In short
- Founded 2016 in Atlanta by Kabir Barday, valued at $4.5B with 2,400+ employees
- Consent and Preferences is one module inside a 20+ module GRC platform
- Coverage spans every major privacy law, GDPR, CCPA, LGPD, PIPL, plus AI Act and 800+ regulations via the DataGuidance research team
- Athena AI engine and 2026 AI Governance suite add agent detection, policy enforcement, and continuous monitoring
- Enterprise pricing, $10K minimum annual contract, median spend $11.5K/year
What is OneTrust
OneTrust is the dominant enterprise privacy, security, and AI governance platform. Founded in 2016 in Atlanta by Kabir Barday, it hit $100M in revenue within three years on the back of GDPR and now serves over half the Fortune 500. Consent and Preferences is one module inside a broader GRC suite that also covers privacy automation, third-party risk, ethics, ESG, and AI governance. In 2026 OneTrust expanded the platform with the Athena AI engine and a new real-time AI Governance suite that adds agent detection, policy enforcement, and continuous monitoring of generative AI systems.
Where OneTrust fits in 2026
OneTrust is built for global organisations running multi-jurisdiction privacy programmes where consent is one input to a broader compliance posture. The Consent and Preferences module handles cookie banners, preference centres, user consent records, and privacy policy generation, but the platform’s pull is the breadth around it: 800+ regulations tracked by the DataGuidance team, integrations into Salesforce, Workday, and ServiceNow, and the ability to operate a unified consent record across web, mobile, app, in-store, and call-centre touchpoints. The trade-off is cost and complexity. OneTrust raised pricing in 2026 to a $10K annual minimum across all tiers, with the median buyer paying $11.5K/year, and implementations typically take weeks rather than days. For an SMB site or a single-brand DTC store, it is overkill.
How OneTrust compares to alternatives
- Usercentrics. EU-headquartered alternative with deep consent configuration at a fraction of OneTrust’s cost. Pick Usercentrics when consent is the use case; pick OneTrust when consent is one module in a broader GRC programme.
- Cookiebot. SMB and mid-market self-service CMP under the Usercentrics parent. A tenth of OneTrust’s price, plug-and-play, but no GRC layer.
- TrustArc. The other US enterprise GRC option. Smaller, more focused, often cheaper, but with a narrower platform footprint.
FAQ about OneTrust
How much does OneTrust cost?
OneTrust is quote-only and raised pricing in 2026 to a $10K annual minimum across all tiers. According to Vendr’s purchase data, the median buyer pays $11.5K/year. Consent and Preferences Essentials starts around $827/month for a single domain, with broader privacy bundles reaching $2,275/month and full enterprise contracts running into six figures.
Is OneTrust GDPR-compliant?
Yes. GDPR was OneTrust’s founding use case. The platform provides DSAR automation, records of processing, vendor risk, consent records, and DPIA workflows, the full Article 30 + Article 35 stack out of the box.
How does OneTrust handle Consent Mode v2?
OneTrust’s Consent and Preferences module integrates with Google Consent Mode v2 by passing the four standard signals to Google tags on consent state changes. The integration is a configured module rather than an out-of-the-box toggle and typically requires implementation services.
Does OneTrust support IAB TCF?
Yes. OneTrust is a registered IAB TCF v2.2 CMP for publishers and supports the US Multi-State Privacy Agreement (MSPA) for state law compliance.
Is OneTrust EU-hosted?
Yes, OneTrust offers EU-hosted deployments for customers with data residency requirements. The company is headquartered in Atlanta with global infrastructure, including EU and APAC data centres.
Does OneTrust have AI?
Yes. The Athena AI and Robotic Automation engine has been embedded in the platform since 2019 with 500+ purpose-built RPA plugins. In March 2026 OneTrust launched a real-time AI Governance suite covering AI agent detection, an AI policy manager and policy library, and continuous guardrail enforcement across generative AI, traditional ML, and agents.
How to use OneTrust?
Engage OneTrust sales for a scoped demo, then a paid implementation project. Most deployments take four to twelve weeks across configuration, integrations, and stakeholder training. Self-service signup is not available.
Why choose OneTrust?
OneTrust is the safe choice for global enterprises with multi-jurisdiction privacy obligations, complex vendor estates, and AI governance requirements. It is the only CMP with a fully integrated GRC suite around it.
How does OneTrust work?
OneTrust deploys as a SaaS platform with module-level configuration. The Consent and Preferences module exposes a JavaScript runtime API for tag gating, a REST API for consent records, and prebuilt connectors to Salesforce, Adobe, and Google.
Is OneTrust free?
No. OneTrust is enterprise-only and has a $10K annual minimum. There is no free tier or self-service trial.
How to learn OneTrust?
OneTrust University offers paid certifications, and the OneTrust YouTube channel publishes regular product demos. The OneTrust DataGuidance research portal is also a recognised reference for global privacy law.
What are OneTrust reviews?
OneTrust is rated 3.5 on G2 with 16 reviews. See the reviews for detailed customer feedback.
Does OneTrust have an API?
Yes. OneTrust exposes REST APIs across all modules, a JavaScript runtime API for consent, prebuilt connectors to enterprise SaaS, and webhooks for consent and privacy events.
Does OneTrust have a trial or a demo?
OneTrust offers a recorded 5-minute product demo and scheduled live demos through sales. There is no self-service free trial.
OneTrust pricing
OneTrust pricing starts at Quote. Plans are organised as Annual, $10K minimum contract. A Custom demo on request free trial is available. See the full OneTrust pricing page for current tiers and any add-ons.
