# OneTrust Cookie Consent — Consent Management (CMP)

OneTrust Cookie Consent by OneTrust LLC holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-10-30. Provenance: Rest of world; sovereignty: not determined.

- Vendor: OneTrust LLC (https://www.onetrust.com/de/products/cookie-consent/)
- Category: [Consent Management (CMP)](https://whats-best.ai/software/consent-management.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/consent-management/onetrust-consent
- Alternatives: https://whats-best.ai/software/consent-management/onetrust-consent/alternatives ([markdown](https://whats-best.ai/software/consent-management/onetrust-consent/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-10-30 · oldest source captured 2026-10-29

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: OneTrust LLC
- Headquarters: Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 29 Oct 2026

## The panel's verdict

OneTrust Cookie Consent is the cookie consent product of OneTrust LLC's OneTrust platform, used on more than 750,000 websites by the vendor's count. It is strongest where its documentation runs deepest: banner and choice scores sit at 7 with no spread, standards and platforms at 6 to 7 — Google Consent Mode, IAB TCF 2.2 templates, and SDKs from iOS and Android to Roku and tvOS. Weakest are sovereignty, 3 to 4 — headquarters and certified entity are in Atlanta, transfers rest on the Data Privacy Framework and standard contractual clauses, and we found no public information on where the banner script, consent logs and scan results are hosted — and scanning and classification, 4 to 5, with no public information on scan depth, rescan schedules, the classification database or tracker-change alerts. Consent records show the widest spread, 5 to 7: the marketing lead found bulk export, cross-device sync and withdrawal-to-privacy-request flow sufficient; the in-house lawyer wanted retention periods, records tied to the banner shown, a visitor-lookup consent ID and tamper-evidence. Public pages show a demo request and a free trial.

**Speaks for it:**
- Banner and choice documented down to numeric reason codes for consent expiry and re-consent, with accept, reject-all and a purposes layer listing partner vendors, plus per-country geolocation rules.
- Auto-blocking offered and documented as capable of blocking Google Tag Manager itself, with a manual path of blocking and exception triggers and blocked tags firing without reload once consent is given.
- Standards and platforms scored 6 to 7 — Google Consent Mode with default and update commands and cookieless pings, IAB TCF 2.2 templates, mobile and connected-TV SDKs across iOS, Android, Roku, tvOS, Unity and MAUI, and a catalog of 112 integrations.
- Consent receipts and cookie receipts bulk-exportable through an API, with consent syncing across devices without third-party cookies and the mobile global opt-out converting withdrawal into a formal privacy rights request.
- Trust documentation published — a DPA, standard contractual clauses, a subprocessor list, ISO 27001 and SOC 2 Type II.

**Held against it:**
- Sovereignty scored 3 to 4 — headquarters and certified entity are in Atlanta, and we found no public information on where the banner script, consent logs and scan results are hosted or on subprocessor locations.
- Scanning and classification scored 4 to 5, with no public information on scan depth, rescan schedules, the classification database behind automatic categorisation or alerts when trackers change.
- We found no public information on placeholders for embedded videos, maps and social content, on server-side tagging, or on a documented way to verify on the live site that nothing loads before consent.
- We found no public information on a registered IAB Europe CMP ID, Google CMP certification, Microsoft UET consent mode or Global Privacy Platform signals.
- No price figures appear on the captured pages, which offer a demo request and a free trial.

**Best for:**
- You deploy consent across many countries and platforms — per-country geolocation rules, Google Consent Mode, IAB TCF 2.2 templates and the mobile and connected-TV SDKs are the highest-scoring areas.
- Your site is built on Google Tag Manager — auto-blocking that can hold back Google Tag Manager itself, manual blocking and exception triggers, and data-layer logic for tags firing after consent without reload.
- You need exportable consent evidence for reporting — bulk export of data subjects, consent receipts and cookie receipts through an API, with reason-coded re-consent and cross-device sync.
- You are a publisher tracking consent performance — banner customisation, consent-rate monitoring over time and cross-domain deployment are documented.

