AdSovereign logo

    Identity and Privacy

    OneTrust CMP: TCF 2.3 and 2.4, GPP, Google certification, pricing and alternatives

    Published · Last updated
    Next review:

    By Art Kukharenko, CEO

    The OneTrust CMP is the consent management platform of OneTrust, an Atlanta privacy and AI governance software company. It runs cookie banners and consent records across websites, apps and connected TVs. IAB Europe lists it as TCF CMP 28, and Google lists it as a certified CMP (IAB Europe CMP list, 5 November 2026).

    Contents

    At a glance

    Company

    OneTrust LLC (OneTrust release, 9 February 2026)

    Headquarters

    Atlanta, Georgia, US, with 10 offices worldwide (OneTrust, About us)

    Founded

    2016 (OneTrust, About us)

    Ownership

    Private. Raised $150 million at a $4.5 billion valuation in July 2023 (SecurityWeek, 24 July 2023); Coatue says it remains "a significant investor" (OneTrust, 9 February 2026)

    Product category

    Consent management platform (CMP) inside a wider privacy, risk and AI governance suite

    What it does

    Scans sites and apps for trackers, shows region-specific consent banners, blocks tags until consent and stores consent records

    Deployment model

    SaaS in 14 shared production environments plus dedicated environments (OneTrust developer docs, updated 17 April 2026)

    Pricing model

    Not published; priced on average daily visitors across channels and properties (OneTrust pricing, accessed 9 November 2026)

    Key integrations

    Google Consent Mode, Firebase, IAB TCF and GPP keys in its SDKs (OneTrust developer docs)

    Publicly named customers

    n/d. The company says "more than half of the Fortune 500" use OneTrust (company claim, 9 February 2026)

    Standards supported

    TCF CMP 28 for web, app and CTV; TCF 2.3; GPP sections 2 and 7 to 12; Google certified CMP 28 (details below)

    Last verified

    9 November 2026

    FieldOneTrust

    Company

    OneTrust LLC (OneTrust release, 9 February 2026)

    Headquarters

    Atlanta, Georgia, US, with 10 offices worldwide (OneTrust, About us)

    Founded

    2016 (OneTrust, About us)

    Ownership

    Private. Raised $150 million at a $4.5 billion valuation in July 2023 (SecurityWeek, 24 July 2023); Coatue says it remains "a significant investor" (OneTrust, 9 February 2026)

    Product category

    Consent management platform (CMP) inside a wider privacy, risk and AI governance suite

    What it does

    Scans sites and apps for trackers, shows region-specific consent banners, blocks tags until consent and stores consent records

    Deployment model

    SaaS in 14 shared production environments plus dedicated environments (OneTrust developer docs, updated 17 April 2026)

    Pricing model

    Not published; priced on average daily visitors across channels and properties (OneTrust pricing, accessed 9 November 2026)

    Key integrations

    Google Consent Mode, Firebase, IAB TCF and GPP keys in its SDKs (OneTrust developer docs)

    Publicly named customers

    n/d. The company says "more than half of the Fortune 500" use OneTrust (company claim, 9 February 2026)

    Standards supported

    TCF CMP 28 for web, app and CTV; TCF 2.3; GPP sections 2 and 7 to 12; Google certified CMP 28 (details below)

    Last verified

    9 November 2026

    What it does

    OneTrust sells consent as one module of a much larger platform. The cookie product finds tags, pixels and trackers, sorts them by purpose and serves a banner that changes by country or US state. The company says more than 750,000 websites use it and that its cookie database holds over 45 million categorised cookies (company claims, OneTrust Cookie Consent).

    The CMP also reaches beyond the browser. OneTrust offers SDKs for mobile apps and for TV platforms such as Apple TV, Roku, Samsung and LG (OneTrust, Mobile and OTT/CTV SDKs). A publisher can therefore keep web, app and CTV consent in one account.

    The rest of the company has moved toward AI governance. It sold its ethics and compliance division to EQS Group on 10 December 2024. Its founder said the sale let OneTrust focus on "the responsible use of data and AI" (Thoma Bravo, 10 December 2024). Buyers who only need a cookie banner should know they are buying into a broad suite.

    How it works

    On the web, a script loads the banner, reads the visitor's location and applies the matching rule set. Tags stay blocked until the visitor agrees, either through OneTrust's own blocking or through a tag manager. The script then writes a TC String for Europe and a GPP string for US traffic, so that ad tech partners can read the choice.

    In apps the SDK stores the same signals under the standard IAB keys. OneTrust's TCF 2.3 page lists IABTCF_DisclosedVendors, the key for the segment that TCF 2.3 made mandatory (OneTrust, IAB TCF 2.3, updated 4 March 2026). How those strings reach a bid request is covered in GPP and TCF implementation for engineers.

