 websites by the vendor's count. It is strongest where its documentation runs deepest: banner and choice scores sit at 7 with no spread, standards and platforms at 6 to 7 — Google Consent Mode, IAB TCF 2.2 templates, and SDKs from iOS and Android to Roku and tvOS. Weakest are sovereignty, 3 to 4 — headquarters and certified entity are in Atlanta, transfers rest on the Data Privacy Framework and standard contractual clauses, and we found no public information on where the banner script, consent logs and scan results are hosted — and scanning and classification, 4 to 5, with no public information on scan depth, rescan schedules, the classification database or tracker-change alerts. Consent records show the widest spread, 5 to 7: the marketing lead found bulk export, cross-device sync and withdrawal-to-privacy-request flow sufficient; the in-house lawyer wanted retention periods, records tied to the banner shown, a visitor-lookup consent ID and tamper-evidence. Public pages show a demo request and a free trial.
Speaks for it
- Banner and choice documented down to numeric reason codes for consent expiry and re-consent, with accept, reject-all and a purposes layer listing partner vendors, plus per-country geolocation rules.
- Auto-blocking offered and documented as capable of blocking Google Tag Manager itself, with a manual path of blocking and exception triggers and blocked tags firing without reload once consent is given.
- Standards and platforms scored 6 to 7 — Google Consent Mode with default and update commands and cookieless pings, IAB TCF 2.2 templates, mobile and connected-TV SDKs across iOS, Android, Roku, tvOS, Unity and MAUI, and a catalog of 112 integrations.
- Consent receipts and cookie receipts bulk-exportable through an API, with consent syncing across devices without third-party cookies and the mobile global opt-out converting withdrawal into a formal privacy rights request.
- Trust documentation published — a DPA, standard contractual clauses, a subprocessor list, ISO 27001 and SOC 2 Type II.
Held against it
- Sovereignty scored 3 to 4 — headquarters and certified entity are in Atlanta, and we found no public information on where the banner script, consent logs and scan results are hosted or on subprocessor locations.
- Scanning and classification scored 4 to 5, with no public information on scan depth, rescan schedules, the classification database behind automatic categorisation or alerts when trackers change.
- We found no public information on placeholders for embedded videos, maps and social content, on server-side tagging, or on a documented way to verify on the live site that nothing loads before consent.
- We found no public information on a registered IAB Europe CMP ID, Google CMP certification, Microsoft UET consent mode or Global Privacy Platform signals.
- No price figures appear on the captured pages, which offer a demo request and a free trial.
Best for
- You deploy consent across many countries and platforms — per-country geolocation rules, Google Consent Mode, IAB TCF 2.2 templates and the mobile and connected-TV SDKs are the highest-scoring areas.
- Your site is built on Google Tag Manager — auto-blocking that can hold back Google Tag Manager itself, manual blocking and exception triggers, and data-layer logic for tags firing after consent without reload.
- You need exportable consent evidence for reporting — bulk export of data subjects, consent receipts and cookie receipts through an API, with reason-coded re-consent and cross-device sync.
- You are a publisher tracking consent performance — banner customisation, consent-rate monitoring over time and cross-domain deployment are documented.
Avoid if
- You require an EU hosting or EU contracting option for the consent chain — headquarters and certified entity are in Atlanta, transfers rest on the Data Privacy Framework and standard contractual clauses, and we found no public information on an EU option, hosting locations or subprocessor locations.
- You must defend consent records to a regulator — consent records scores span 5 to 7, and we found no public information on retention periods, records tied to the exact banner version shown, or a consent ID the visitor can look up.
- You rely on scanning as your compliance backbone — this criterion scores 4 to 5, and we found no public information on scan depth, rescan schedules or the classification database behind automatic categorisation.