**Avoid if:**
- You require an EU hosting or EU contracting option for the consent chain — headquarters and certified entity are in Atlanta, transfers rest on the Data Privacy Framework and standard contractual clauses, and we found no public information on an EU option, hosting locations or subprocessor locations.
- You must defend consent records to a regulator — consent records scores span 5 to 7, and we found no public information on retention periods, records tied to the exact banner version shown, or a consent ID the visitor can look up.
- You rely on scanning as your compliance backbone — this criterion scores 4 to 5, and we found no public information on scan depth, rescan schedules or the classification database behind automatic categorisation.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Data Protection Officer | The Agency Developer | The Publisher Marketing Lead | The In-House Lawyer | The WordPress Webmaster | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Banner & choice architecture | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Prior blocking & script control | 3/5 | 3/5 | 3.5/5 | 3/5 | 3.5/5 | 3/5 |
| Scanning & cookie classification | 2/5 | 2/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2/5 |
| Consent records & proof | 3/5 | 3/5 | 3.5/5 | 2.5/5 | 3/5 | 3/5 |
| Frameworks, signals & platforms | 3/5 | 3/5 | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 |
| European sovereignty | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 1.5/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **3/5** | **3/5** | **3.5/5** | **3/5** | **3/5** | **2.5/5** |

### The judges

- **The Data Protection Officer** (v1.0): External DPO for a dozen mid-sized companies, two of which received a letter from a state supervisory authority about their cookie banner last year. Wants reject on the first layer, nothing loaded before the click, a consent log that shows which banner version each visitor saw, a cookie list that matches the site, and a DPA and subprocessor list that keep visitor data in the EU.
- **The Agency Developer** (v1.0): Lead developer at a web agency that maintains forty client sites on WordPress, TYPO3 and Shopify. Wants one account for every client, blocking that works without rewriting each theme, content blockers for YouTube and Maps, a Tag Manager template, a scanner that flags the tracker a client added on Friday, and a JavaScript API documented well enough that forms and plugins can ask for consent.
- **The Publisher Marketing Lead** (v1.0): Runs marketing for an ad-funded news site and an online shop in the same group, where every point of consent rate shows up in ad revenue and in Google Ads conversions. Wants a registered IAB TCF CMP, Google Consent Mode v2 in advanced mode, banner tests within what the law allows, consent shared between the site and the app, and a dashboard that shows where visitors drop off.
- **The In-House Lawyer** (v1.0): In-house counsel at a retailer with shops in Germany, France and Austria, who has read the court decisions on missing reject buttons and the regulators' banner guidance. Wants § 25 TDDDG and the GDPR mapped to concrete settings, equal-weight choices as the default, consent that can be withdrawn as easily as it was given, and records that would hold up if a competitor or a consumer group sued.
- **The WordPress Webmaster** (v1.0): Looks after the WordPress site of a mid-sized engineering company on top of the actual job, with Google Analytics, a YouTube channel, a Maps embed and a contact form with reCAPTCHA. Wants a plugin that finds these by itself, blocks them until the visitor agrees, survives the next plugin update and caching, and costs a known amount per site per year without a call to sales.
- **The Skeptic** (v1.0): Has opened the browser's network tab on sites with a "certified" banner and watched the ad pixels fire before anything was clicked. Reads "consent rate optimisation" as a hint that reject will be grey and small, "auto-blocking" as a claim until the test steps are published, and "EU hosting" next to a US script CDN — and asks what leaving would cost: the consent logs, and every visitor asked again.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Caiq: CAIQ v4.0.3 self-assessment [S7]
- Dpf certified entity: OT Technology Inc. [S6]
- Dpf complaint timeline: 45 [S6]
- Dpf dispute resolution: DPF Services (BBB National Programs) · yes [S6]
- Dpf participation: yes · yes · yes [S6]
- Dpframework scots: U.S. Department of Commerce · yes [S6]
- Ecovadis: EcoVadis Committed Sustainability Rating Badge [S7]
- Ens: ENS (Esquema Nacional de Seguridad) Basic attestation [S7]
- Ftc jurisdiction dpf: yes [S6]
- Gpc honored: yes [S6]
- Hitrust: HITRUST certification [S7]
- ISO 27001: ISO/IEC 27001 certification and Statement of Applicability [S7]
- ISO 27017: ISO/IEC 27017 certification and Statement of Applicability [S7]
- ISO 27701: ISO/IEC 27701 certification and Statement of Applicability [S7]
- ISO 9001: ISO 9001 certification [S7]
- Law enforcement transfers: no [S6]
- No monetary sale: no [S6]
- No sale of minors data: yes [S6]
- Onward transfer disclosure categories: payment processing providers · customer relationship management · consulting · e-mail · product feedback · helpdesk services · advertising networks · website analytics companies · Event sponsors [S6]
- Pci dss: PCI DSS certification and third party responsibility matrix [S7]
- Penetration test: 2026 Main Web and API Penetration Test executive summary available [S7]
- Sccs available: https://www.onetrust.com/legal-sccs/ · yes [S6]
- Security certifications reference: OneTrust Trust page [S6]
- Sensitive data opt in: yes [S6]
- SOC 2 type2: SOC 2 Type II audit reports [S7]
- Tia performed: yes [S6]
- TISAX: TISAX certification [S7]
- Transfer mechanisms: EU Standard Contractual Clauses · UK IDTA · Adequacy Decisions [S6]
- Transparency report: yes · Transparency Report [S6]
- Trust center: Trust Center with certifications, audit reports, security documentation, privacy materials, Responsible AI resources, and system status [S7]
- Tx ramp: TX-RAMP certification [S7]

