OneTrust pricing: what OneTrust publishes, September 2026
OneTrust publishes no price for any of its nine packages, checked 28 September 2026. Cost is set by a sales quote against per-package usage meters, and inventory is the meter most likely to move a bill after signing.
OneTrust publishes no price. Its pricing page, checked 28 September 2026, lists nine packages across five solution areas. Each package shows a “Get Pricing” button where a figure would sit.1 The cost comes from a sales quote. OneTrust bases it on usage meters: admin users plus an inventory for the risk and governance packages, and daily visitors or data subject profiles for the consent packages.1
The number to prepare before a sales call is your own count on each meter.
TL;DR
- OneTrust sells by quote only. None of its nine packages shows a price, a free edition or a trial offer.1
- Three solution areas come in Base and Suite editions. Suite adds data subject request handling in consent and privacy, and Dow Jones ethics screening in third-party management.1
- Inventory is the meter to watch. Admin users count a team, inventories grow with the business, and OneTrust moves customers who consistently exceed a tier to the next one.1
- Dollar figures in search results come from buyer marketplace data. OneTrust has not confirmed the reported minimum contract.2
How we checked OneTrust’s pricing page
We read OneTrust’s US English pricing page, titled “OneTrust Pricing and Packaging”, on 28 September 2026.1 OneTrust sits within our compliance automation coverage. For each package we recorded the solution area, the edition, the listed capabilities and the line that states the pricing basis. We then searched the captured page for currency amounts, free plans and trial offers. None appeared.1
The count at each step: five solution areas, nine packages, nine pricing-basis lines and zero published prices. OneTrust also offers German, Spanish, French, Italian and Portuguese versions of the page. We did not check those.1 The standard behind every check is set out in our research methodology.
What packages does OneTrust publish?
OneTrust publishes nine packages in five solution areas: AI Governance, Consent & Preferences, Privacy Automation, Tech Risk & Compliance and Third-Party Management. None carries a published price. Each package states the basis OneTrust prices it on, shown below in OneTrust’s own words.1
| Solution area | Package and edition | Pricing basis, as OneTrust states it | Published price |
|---|---|---|---|
| AI Governance | AI Governance | Admin users and AI inventory | None |
| Consent & Preferences | Consent Management Platform (CMP) Base | Average daily visitors aggregated across all channels and properties | None |
| Consent & Preferences | Consent Management Platform (CMP) Suite | Average daily visitors aggregated across all channels and properties | None |
| Consent & Preferences | Universal Consent & Preference Management (UCPM) | Total data subject profiles captured | None |
| Privacy Automation | Privacy Automation Base | Users and privacy asset inventory | None |
| Privacy Automation | Privacy Automation Suite | Users and privacy asset inventory | None |
| Tech Risk & Compliance | Tech Risk & Compliance | Admin users and asset inventory | None |
| Third-Party Management | Third-Party Risk Management Base | Admin users and third-party inventory | None |
| Third-Party Management | Third-Party Management Suite | Admin users and third-party inventory | None |
Source: OneTrust pricing page, checked 28 September 2026.1
Two names on OneTrust’s site sit outside this list. Its navigation offers a “Data Use Governance” solution, and its pricing form lists “Data Governance” as a solution of interest. Neither has a package on the pricing page.1 A buyer who needs data governance should ask which package the quote is built on.
What does each OneTrust package include?
Base editions cover the core programme, and Suite editions add a second workflow. In Consent & Preferences and Privacy Automation, the addition is data subject request (DSR) handling. In Third-Party Management, it is ethics and compliance screening with Dow Jones data. AI Governance and Tech Risk & Compliance each come as one package.1
AI Governance keeps AI initiatives, models, agents, datasets and vendors in one system of record. It aligns risk assessments to the EU AI Act, NIST and ISO 42001, and it sets approval gates before a system reaches production. At runtime it applies controls to prompts, outputs, data access and allowed AI actions. It also governs agent tool access across MCP environments.1
CMP Base builds consent banners for websites, mobile apps and CTV devices. It keeps an inventory of trackers and SDKs, and OneTrust says its cookie database holds over 45 million categorised cookies.1 CMP Suite adds centrally managed privacy notices and DSR automation, covering intake, identity verification, discovery and redaction.1
UCPM does a different job. It collects consent and preferences across the customer journey, runs branded preference centres and syncs that data to marketing systems. It is metered on data subject profiles, while both CMP editions are metered on visitors.1
Privacy Automation Base maintains a data and activity map and runs privacy impact assessments. It also assesses vendor privacy risk, manages DPAs and data transfers, and supplies DataGuidance regulatory intelligence.1 Privacy Automation Suite adds DSR fulfilment from intake to deletion, plus management of privacy incidents and notification duties.1
DSR tools therefore appear in two Suite editions, CMP Suite and Privacy Automation Suite. OneTrust’s pricing page gives no account of how the two relate.1 A buyer who needs consent banners and privacy operations together should confirm which package carries the DSR workflow before signing.