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 3.5 of 5 |
| Prior blocking & script control | 3 of 5 |
| Scanning & cookie classification | 2.5 of 5 |
| Consent records & proof | 3 of 5 |
| Frameworks, signals & platforms | 3.5 of 5 |
| European sovereignty | 2 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Cookie auto-blocking is offered and is documented as capable of blocking Google Tag Manager itself, and the tag-manager documentation goes deep into manual blocking triggers, exception triggers and their limits, with a JavaScript callback for reading consent state. We found no public information on placeholders for embedded videos or maps, server-side tagging, or a documented way for the site owner to verify on the live site that nothing loads before consent. 1 12 11 17
The Agency Developer
Auto-blocking is documented and can even hold back Google Tag Manager itself, with a container file to import, exception-trigger patterns, and the OnetrustActiveGroups data-layer key plus the OptanonWrapper hook — I could wire this across forty themes without rewriting each one. But I found no public information on content blockers with placeholders for YouTube or Maps embeds, server-side tagging support, or a documented procedure to verify on the live site that nothing fires before consent. 1 12 17
The Publisher Marketing Lead
Cookie auto-blocking is offered and is documented as capable of blocking Google Tag Manager itself, with a documented manual alternative via container import or per-tag triggers, category data-layer variables, and blocked tags firing without a page reload once consent is given. The Google Tag Manager guidance goes deep, including conflicts such as the support document.write issue. We found no public information on content blockers with placeholders for embedded videos, maps or social content, or on server-side tagging. 1 12 17
The In-House Lawyer
Cookie auto-blocking is offered and is documented as capable of blocking Google Tag Manager itself, and the tag-manager instructions are thorough: blocking and exception triggers, category groups in the data layer, tags firing without a page reload, and Google Consent Mode behaviour when advertising or analytics storage is denied. I found no public information on content blockers with placeholders for embedded videos and maps, consent passed to forms and CAPTCHAs, server-side tagging, or a documented way for the site owner to verify on the live site that nothing loads before consent. 1 11 12 17
The WordPress Webmaster
Automatic blocking, including of Google Tag Manager itself, is documented alongside a deep manual path with container import, blocking and exception triggers, a data-layer variable and an event that lets tags fire after consent without a reload, and Consent Mode behaviour per storage type is spelled out. I found no public information on placeholders for video or map embeds, consent passed to forms or CAPTCHAs, server-side tagging, or an automated check that nothing loads before consent. 1 12 17 2
The Skeptic
Auto-blocking is offered and documented as capable of blocking Google Tag Manager itself, and the Google Tag Manager path is documented in real depth: blocking triggers, exception triggers, trigger group logic, the data layer key repopulated on every page load, tags firing without reload after consent, and the edge cases that break it. Both an automatic mode and a manual per-tag mode are described. We found no public information on placeholders for embedded videos, maps and social content, server-side tagging, or a documented way to check that nothing loads before consent. 1 2 12 17
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
The product scans for cookies, tags, trackers, pixels and beacons, categorises them automatically, and supports automated scanning and programmatic rescans of apps via API. We found no public information on a maintained vendor database behind the classification, a cookie declaration generated from the scan result, or alerts when new or changed trackers appear. 1 2 13
The Agency Developer
The scanner is said to detect cookies, tags, trackers, pixels and beacons with automatic categorisation and automated rescans, and mobile apps can be scanned and rescanned programmatically via the integrations API. I found no public information on a maintained vendor database with purposes, providers and lifetimes, alerts when a client adds a new tracker, or a self-updating cookie declaration generated from the scan. 1 2 13
The Publisher Marketing Lead
The product scans for cookies, tags, trackers, pixels and beacons, categorizes cookies and trackers automatically, automates scans with record-keeping, and can scan and rescan mobile apps programmatically through an API. We found no public information on scan depth or schedule, a maintained vendor classification database, or alerts when new or changed trackers appear. 1 2 13
The In-House Lawyer
The product pages confirm detection of cookies, tags, trackers, pixels and beacons with automatic categorisation and automated scans, and mobile apps can be audited for hidden tracking technologies and rescanned programmatically via the integrations module. Scheduled rescan depth, a maintained classification database with purposes, providers and lifetimes, alerts on new or changed trackers and a self-updating cookie declaration are not described in the captured pages. 1 2 13