**Data**
- Children policy: 13 [S6]
- Retention policy: Retention varies by category of information and relationship; goal is to keep for shortest period possible to achieve purpose [S6]
- Subprocessors: Subprocessor list published [S7]

**Integrations**
- Access token lifetimes: 1 Hour · 1 Day · 1 Week · 1 Month · 1 Year [S13]
- Acoustic: Acoustic consent management integration [S4]
- API host: https://app.onetrust.com [S15]
- Auth: OAuth 2.0 · Client Credentials [S13]
- Aws data discovery: Amazon Redshift Data Discovery integration [S4]
- Banner error codes: ERROR_CODE_GENERIC_ERROR (500) · ERROR_CODE_NO_ACCESS (403) · ERROR_CODE_TEXT_RESOURCE_NOT_FOUND (404) · ERROR_CODE_INVALID_OT_CONSENT_STRING (400) · ERROR_CODE_INVALID_COUNTRY_OR_REGION (400) · ERROR_CODE_BLOB_LOCATIONS_UNAVAILABLE (400)… [S9]
- Banner request headers: OT-Language · OT-Country-Code · OT-Region-Code · OT-Force-Fetch · OT-Exclude-Html-Tags · OT-CDN-Location · OT-App-Id · OT-SDK-Version · OT-Device-Type · OT-Consent-String (after first call) [S9]
- Catalog size: 112 [S4]
- Categories: categories include Consent & Preferences, Data Discovery & Security, Privacy Management [S4]
- Categories: CMP · Web Development · Consent & Preferences [S11]
- Connection methods: APIs · SDKs · data feeds · system integration [S4]
- Credential scopes: Integration Scope · Cookie Scope [S13]
- Developer: OneTrust [S11]
- Dsar support: Amazon API Gateway integration supports servicing DSARs [S4]
- File types: 64 · .ipa · .apk [S13]
- Ftp method: FTP · 64 [S13]
- Global opt out dsar endpoint: POST · https://mobile-data.onetrust.io/cfw/cmp/v1/dsar [S10]
- Gtm modules: Consent · Cookie Compliance [S11]
- Marketplace: yes [S4]
- Microsoft: Microsoft integration for privacy compliance workflows and consent data in Microsoft 365 [S4]
- Partner program: yes [S4]
- Platforms: IOS · ANDROID [S13]
- Request integration: yes [S4]
- Rest file limit: REST form-data · 64 [S13]
- Snowflake: Snowflake integration for consent management, data use governance, data privacy [S4]
- Social import scope: yes [S6]
- Social login providers: DataGuidance · Microsoft · Meta · Google · LinkedIn · X · Apple · Full name · Email address [S6]
- Token URL: https://{environment}.onetrust.com/api/access/v1/oauth/token [S13]

**Legal**
- Controller entity: 505 North Angier Avenue NE, Suite 9000, Atlanta, GA 30308, United States [S6]
- Copyright notice: Copyright notice published [S5]
- Dnt not honored: no [S6]
- Documents: Legal documents incl. DPA, MSA, SCC available [S7]
- Effective date: Effective October 23th, 2026 [S6]
- Integrity program: Business Integrity & Responsibility Program promoting ethical behavior, speak-up culture, and compliance with global laws [S5]
- Schrems ii: Schrems II Response White Paper [S7]
- Trademark guidelines: Trademark usage terms published [S5]
- Trademark list: Non-exhaustive trademark list published [S5]
- Training materials ip: training content is OneTrust exclusive property [S8]
- UK gender pay gap report: UK Gender Pay Gap Report published [S5]

