OneTrust doesn't publish a price. There's no pricing page with tiers and a sign-up button. What you get instead is a contact form, a sales process, and a custom quote built around which modules you buy, how many admins you have, and how much data you're managing. Here's what real buyers actually pay in 2026, from third-party transaction data, and the costs that sit under the subscription line.
Key Takeaways
- 01OneTrust doesn't publish pricing; every plan is a sales call and an annual contract.
- 02Vendr's data puts the median OneTrust deal around $11,970/yr, with a $10,000 annual minimum as of Q2 2026.
- 03Implementation runs $10,000 to $50,000 (20 to 40% of the subscription), contracts carry 5 to 10% annual escalators, and buyers leaving the retired Pro tier report far steeper jumps.
- 04For website consent alone, a focused CMP like ConsentStack is $29/mo ($348/yr) with no sales process.
It helps to know what OneTrust is. It's a broad enterprise privacy and governance platform: data mapping, DSAR automation, AI governance, vendor risk, and cookie consent as one module among many. If all you need is a cookie banner, you're pricing a small part of a very large product.
What OneTrust actually costs
Since OneTrust doesn't list prices, the best data comes from procurement platforms that track real contracts. Vendr, which negotiates software deals for its customers, publishes aggregate numbers from hundreds of OneTrust purchases:
| What you pay | Amount | Source |
|---|---|---|
| Median annual contract | ~$11,970/yr | Vendr (307 purchases) |
| Common deal range | ~$1,620 to $48,230/yr | Vendr |
| Larger deployments | $50,000 to $300,000+/yr | Vendr / buyer reports |
| Annual minimum (as of Q2 2026) | $10,000/yr | OneTrust |
| Implementation (one-time) | $10,000 to $50,000, or 20 to 40% of the annual subscription | Vendr |
| Training and onboarding | Another 5 to 10% of the subscription | Vendr |
| Annual escalation clause | 5 to 10% per year | Vendr |
In short: the typical buyer lands around $12,000 a year, above the $10,000 annual minimum OneTrust made official in Q2 2026 (it is also retiring its self-serve Pro tier, so there is no longer any way to buy below that floor), and large or multi-module deployments run into six figures. Implementation is a separate one-time cost on top. If you're also weighing TrustArc, see our TrustArc pricing teardown: same custom-quote model, slightly higher median.
OneTrust cost by deployment size
Vendr groups the OneTrust contracts it has negotiated into three bands by buyer size. The bands are wide because a quote is built from usage meters rather than a rate card, so two companies of the same size can land far apart.
| Deployment | Annual subscription | What sits in the band |
|---|---|---|
| Small to mid-sized, one or two modules | Tens of thousands of dollars: $10,000 minimum up to about $48,000 (the top of Vendr's recorded range is $48,230) | Cookie consent on its own, or consent plus one privacy module |
| Mid-market, several modules | Low to mid six figures | Consent plus privacy automation or third-party risk, across regions |
| Enterprise, full platform | Mid to high six figures or more | Privacy, GRC, AI governance and custom integrations across a multinational |
The median buyer at $11,970 a year sits at the bottom of the first band. That is the number to anchor on if you are a single-module buyer; the six-figure bands describe suite deployments, not a cookie banner.
How OneTrust meters each solution package
OneTrust's own pricing page lists nine solution packages and no prices. It says each package carries one or more value-based usage meters: data profiles, visitors or data volume for the data-collection products, and admin users plus inventory size for the risk and compliance programs. Cookie consent lives in the two CMP packages.
| Solution package | What it covers | Metered by |
|---|---|---|
| Consent Management Platform (CMP) Base | Cookie consent banner and preference collection | Visitors |
| Consent Management Platform (CMP) Suite | CMP Base plus the wider consent and preference tooling | Visitors |
| Universal Consent & Preference Management (UCPM) | Cross-channel consent and preference records | Data profiles |
| Privacy Automation Base and Suite | Data mapping, assessments, DSAR automation | Admin users and inventory size |
| Third-Party Risk Management Base and Third-Party Management Suite | Vendor risk and third-party management | Admin users and inventory size |
| Tech Risk & Compliance | IT risk, controls and compliance | Admin users and inventory size |
| AI Governance | AI inventory, assessments and policy | Admin users and inventory size |
What that means for a cookie-banner buyer: the meter on a CMP package is your visitor traffic, so the quote moves with your audience, and the $10,000 annual minimum applies whether you take one package or five. OneTrust's page also says the tiered model has "room for growth throughout your contract term" and addresses usage that "consistently exceeds the current tier's limits", so budget for the meter to move within the term, not only at renewal.
The costs under the subscription
The subscription is only part of the number. A few things buyers consistently run into:
- Implementation fees. $10,000 to $50,000 is common to get set up, which Vendr puts at 20 to 40 percent of the annual subscription, with training and onboarding adding another 5 to 10 percent.