    9 of 9 rows

    Columns (3)

    IAB Europe TCF registration

    CMP ID 28, "OneTrust LLC", active, web, mobile app and CTV

    IAB Europe CMP list, 5 November 2026

    TCF v2.3 (Disclosed Vendors)

    Documented; Disclosed Vendors key exposed

    OneTrust docs, 4 March 2026

    TCF v2.4 (web deadline 23 October 2026)

    n/d: no public statement found

    IAB Europe letter, 16 July 2026

    GPP sections

    2 (EU TCF), 7 (US National), 8 to 12 (California, Virginia, Colorado, Utah, Connecticut) in SDK docs

    OneTrust GPP docs

    GPP US National v3 (merged 4 November 2026)

    n/d: no statement found

    OneTrust GPP docs

    Google certified CMP (EEA, UK, Switzerland)

    Yes, "Onetrust / Cookiepro CMP", ID 28, web, app and CTV

    Google Ad Manager Help

    Google Consent Mode v2

    Supported; Google CMP Partner, Gold tier

    Google CMP Partner Program

    Platforms

    Web; Android, iOS, React Native, Flutter, Cordova, Ionic, MAUI and Unity; Apple TV, Android TV, Fire TV, Roku, Samsung TV, LG TV

    OneTrust SDK docs

    Hosting and data residency

    Shared environments for the US, EU, UK, Germany, France, Switzerland, Canada, Brazil, Australia, Japan, India, UAE and APAC, plus dedicated tenants

    OneTrust environment URLs, 17 April 2026

    TCF v2.3 (Disclosed Vendors)

    Status on 9 November 2026

    Documented; Disclosed Vendors key exposed

    GPP sections

    Status on 9 November 2026

    2 (EU TCF), 7 (US National), 8 to 12 (California, Virginia, Colorado, Utah, Connecticut) in SDK docs

    GPP US National v3 (merged 4 November 2026)

    Status on 9 November 2026

    n/d: no statement found

    Google certified CMP (EEA, UK, Switzerland)

    Status on 9 November 2026

    Yes, "Onetrust / Cookiepro CMP", ID 28, web, app and CTV

    Platforms

    Status on 9 November 2026

    Web; Android, iOS, React Native, Flutter, Cordova, Ionic, MAUI and Unity; Apple TV, Android TV, Fire TV, Roku, Samsung TV, LG TV

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    The environment list shows where an account is hosted. It does not say which consent records stay in that region, so ask before you sign.

    Ownership and material events

    4 of 4 rows

    Columns (3)

    24 July 2023

    $150 million raised at a $4.5 billion valuation

    SecurityWeek

    10 December 2024

    Ethics and compliance business sold to EQS Group

    Thoma Bravo

    9 February 2026

    John Heyman succeeds founder Kabir Barday as CEO; Barday stays on the board

    OneTrust

    3 November 2026

    New chief operating, legal and information officers named

    OneTrust

    24 July 2023

    Event

    $150 million raised at a $4.5 billion valuation

    10 December 2024

    Event

    Ethics and compliance business sold to EQS Group

    9 February 2026

    Event

    John Heyman succeeds founder Kabir Barday as CEO; Barday stays on the board

    Source

    OneTrust

    3 November 2026

    Event

    New chief operating, legal and information officers named

    Source

    OneTrust

    Download JSON

    Table by AdSovereign, CC BY 4.0.

    Pricing

    OneTrust does not publish a rate card. Its pricing page says the CMP is priced on "average daily visitors aggregated across all channels and properties" (OneTrust pricing, accessed 9 November 2026). Google's partner directory lists a 14-day free trial and pricing "based on visitor traffic, websites, and apps" (Google CMP Partner Program).

    CookiePro, the small-business brand, now lives on OneTrust.com. Existing CookiePro customers still buy and manage plans inside the CookiePro app (OneTrust, CookiePro FAQ). We found no CookiePro price list on that page.

    Strengths and limits

    Strengths

    • One account for web, app and TV. The SDK list covers six TV platforms, including Roku, Samsung and LG (OneTrust docs).
    • Wide hosting choice. Fourteen shared environments help a buyer place its account near its users (OneTrust docs).
    • Google status on every surface. Google certifies it for web, app and CTV and rates it Gold in its Consent Mode partner programme (Google; Google CMP Partner Program).

    Limits

    • No public price. Cost depends on traffic and scope, so budgets need a quote.
    • TCF 2.4 is undocumented in public. We found no OneTrust statement on the 23 October 2026 web deadline.
    • GPP state coverage looks partial. The SDK docs list five state sections (OneTrust docs), while the GPP standard defines 20 (IAB Tech Lab, GPP sections). Check the web product separately.
    • A suite, not a point tool. Leadership changes in 2026 and the AI governance focus may shape the roadmap more than cookie banners do.

    Alternatives

    • Usercentrics and Cookiebot: published monthly prices from €7 and a free tier for small sites.
    • Didomi: a European enterprise CMP with documented TCF 2.4 migration dates.
    • Osano: a US privacy platform with a free plan and a "No Fines. No Penalties." pledge.