The WordPress Webmaster
The product page documents scans that find cookies, tags, trackers, pixels and beacons, automatic categorization, and automated scans with record-keeping, plus programmatic app scans and rescans via an API. I found no public information on a cookie declaration generated from the scan, the classification database's size or detail, or alerts on new trackers. 1 2 13
The Skeptic
The product page states scanning for cookies, tags, trackers, pixels and beacons with automatic categorisation, scans can be automated with records kept, and apps can be scanned and rescanned programmatically through an API. We found no public information on rescan schedules and scan depth, the classification database behind the automatic categorisation, alerts on new or changed trackers, or a cookie declaration generated from the scan. 1 2 13 14
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
Consent receipts are described for demonstrating compliance, bulk export jobs for data subjects, consent receipts and cookie receipts can be created, monitored and downloaded through an API, and the documented consent string carries a data subject identifier across devices with expiry and re-consent reason codes, while withdrawal is converted into a formal privacy rights request in the mobile global opt-out flow. We found no public information tying each record to the banner version the visitor saw, on retention and storage location for the consent log, or on a consent ID the visitor could look up. 2 15 9 10
The Agency Developer
Consent receipts and continuous monitoring are offered, reconsent is triggered when new SDK data is published, consent expiry and cross-device synchronisation are real behaviours with documented reason codes, and a bulk export API packages data subjects, consent receipts and cookie receipts for download. I found no public information on retention periods for the consent log, records tied to the exact banner version and texts shown, or a consent ID the visitor can look up. 2 9 10 15
The Publisher Marketing Lead
Consent receipts and cookie receipts can be bulk-exported through an API for compliance reporting, cross-device and cross-app consent synchronization is documented in the banner data flow, reason codes cover consent expiry and re-prompting, and a withdrawal can be converted into a formal privacy request record. We found no public information on records tied to the exact banner version and texts shown, a stated retention period for the consent log, or a consent identifier the visitor can look up themselves. 15 2 9 10
The In-House Lawyer
Consent receipts and cookie receipts exist and can be bulk-exported through an API for compliance reporting, the banner logic evidences reconsent, consent expiry and cross-device synchronisation, and a mobile global opt-out becomes a formal privacy request reviewed in the admin console. I could not find the retention period for consent logs, records tied to the exact banner version and texts shown, a consent ID the visitor can look up, or any tamper-evidence — the pieces I would need to answer a supervisory authority or a consumer group. 2 9 10 15
The WordPress Webmaster
Consent receipts and cookie receipts can be bulk-exported through an API for compliance reporting, consent expiry and re-consent are built into the banner logic, and cross-device consent synchronisation is documented. I found no public information on retention of the consent log, records tied to the banner version shown, a visitor consent-ID lookup, or tamper-evidence. 15 2 9
The Skeptic
Consent receipts with continuous monitoring are named, and bulk export jobs for data subjects, consent receipts and cookie receipts can be created, tracked, downloaded and cancelled through an API. Re-asking is documented precisely — reason codes cover republished configurations, expired consent, expired TC strings and authenticated users — and consent persists across sessions and syncs across devices without third-party cookies. We found no public information on how long consent records are kept, where they are stored, a consent ID the visitor can look up, or withdrawal recorded as its own event. 2 9 15
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
IAB TCF 2.2 is documented through a dedicated compliance solution and the IAB template type, Google Consent Mode is described with Google's consent API and its signals, and the mobile and connected-TV SDKs cover an unusually wide set of platforms from iOS and Android to Roku, tvOS, Unity and MAUI, with an OAuth-secured REST API and a catalog of 112 integrations. We found no public information on a registered IAB CMP ID, Microsoft UET consent mode, or GPP and GPC handling within the product itself. 16 11 17 10 13 4
The Agency Developer