- A sales process. There's no self-serve path. Expect demos, scoping calls, and a procurement cycle measured in weeks, not minutes.
- Modular pricing. Consent is one module. Data mapping, DSAR automation, and the rest are priced separately, so the quote grows with each capability you add.
- Escalators, overage and support. Vendr reports annual escalation clauses of 5 to 10 percent written into contracts, overage fees adding 10 to 20 percent when traffic or data passes the contracted tier, and premium support at another 10 to 15 percent. Some buyers report far steeper jumps: one OneTrust Pro customer described a "275% followed by 468%" increase on short notice as that self-serve tier was retired.
OneTrust uses a modular, custom-quote model. What you pay depends on which modules you license, how many admin seats you need, your data volumes, and how hard you negotiate. Two companies of the same size can pay very different amounts. That's standard for enterprise privacy suites; it's also the opposite of self-serve.
When OneTrust is the right call
OneTrust earns its price for the job it's built for. If you need a full privacy program spanning data mapping, DSAR automation, AI governance, and vendor risk across a large organization, few tools match its breadth, and roughly three-quarters of the Fortune 100 use it. When the scope is that big, the cost is proportionate, and consent is just one line in a much larger platform you'd be buying anyway.
When it isn't
The mismatch shows up when all you actually need is website consent. Paying $10,000 or more a year, plus implementation, plus a multi-week sales process, to put a compliant cookie banner on your site is a lot of platform for one job. Most small and mid-market sites are in exactly this spot: they need consent handled correctly, not an enterprise governance suite.
A flat-priced alternative for website consent
If website consent is the job, ConsentStack does that one thing for a flat $29 a month, or $0 on the free tier, with no sales call and no contract. That covers geo-aware script blocking, 195+ regulations, consent logging, and platform integrations, self-serve and live in minutes. At $29 a month, that's $348 a year against OneTrust's $10,000-plus.
To be clear about the trade: ConsentStack is a consent platform, not a full privacy program. It doesn't do DSAR automation, data mapping, or AI governance. If you need those, OneTrust or a suite like it is the right category. If you need a cookie banner that's compliant, on-brand, and cheap to run, that's exactly what ConsentStack is for. The full ConsentStack vs OneTrust comparison lays it out side by side.
Check what you're actually paying for
Whatever you're running today, it's worth confirming the banner actually blocks trackers before consent, since that's the part that creates legal exposure. Run your site through our free compliance scanner to see what fires before and after someone clicks Reject. About a minute, no email.
OneTrust pricing FAQ
OneTrust doesn't publish pricing. Based on Vendr's transaction data, the median deal is around $11,970 a year, with a common range from roughly $1,600 to $48,000 and larger deployments running $50,000 to $300,000 or more. As of Q2 2026 there is a $10,000 annual minimum, and implementation fees of $10,000 to $50,000 are typical on top.
No. There are no public tiers or self-serve sign-up. Every plan requires a sales conversation and an annual contract, with a custom quote based on the modules, admin seats, and data volumes you need.
Yes. As of Q2 2026, OneTrust has a $10,000 annual minimum deal size, so smaller buyers can't purchase below that floor.
Because cookie consent is one module in a broad enterprise privacy platform priced for data mapping, DSAR automation, and governance. You're buying into that model even if you only need the banner, and implementation fees plus annual renewal increases add to it.
For website consent specifically, ConsentStack is a self-serve alternative at $29 a month ($348/yr) or free, with no sales process, covering 195+ regulations, script blocking, and consent logging. It doesn't replace OneTrust's full privacy-program modules; it replaces the cookie-banner part at a fraction of the cost.
OneTrust does not sell monthly plans; every contract is annual. Vendr's $11,970 median works out to about $1,000 a month, and the $10,000 annual minimum is roughly $830 a month, before implementation fees and any overage.
Cookie consent is sold as the Consent Management Platform (CMP) Base or CMP Suite package, metered by visitors, and OneTrust publishes no price for either. The $10,000 annual minimum applies, so a banner-only buyer should expect at least that plus implementation. Standalone consent tools cover the same job for $0 to about $200 a month.
See what your cookie banner actually does
Run a free compliance scan against EU and US rules and find out what fires before consent. No signup.
Related Posts
How Much Does a Consent Management Platform Cost? (2026 Pricing Guide)
What consent management platforms actually cost in 2026: entry prices, billing units (per domain, pageview, session, or visitor), and hidden fees, compared across 10 CMPs from free to enterprise.
Cookiebot Pricing Explained (2026): What You Actually Pay
What Cookiebot really costs in 2026: the per-subpage tiers, the August 2025 price increase, and the per-domain math, with a flat-priced alternative from $29/mo.
CookieYes Pricing Explained (2026): What You Actually Pay
What CookieYes really costs in 2026: the per-domain tiers, the features gated behind Pro and Ultimate, the pageview-limit banner suspension, and a flat-priced alternative from $29/mo.