**Product**
- Ad storage denied behavior: No new advertising cookies written; no first-party advertising cookies read; third-party cookies limited to spam/fraud purposes [S17]
- Ads data redaction: ads_data_redaction=true redacts ad-click identifiers and page URLs with them; requests sent through a different domain [S17]
- AI transparency report: AI Systems Transparency Report [S7]
- AI usage disclosed: yes [S6]
- Analytics denied behavior: No read/write of first-party analytics cookies; cookieless pings sent for measurement and modeling [S17]
- App audit tracking technologies: Audit apps for hidden cookies and other tracking technologies [S2]
- Architecture whitepaper: Security, Privacy & Architecture Overview Whitepaper [S7]
- Auto blocking: yes [S1]
- Auto categorization: yes [S1]
- Autoblocking gtm block: OneTrust Auto-Blocking can block Google Tag Manager itself [S12]
- Badge requirement: all track courses required for badge [S8]
- Banner buttons: I Accept · BANNER_ALLOW_ALL · Reject All · BANNER_REJECT_ALL · Show Purposes · vendorList · List of Partners (vendors) [S9]
- Banner geo rule note: Banner details are not returned if the banner is not configured to be shown in your geolocation rule [S9]
- Banner reason codes: Show banner enabled in geo rule and is first launch · SDK data has been published with reconsent · Consent has expired · TC String has expired · Reconsent triggered for an authenticated user · 100% sync not achieved for cross device sync e… [S9]
- Banner response contents: appConfig (showBanner, bannerReason, bannerReasonCode, templateType) · bannerUIData (general, logo, summary, buttons, links) · storageKeys (IAB TC string, additional consent, OT group consents, SDK consents) · otConsentString [S9]
- Banner script tag type: Banner script deployed as a Custom HTML tag in GTM [S12]
- Banner UI endpoint: GET · Retrieve the required attributes to render the banner UI · https://mobile-data.onetrust.io/cfw/cmp/v1/banner [S9]
- Blocking trigger same event: GTM blocking triggers must fire on the same event as the active triggers [S12]
- Bulk export API endpoint: /api/ot-insights/v1/bulk-export-jobs [S15]
- Bulk export capabilities: yes · yes · yes · yes [S15]
- Bulk export use cases: compliance reporting, data analysis, backup and archiving [S15]
- Certification badge provider: Credly badge for completed learning track [S8]
- Certification cost: free · paid [S8]
- Certification process: prerequisite course · exam · courses + badge [S8]
- Certification program exclusivity: customers and partners only [S8]
- Consent mode: Tag behavior configurable based on consent via Google's Consent Mode [S11]
- Consent mode API: Uses the gtag('consent') API with 'default' and 'update' commands [S17]
- Consent mode deployment: gtag.js · Google Tag Manager [S11]
- Consent mode persistence: no [S17]
- Consent mode products: Google Ads · Floodlight · Google Analytics · Conversion Linker [S11]
- Consent mode supported products: Phone Conversions support pending · Google Ads · Floodlight · Google Analytics [S17]
- Consent ping types: Consent status pings, conversion pings, Google Analytics pings [S17]
- Consent preferences: Capture, store, flag, and manage user consent and preferences with OneTrust Consent & Preferences [S16]
- Consent rate monitoring: Monitor consent rates over time [S2]
- Consent receipts monitoring: Consent receipts and continuous monitoring [S2]
- Container import option: Recommended container import option is Merge with overwrite of conflicting tags, triggers and variables [S12]
- Cookie consent description: Cookie Consent vereinfacht Cookies-Compliance und Einwilligungsmanagement [S1]
- Cookieless consent sync: Cross-device and cross-app consent synchronization via cookieless syncs [S2]
- Course formats: instructor-led · eLearning / self-paced [S8]
- Course registration: registration via OneTrust University [S8]
- Custom scan completion: Update Scan Job Status API sets job from IN_PROGRESS to COMPLETED [S14]
- Custom scan oauth: Requires OAuth 2.0 Client Credentials; credential file contains client_id and secret for custom scanner authentication [S14]
- Custom scan purpose: Custom Scan APIs retrieve custom scan jobs, submit metadata for cataloging, and submit content for classification [S14]
- Custom scan requirements: Requires configuring Ingress for the Worker Node per API Access for Worker Node Management [S14]
- Custom scan workflow: Workflow: generate access token, get pending scan jobs for a data source, update job status PENDING to IN_PROGRESS [S14]
- Customer count: 750000 [S1]
- Customizable banners: Customizable banners to maximize opt-in [S2]
- Customizable banners: yes [S1]
- Data enrichment disclosed: yes · yes [S6]
- Datalayer ignore attribute: prevents OneTrust CDN from pushing to window.dataLayer · data-dLayer-ignore [S12]

**Subprocessors**
- Onward transfer liability: yes [S6]

**Support**
- Document write conflict: Multiple tags/containers with Support document.write checked can prevent the OneTrust script from firing [S12]
- Status page: System status page for service availability and operational health [S7]

64 more facts on the canonical page: https://whats-best.ai/software/consent-management/onetrust-consent

## Questions

### Is OneTrust Cookie Consent European?

No. whats-best.ai classifies OneTrust Cookie Consent as Rest of world.