TCF 2.2 templates with the consent-string headers, Google Consent Mode through the gtag consent API with default and update commands and cookieless pings, a REST API on OAuth 2.0 client credentials, and an unusually wide spread of mobile and connected-TV SDKs from Android TV to Roku, tvOS and Flutter — the signal plumbing is strong. But I found no public information on plugins for WordPress, TYPO3 or Shopify, a registered CMP ID or Google CMP certification, Microsoft UET or GPP signals, or agency accounts to run many client sites from one login. 9 10 13 16 17
The Publisher Marketing Lead
This is the area I care about most and it holds up: IAB TCF 2.2 templates carrying the IAB TC String, Google Consent Mode through the gtag consent API with default and update commands, cookieless measurement pings and ads data redaction documented, and SDKs for iOS, Android and connected TV that synchronize consent across devices on one platform, with REST APIs and cross-domain deployment. We found no public information on a registered IAB CMP ID, Google's CMP certification, Microsoft UET consent mode, or GPP and Global Privacy Control signals in the product itself. 9 16 17 13 10 11
The In-House Lawyer
IAB TCF 2.2 templates, Google Consent Mode with consent status and conversion pings, iOS and Android SDKs, and connected TV across Roku, tvOS and Android TV are documented, alongside a catalog of 112 integrations, OAuth-secured REST APIs and cross-domain deployment. I found no public information on a registered IAB Europe CMP ID, Microsoft UET consent mode, GPP support, agency accounts managing many client sites, or the vendor being named a Google-certified CMP. 4 9 10 13 16 17
The WordPress Webmaster
IAB TCF 2.2 templates, Google Consent Mode with default and update commands, iOS and Android SDKs reaching connected-TV platforms, a Google Tag Manager integration, cross-domain deployment, OAuth REST APIs and a 112-entry integration catalogue are documented. I found no public information on a registered IAB CMP ID, Google's CMP certification, Microsoft UET, GPP/GPC signals for the web banner, or a WordPress plugin, which matters most for my site. 16 17 13 1 9 10
The Skeptic
Google Consent Mode is documented in depth — default and update commands, consent, conversion and analytics pings, cookieless pings under denied analytics storage, and ad-click redaction — and the IAB TCF EU v2.2 consent string flows through the banner API with a TCF 2.2 compliance offering alongside it. Mobile and connected-TV SDKs are documented to an unusual level of detail: iOS, Android, tvOS, Roku, Fire TV, Samsung and LG, React Native, Flutter, Cordova, Unity and MAUI, with REST and OAuth for configuration. We found no public information on a registered IAB Europe CMP ID, Microsoft UET consent mode, Global Privacy Platform support, or the vendor named as a Google-certified CMP. 9 10 11 16 17
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
The contracting side of the chain sits in the United States, with the headquarters address in Atlanta and a US entity certified under the Data Privacy Framework, while transfers are covered by the framework, standard contractual clauses and a published DPA. A subprocessor list is published and ISO 27001, ISO 27701 and SOC 2 Type II are stated with statements of applicability, but we found no public information on where the banner script is served from or where consent logs and scan results are stored. 6 7 15 9
The Agency Developer
The contracting entity sits in Atlanta, Georgia, which is proven, and there is a published DPA, SCCs, a transfer impact assessment practice, a published subprocessor list and ISO 27001 and SOC 2 Type II documentation. I found no public information on EU hosting for the banner script and consent logs, on subprocessor locations, or on an EU contracting entity, so the European end of the chain stays unproven even though the paperwork is there. 6 7
The Publisher Marketing Lead
The contracting entity is a US company headquartered in Atlanta, and while standard contractual clauses, a published data processing agreement, a published subprocessor list, ISO 27001 with a statement of applicability and SOC 2 Type II are all documented, we found no public information on where the banner script and consent logs are hosted, on EU hosting or an EU contracting option, or on subprocessor locations. 6 7
The In-House Lawyer
The contracting entity is a US company headquartered in Atlanta relying on the Data Privacy Framework, EU standard contractual clauses and transfer impact assessments, with a published data processing agreement, a published subprocessor list and ISO 27001 and SOC 2 attestations. No EU hosting or EU contracting entity for the banner script and the consent logs is documented and the subprocessor locations are not given in the captured pages, so a chain that sees every one of our visitors rests on transfer mechanisms rather than EU residency. 6 7
The WordPress Webmaster
The contracting party sits in Atlanta, USA, and where the banner script, consent logs and scan results are hosted is not stated on the captured pages; standard contractual clauses, a data processing agreement, a published subprocessor list, and ISO 27001/27701 and SOC 2 Type II certifications are posted. That is a documented US chain with transfer safeguards rather than a European one. 6 7
The Skeptic