    Test a OneTrust string before go-live with the TCF consent string decoder. The wider series sits on the identity and privacy hub.

    What we could not verify

    • Whether OneTrust's web CMP met the TCF 2.4 deadline of 23 October 2026. Its public docs did not say.
    • Which GPP state sections the web CMP writes beyond the five in the SDK docs, and any plan for US National v3.
    • Whether consent records stay inside the chosen hosting environment.
    • Any CookiePro or OneTrust list price, and the date CookiePro moved onto OneTrust.com.

    FAQ

    Is OneTrust a TCF 2.3 CMP?
    OneTrust is registered with IAB Europe as CMP 28 and documents TCF 2.3, including the Disclosed Vendors key (OneTrust docs, 4 March 2026). We found no public note on TCF 2.4, which web CMPs had to meet by 23 October 2026.
    Does OneTrust support GPP?
    Yes. Its SDK docs list GPP sections 2, 7 and 8 to 12, which cover the EU TCF, US National and five states (OneTrust GPP docs). Check the web product for newer state sections.
    How much does OneTrust cost?
    OneTrust does not publish prices. It bases the CMP fee on average daily visitors across all channels and properties (OneTrust pricing), and Google's directory lists a 14-day trial.

    Sources

    1. IAB Europe, CMP list (JSON, lastUpdated 5 November 2026). https://cmplist.consensu.org/v2/cmp-list.json
    2. Google Ad Manager Help, "Google consent management requirements for serving ads in the EEA, the UK, and Switzerland" (certified CMP list, accessed 9 November 2026). https://support.google.com/admanager/answer/13554116
    3. Google, "CMP Partner Program" (accessed 9 November 2026). https://cmppartnerprogram.withgoogle.com/
    4. IAB Europe, "TCF Policies v5.0.b and Specifications v2.4: confirmation of the timeline" (16 July 2026). https://iabeurope.eu/wp-content/uploads/TCF_V-CMP_comms_TCFpoliciesV5.0.bAndSpecificationsV2.4ConfirmationOf-theTimeline_160726_IABEurope.pdf
    5. OneTrust, "OneTrust Appoints John Heyman As CEO" (9 February 2026). https://www.onetrust.com/news/onetrust-appoints-john-heyman-as-chief-executive-officer-to-drive-ai-ready-governance-platform-innovation/
    6. OneTrust, "OneTrust Strengthens Executive Leadership Team" (3 November 2026). https://www.onetrust.com/news/onetrust-strengthens-executive-leadership-team-to-support-next-phase-of-growth/
    7. OneTrust, About us (accessed 9 November 2026). https://www.onetrust.com/about-us/
    8. OneTrust, Cookie Consent product page (accessed 9 November 2026). https://www.onetrust.com/products/cookie-consent/
    9. OneTrust, Pricing and packaging (accessed 9 November 2026). https://www.onetrust.com/pricing/
    10. OneTrust, "CookiePro.com Is Now Part of OneTrust.com" (accessed 9 November 2026). https://www.onetrust.com/cookiepro/
    More sources (8)
    1. OneTrust Developer Portal, "IAB TCF 2.3" (updated 4 March 2026). https://developer.onetrust.com/onetrust/docs/iab-transparency-and-consent-framework-22.md
    2. OneTrust Developer Portal, "IAB Global Privacy Protocol" (Android SDK, accessed 9 November 2026). https://developer.onetrust.com/onetrust/docs/iab-global-privacy-protocol-android-next-gen.md
    3. OneTrust Developer Portal, "Mobile & OTT/CTV SDKs" (accessed 9 November 2026). https://developer.onetrust.com/onetrust/docs/mobile-ctv.md
    4. OneTrust Developer Portal, "Google Consent Mode" (Android SDK, accessed 9 November 2026). https://developer.onetrust.com/onetrust/docs/google-consent-mode-android-next-gen.md
    5. OneTrust Developer Portal, "Environment URLs" (updated 17 April 2026). https://developer.onetrust.com/onetrust/reference/url-variables-for-apis-sdks.md
    6. SecurityWeek, "OneTrust Raises $150 Million at $4.5 Billion Valuation" (24 July 2023). https://www.securityweek.com/onetrust-raises-150-million-at-4-5-billion-valuation/
    7. Thoma Bravo, "EQS Group Acquires the Ethics and Compliance Business Division from OneTrust" (10 December 2024). https://www.thomabravo.com/press-releases/eqs-group-acquires-the-ethics-and-compliance-business-division-from-onetrust
    8. IAB Tech Lab, GPP "Section Information" (section IDs 1 to 27, accessed 9 November 2026). https://github.com/InteractiveAdvertisingBureau/Global-Privacy-Platform/blob/main/Sections/Section%20Information.md
    Changelog
    • 9 November 2026: profile drafted. TCF 2.4 status and GPP US National v3 support not found in public docs.

    Author: Art Kukharenko, CEO, AdSovereign. Published: 10 November 2026. Last updated: 10 November 2026.

    Spotted an error? Tell us