OneTrust

Overview

Founded in 2016 and headquartered in Atlanta, OneTrust is the largest enterprise platform in the Compliance & Legal space. Its surface runs from consent management through data mapping, data subject requests, third-party risk, GRC, and ESG reporting, with mid-market and multinational clients as the core.

Scale is both the moat and the cost. A $300M round in 2021 valued the company at $5.3B, and acquisitions added consent (CookiePro) and third-party risk. Buyers gain one vendor across compliance modules, and inherit long implementations and substantial annual fees.

It does not fit independent publishers. A consent banner is its smallest module and the real value sits in cross-department data inventories and audit trails, so for a banner alone any dedicated CMP is cheaper and faster to launch.

Core Strengths

• One platform spanning consent, data mapping, DSAR, third-party risk, and GRC or ESG, purchasable module by module
• A $300M round in 2021 at a $5.3B valuation made it one of the largest privacy technology vendors
• Consent banners in 100+ languages with cultural adaptation for unified multi-market rollout
• Consent signal integrations with mainstream ad and analytics stacks, covering IAB TCF v2.2 and GPP

Product Ecosystem

Consent management across channels

Web, app, OTT, and offline touchpoints feed one consent store, and the value is one consent state per person, since multi-channel businesses suffer most when channels disagree about what a user agreed to.

Data mapping and third-party risk

Automated discovery plus questionnaires build records of processing activities and supplier risk ratings. This is what separates it from a pure CMP, and it is also the longest part of implementation.

Drawbacks

• Annual fees scale with modules and company size, straining smaller teams and requiring budget cycles
• Implementation is long and usually involves consultants plus legal, measured in quarters
• The broad surface makes the console complex, with a steeper learning curve than a dedicated CMP
• Pricing is not published, so comparison depends on sales conversations

Use Cases

• Multinational groups and multi-market operations (★★★★★) - Unified consent state across languages, regimes, and touchpoints is its strongest scenario
• Enterprises needing ROPA and supplier risk (★★★★★) - Data mapping and third-party assessment go beyond what a CMP can do
• Mid-market companies (★★★☆) - Modules can be trimmed, but implementation cost and internal effort must be assessed
• Personal sites and small content sites (★) - Buying it for one banner is uneconomic compared with a dedicated CMP

Pricing

Pricing is unpublished and charged annually by module and company size, with implementation billed separately. When modelling total cost of ownership, list internal labour as its own line, since implementation and operations effort often rivals the subscription itself.

FAQ

• Do I need OneTrust for just a cookie banner? No. A dedicated CMP is cheaper and faster, and OneTrust's value is data mapping plus cross-department inventories, so buying its smallest module means paying for capabilities you do not use.

• How long is implementation? Measured in quarters and driven by mapping scope and supplier count. Start with one business line rather than a full rollout, which is usually more controllable.

• Does it support TCF v2.2? Yes, alongside the GPP framework, and it can pass consent signals to mainstream ad platforms. Verify signal mapping per platform, otherwise consent recorded in the console may still be treated as absent downstream.