Cookiebot vs OneTrust vs Usercentrics: choose a CMP your team can run

Last updated: 9 October 2026.

Define the job before comparing banners

A CMP must help your website collect a choice, preserve the relevant record and make that choice affect the technologies that run. The visible banner is only one part of the job.

Start with a list of properties and journeys. Include the marketing website, blog, application, checkout, support centre and any domains reached through forms or payment flows. Name the owners of GTM, hardcoded scripts, embedded tools and server-side integrations. A tool cannot control a data flow merely because its logo appears in the footer.

Write the requirements in terms someone can test:

• Which regions and processing purposes need different rules under the organisation's approved policy?
• Which languages and accessible interactions must the banner support?
• Which services must wait, change behaviour or remain unavailable after a refusal?
• How can a visitor reopen preferences and withdraw a previous choice?
• Where are consent records stored, and who can retrieve the relevant version?
• Which websites, apps and third parties need the choice, and how is it transmitted?
• Who approves changes when a new advertising tag, chat widget or embedded video is introduced?

This list prevents a common procurement mistake: buying a plan that covers the homepage, then discovering that domain limits, app requirements or an unsupported integration define the real implementation.

Keep the collection requirements beside the tracking plan. The same event should not have one consent assumption in GTM and a different one in a server-side destination.

Understand what each vendor counts

The pricing below uses published euro prices checked on 9 October 2026, excluding VAT where the vendor states it. Treat the scenarios as subscription estimates for the stated configuration. Confirm the selected plan, billing period, required features and current checkout or quote before purchase.

Cookiebot: inspect scanned pages and domains

Cookiebot's pricing page lists monthly Premium tiers including Medium at €30 and Large at €50 per domain. A single domain with 200 scanned pages belongs in the €30 case; one with 5,000 pages belongs in the €50 case. The headline €15 Small price requires an account with at least four domains. It is not the price for every small website.

Cookiebot's pricing page states that traffic is not the billing limit. That can make the model attractive when traffic grows faster than the website's page inventory. Each domain still needs to be assessed, and the included features must meet the requirements.

Use the scanner's URL inventory, not the number labelled “Pages” in WordPress or the number indexed by Google. Cookiebot documents that it scans accessible HTML, including dynamic content, and provides a discovered URL list. A linked error page or old public test page can affect that inventory. Scanner definition.

Review duplicate routes, obsolete public pages and unnecessary URL variants because they are also maintenance problems. Do not hide active tracking pages from discovery just to force the website into a cheaper tier. Preserve coverage of the journeys visitors actually use.

Usercentrics: forecast its sessions, not just GA4 sessions

The Usercentrics Web CMP pricing page lists Pro at €30 per month for up to 15,000 sessions and three domains. Its Business usage tiers include 200,000 sessions and 20 domains for €200 per month. The page specifies monthly billing for these self-service plans and automatic adjustment when limits are exceeded. Subdomains count towards the domain allowance.

Do not substitute a GA4 screenshot for the vendor's billable usage. Usercentrics describes a 30-minute session mechanism using its own script and browser cache; a later page load can begin another session. Cross-domain sharing also affects how sessions carry across properties. Usercentrics session definition.

Ask for usage reporting during evaluation and compare it with your traffic forecast. The counts can differ from analytics for implementation and definition reasons. The useful budgeting input is the quantity the contract bills.

OneTrust: request a scoped package quote

OneTrust's current pricing and packaging page distinguishes CMP Base from CMP Suite. Base covers consent experiences across web, mobile and connected TV. Suite adds capabilities around notices and data-subject requests. Both describe pricing based on average daily visitors aggregated across channels and properties, with prices obtained through a quote.

The same page lists Universal Consent & Preference Management separately, with a different profile-based billing unit. Do not assume a cookie-consent quote includes every CRM preference-management capability you saw in a demo.

Request the exact package, included properties, billable-visitor definition, usage bands, implementation services, support terms and renewal mechanics. A third-party median contract value would not price your configuration accurately, so it is not used here.

Compare two realistic site shapes

These are original examples using the published rates above. They assume one billable domain, no optional add-ons and that the selected plans meet the site's actual feature requirements. Annual figures are twelve months at the stated monthly rate, not annual-payment discounts.

Many pages, modest traffic

Suppose a resource library has 5,000 scanned pages and 12,000 billable CMP sessions per month. Cookiebot's stated tier gives €50 monthly, or €600 over twelve months. Usercentrics Pro gives €30 monthly, or €360 over twelve months. The subscription difference is €240 a year under those assumptions.

Now ask what happens when the library expands and when traffic grows. A content programme might add thousands of pages without immediately adding visits. A successful launch might reverse that pattern. Price the direction your own site is likely to take, rather than copying the recommendation for a different business.

Few pages, substantial traffic

Suppose a campaign website has 200 scanned pages and 200,000 billable sessions monthly. Cookiebot's stated single-domain case gives €30 monthly, or €360 over twelve months. Usercentrics' stated 200,000-session tier gives €200 monthly, or €2,400 over twelve months. The difference is €2,040 a year before feature and implementation differences.

This example sits at the Usercentrics tier limit. Budget for the next tier if the forecast has meaningful upside; do not treat exactly 200,000 sessions as spare capacity. Cookiebot's page count should also include the actual campaign routes and any separately billable properties.

Neither example establishes which product will take fewer engineering hours or provide better support for your site. Those are separate evaluation questions. Give OneTrust the same property and usage assumptions so its quote can enter the comparison without pretending it has an equivalent published monthly price.