The headquarters and certified entity is in Atlanta, Georgia, and the whole transfer story is built on the EU-US Data Privacy Framework with FTC enforcement and US-based BBB dispute resolution; a privacy policy, a DPA with SCCs, a subprocessor list and ISO 27001 and SOC 2 Type II are published on the trust pages. We found no public information on where the banner script, consent logs and scan results are hosted or stored, on subprocessor locations, or on an EU hosting option — so residency stays open, and so does the question of what leaving would cost. 6 7
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
The captured product pages offer a free trial and a demo request, and the training programme notes free online courses alongside paid in-person options. We found no public information on prices, tiers, per-domain fees, traffic limits, add-ons or minimum terms, so a buyer cannot compute an annual cost from what is public. 1 16 8
The Agency Developer
No prices appear on the captured product pages — the path shown is a demo request and a free trial, with tiers, per-domain cost, traffic limits, agency terms and minimum term all unpriced. I cannot compute an annual cost for a single client site from public information, let alone for a forty-client portfolio. 1 16
The Publisher Marketing Lead
The captured pages offer a free trial and a demo request, and the online training courses are free, but we found no public information on product pricing — no tier prices, no scaling rule per domain or traffic band, and no priced add-ons such as TCF or the app SDKs. As a buyer I cannot compute an annual cost from anything captured here. 1 16
The In-House Lawyer
The only pricing-related items on the captured pages are a free trial and a demo request; we found no public information on tiers, price per domain, page-view or consent limits, or what TCF, app SDKs and multi-domain use cost. A buyer cannot compute an annual cost from the public pages, so for us this would be a procurement negotiation rather than a published price. 1
The WordPress Webmaster
Only a free trial and a demo request are public; no price per site or domain, tiers, traffic limits or add-ons appear anywhere. As the buyer of a single company site I cannot compute the annual cost without talking to sales. 1 16
The Skeptic
The captured pages offer a demo request and a free trial, and beyond that no price figure at all: no tiers, no per-domain licence, no traffic or consent limits, no add-on or agency pricing. No buyer can compute an annual cost from public pages when the product is sold through a demo call; the only priced items found are the training courses, free online and paid in person. 1 8 16
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about OneTrust Cookie Consent
Is OneTrust Cookie Consent European?
No. whats-best.ai classifies OneTrust Cookie Consent as Rest of world.
Where does OneTrust Cookie Consent store data?
Not stated on the vendor’s pages as of 29 Oct 2026.
Does OneTrust Cookie Consent have a free plan?
Not stated on the vendor’s pages as of 29 Oct 2026.
What are the best alternatives to OneTrust Cookie Consent?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: OneTrust Cookie Consent alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (onetrust.com/de/products/cookie-consent, onetrust.com/products/mobile-app-consent, onetrust.com/solutions/consent-and-preferences, onetrust.com/integrations, onetrust.com/about-us/legal, onetrust.com/privacy-notice and 11 more). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 12 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (17)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (cookie consent product) www.onetrust.com Checked 29 Oct 2026 Details →
- 2 Features page (mobile apps) www.onetrust.com Checked 29 Oct 2026 Details →
- 3 Features page (consent and preferences) www.onetrust.com Checked 29 Oct 2026 Details →
- 4 Integrations page www.onetrust.com Checked 29 Oct 2026 Details →
- 5 Legal notice www.onetrust.com Checked 29 Oct 2026 Details →
- 6 Privacy policy www.onetrust.com Checked 29 Oct 2026 Details →
- 7 Security / trust page www.onetrust.com Checked 29 Oct 2026 Details →
- 8 Security / trust page (certifications) www.onetrust.com Checked 29 Oct 2026 Details →
- 9 Banner & choice architecture — found from sitemap developer.onetrust.com Checked 29 Oct 2026 Details →
- 10 Banner & choice architecture — found from sitemap developer.onetrust.com Checked 29 Oct 2026 Details →
- 11 Prior blocking & script control — found from sitemap www.onetrust.com Checked 29 Oct 2026 Details →
- 12 Prior blocking & script control — found from sitemap developer.onetrust.com Checked 29 Oct 2026 Details →
- 13 Scanning & cookie classification — found from sitemap developer.onetrust.com Checked 29 Oct 2026 Details →
- 14 Scanning & cookie classification — found from sitemap developer.onetrust.com Checked 29 Oct 2026 Details →
- 15 Consent records & proof — found from sitemap developer.onetrust.com Checked 29 Oct 2026 Details →
- 16 Frameworks, signals & platforms — found from sitemap www.onetrust.com Checked 29 Oct 2026 Details →
- 17 Frameworks, signals & platforms — found from sitemap developer.onetrust.com Checked 29 Oct 2026 Details →