### Where does OneTrust Cookie Consent store data?

Not stated on the vendor’s pages as of 29 Oct 2026.

### Does OneTrust Cookie Consent have a free plan?

Not stated on the vendor’s pages as of 29 Oct 2026.

### What are the best alternatives to OneTrust Cookie Consent?

As of 3 Nov 2026, the panel rates [Usercentrics CMP (3.5/5)](https://whats-best.ai/software/consent-management/usercentrics), [Didomi (3.5/5)](https://whats-best.ai/software/consent-management/didomi) and [CCM19 (3.5/5)](https://whats-best.ai/software/consent-management/ccm19) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Usercentrics CMP](https://whats-best.ai/software/consent-management/usercentrics) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [OneTrust Cookie Consent alternatives](https://whats-best.ai/software/consent-management/onetrust-consent/alternatives).

## Head-to-head

- [OneTrust Cookie Consent vs Usercentrics CMP](https://whats-best.ai/compare/onetrust-consent-vs-usercentrics.md)

## What this page leaves out

- We found no public information on pricing on the pages we read (onetrust.com/de/products/cookie-consent, onetrust.com/products/mobile-app-consent, onetrust.com/solutions/consent-and-preferences, onetrust.com/integrations, onetrust.com/about-us/legal, onetrust.com/privacy-notice and 11 more). If the vendor publishes it somewhere else, send us the page.
- 12 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage (cookie consent product): https://www.onetrust.com/de/products/cookie-consent/ (checked 2026-10-29)
- [S2] Features page (mobile apps): https://www.onetrust.com/products/mobile-app-consent/ (checked 2026-10-29)
- [S3] Features page (consent and preferences): https://www.onetrust.com/solutions/consent-and-preferences/ (checked 2026-10-29)
- [S4] Integrations page: https://www.onetrust.com/integrations/ (checked 2026-10-29)
- [S5] Legal notice: https://www.onetrust.com/about-us/legal/ (checked 2026-10-29)
- [S6] Privacy policy: https://www.onetrust.com/privacy-notice/ (checked 2026-10-29)
- [S7] Security / trust page: https://www.onetrust.com/trust/ (checked 2026-10-29)
- [S8] Security / trust page (certifications): https://www.onetrust.com/certifications/ (checked 2026-10-29)
- [S9] Banner & choice architecture — found from sitemap: https://developer.onetrust.com/onetrust/docs/get-banner-ui (checked 2026-10-29)
- [S10] Banner & choice architecture — found from sitemap: https://developer.onetrust.com/onetrust/docs/cmp-global-opt-out (checked 2026-10-29)
- [S11] Prior blocking & script control — found from sitemap: https://www.onetrust.com/integrations/google-tag-manager/ (checked 2026-10-29)
- [S12] Prior blocking & script control — found from sitemap: https://developer.onetrust.com/onetrust/docs/google-tag-manager (checked 2026-10-29)
- [S13] Scanning & cookie classification — found from sitemap: https://developer.onetrust.com/onetrust/docs/scan-apps-via-api (checked 2026-10-29)
- [S14] Scanning & cookie classification — found from sitemap: https://developer.onetrust.com/onetrust/reference/custom-scan-using-worker-node-apis (checked 2026-10-29)
- [S15] Consent records & proof — found from sitemap: https://developer.onetrust.com/onetrust/recipes/bulk-export-for-data-subjects-consent-receipts-and-cookie-receipts (checked 2026-10-29)
- [S16] Frameworks, signals & platforms — found from sitemap: https://www.onetrust.com/solutions/iab-tcf-2-2-compliance/ (checked 2026-10-29)
- [S17] Frameworks, signals & platforms — found from sitemap: https://developer.onetrust.com/onetrust/docs/using-google-consent-mode (checked 2026-10-29)

---

Cite as: whats-best.ai, "OneTrust Cookie Consent — Consent Management (CMP)", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/consent-management/onetrust-consent

Corrections: https://whats-best.ai/correct/1163?target=page