Compare the cost of owning the implementation

Subscription cost is only one line. Estimate initial configuration, consent-policy review, tag migration, journey testing, ongoing scan review and the effort required to investigate a new vendor or failed integration.

Use the same internal hourly-cost assumption across vendors. Otherwise one comparison may include an engineer's time while another quietly assumes maintenance is free. Include the work you already perform in another system so you do not buy overlapping capabilities without a reason.

A useful shortlist follows the shape of the work:

• Consider Cookiebot when its per-domain page model fits your growth pattern and the required website controls work in your evaluation.
• Consider Usercentrics when the session and domain allowance fits your properties and the selected plan covers the configurations your team needs.
• Include OneTrust when broader property coverage, notice management or request workflows are part of the buying decision, or when an existing organisational deployment could reduce duplicate work.

These are selection criteria, not claims that one vendor always serves startups and another always serves enterprises. A small team can have complex requirements; a large company can have a simple website consent use case.

Open full diagram

Separate Google partnership from a working consent setup

Google lists Cookiebot, Usercentrics and OneTrust among its CMP partners. The documentation distinguishes dedicated integrations from the wider partner list and says adopting a partner does not guarantee compliance with Google's EU User Consent Policy. Google's setup guidance.

Also distinguish an advertiser's consent-mode integration from a publisher's TCF requirements. For applicable publisher use cases in the EEA, UK and Switzerland, Google's publisher CMP requirements concern certified CMPs and the IAB Transparency and Consent Framework. Google states that certification does not check full compliance with applicable privacy laws.

For procurement, ask which exact integration and certification your use case requires, whether the chosen product and plan support it, and who configures it. A certification badge cannot tell you whether your custom checkout script respects a visitor's choice.

If you only operate a marketing website with analytics and advertising tags, do not copy a publisher configuration without understanding why it exists. Conversely, a site monetising through publisher products should not assume that sending the four consent-mode signals completes its publisher requirements.

Verify the data flow behind the banner

Google's consent-mode overview separates basic and advanced implementations. Basic mode blocks Google tags before consent; advanced mode can send consent signals and measurements without cookies while consent is denied. These are materially different data flows. Consent-mode overview.

Choose the mode that matches the approved requirements. Do not describe advanced mode as “nothing leaves the browser” or switch it on merely because a sales page promises better modelling.

For Google tags, verify analytics_storage, ad_storage, ad_user_data and ad_personalization as distinct signals. Google's implementation guide requires defaults before measurement commands and updates when the visitor's choice changes. An update must occur on the page where the choice is made, before navigation loses it.

Follow the current vendor integration instructions for GTM, a CMS plugin or a direct installation. Give one integration clear responsibility for setting defaults and updates. Two competing snippets can make a banner appear correct while the underlying state changes in the wrong order.

Then inspect non-Google technologies separately. A Meta tag, embedded scheduler or custom HTML tag does not become consent-aware merely because a Google tag has built-in checks. Map each service to the intended behaviour and verify its actual requests and storage.

If events are forwarded through server-side GTM or another backend, check that the downstream path respects the approved choice too. The server-side GTM setup guide explains where forwarding and field controls sit in that flow. Moving an event to a server does not erase the consent decision attached to its collection or use.

Run the same acceptance tests for every shortlisted CMP

Start with a clean browser state and a representative page for each important journey. Record the region rule, configuration version, expected behaviour and observed requests. A screenshot of the banner alone is weak acceptance evidence.

Test the initial state before interaction. Then test rejection, full acceptance and a granular choice such as analytics allowed while advertising remains denied. Reload and navigate so you know whether the choice persists as intended. Reopen preferences and withdraw a previous permission.

Repeat the relevant paths on mobile, after a slow network load, across a domain transition and through your forms or checkout. Inspect keyboard navigation, focus, labels and whether the banner prevents essential tasks from completing. Check your actual language content; an available language setting does not establish that your custom wording is understandable.

For each case, inspect storage, consent state and the relevant network requests. The expected request pattern depends on the approved mode and service, so “zero requests” is not a universal test assertion. What matters is whether the observed behaviour matches the defined requirement.

Scans help find technologies, but they do not exercise every business journey. Cookiebot documents that its scanner does not complete form submissions or pay for cart items. Those paths need deliberate testing. Scanner behaviour.

Record failures as concrete issues: which page, which choice, which service, what happened and who owns the fix. This makes vendor support useful and prevents a vague “consent mode broken” ticket from bouncing between the marketing team and the developer.

Plan the handover and the next change

Before replacing an existing CMP, export the settings and records you need to retain, inventory category mappings and plan how old preferences will be handled. Do not assume two products interpret the same category name identically or that existing consent records can be imported without checking their scope and format.

Test the replacement in a controlled environment with a rollback plan. Remove redundant integrations deliberately, then verify the production journeys again. A migration that leaves two banners or two consent-state writers can create a new failure while appearing to remove the old one.

Assign an operating owner. They should review newly detected services, usage approaching billing limits, configuration changes and failures reported by the team. Add a consent check to the release process whenever someone introduces a tag, embeds a new service or changes a checkout path.

Keep measurement consequences visible without treating maximum acceptance as the sole success metric. The useful outcomes are understandable choices, correct enforcement, reliable permitted measurement and a setup the team can maintain.

An analytics and tracking implementation should leave you with that evidence alongside the banner configuration. Choose the CMP your team can operate correctly, then keep it aligned with the data flows the business actually uses.