Tech Risk & Compliance is OneTrust’s governance, risk and compliance (GRC) package. It supplies templates and guidance across 50+ standards, regulations and frameworks. It consolidates assets for IT risk, quantifies risk and automates assessments and control management. It also runs the policy lifecycle with reviews, approvals and attestations.1
Third-Party Risk Management Base builds the third-party inventory and automates vendor assessments. OneTrust says it adds risk intelligence data on millions of third parties.1 Third-Party Management Suite adds Dow Jones ethics and compliance databases, including PEP, sanctions and watchlists. It also screens for adverse media and reputational risk. Both editions use the same meter: admin users and third-party inventory.1
How does OneTrust set the price?
OneTrust prices each package on “one or more value-based usage meters”, and the meter depends on the programme.1 Its FAQ says risk and compliance solutions “are metered on admin users and the size of inventory managed by the solution.” Data collection and use solutions are metered on data profiles, visitors or data volume.1
The model is tiered, and the tiers sit inside the contract term. OneTrust’s pricing form offers “a personalized quote based on your team size and business goals.”1 The quote is where the tier, the meter counts and the price meet for the first time.
One meter in the FAQ has no package attached. OneTrust names data volume as a pricing basis, but no package on its pricing page lists it.1 If a quote uses data volume, ask which package it applies to and how OneTrust counts it.
Which meter will move a OneTrust quote?
Inventory is the meter most likely to raise a OneTrust bill after signing. Glamdring Research reads OneTrust’s terms this way for a structural reason. Admin users count a team. Inventories count the business: assets, third parties, AI systems and privacy assets. OneTrust’s FAQ says a customer whose usage “consistently exceeds the current tier’s limits” moves to the next tier with its Account Executive.1
Scrutineer, a compliance software company that sells a competing product, reaches the same view for vendor risk. It says a vendor inventory “only grows” as procurement adds tools and acquisitions add suppliers.3
Consent packages carry the same exposure through traffic. Both CMP editions count “average daily visitors aggregated across all channels and properties.”1 A new app or CTV property adds to that one count.
OneTrust publishes no tier limits and no definition of “consistently”. Ask for three things in writing: each tier’s limit on each meter, the next tier’s price, and the period over which “consistently exceeds” is measured. Scrutineer’s OneTrust guide recommends the same contract checks.3
Buyers weighing other compliance automation systems can read our Laika and Vanta comparison.
Why do third-party OneTrust prices disagree?
Third-party OneTrust prices disagree because they come from different samples of buyer data, collected at different dates. OneTrust supplies none of them. FeeGuides says its figures “come from buyers and analysts, not from the vendor”, and it cites Vendr data from 306 purchases.2 Scrutineer cites Vendr data across 309 purchases, as of February 2026.3
Scrutineer adds that a marketplace median “is not your number”. Its sample mixes single consent packages with multi-package programmes.3 FeeGuides reports a minimum annual contract and notes that “OneTrust has not confirmed it”.2 Software directories list OneTrust as a custom quote.4,5
Glamdring reports OneTrust’s published terms, so the package table holds no marketplace estimates. A single median spread across nine packages and five kinds of meter cannot price one buyer’s scope. Use the estimates to test whether a quote looks plausible. Negotiate from your own meter counts.
What the pricing page cannot tell you
OneTrust’s pricing page leaves every commercial term to the quote. As checked on 28 September 2026, it shows none of the following:1
- a price for any package or tier
- the limits of each tier on each meter
- setup, implementation or services fees
- contract length, renewal terms or annual increases
- prices outside the US English page
- how the DSR tools in CMP Suite and Privacy Automation Suite relate
Confirm each of these in the written quote before comparing OneTrust with another system. New pricing research in this category arrives through the Glamdring email briefing.
Frequently asked questions
Does OneTrust publish its prices?
No. On 28 September 2026, all nine packages on OneTrust’s pricing page showed a “Get Pricing” button and no figure.1 KolApp’s directory listing describes a “custom quote pricing model”.4 Lister’s listing shows pricing from “Custom”.5
Is OneTrust free?
OneTrust’s pricing page lists no free package and no trial offer, checked 28 September 2026.1 Directories disagree on a trial. KolApp lists no free trial.4 SpotSaaS lists one and links it to OneTrust’s pricing page.6 Ask OneTrust sales whether a trial exists for the package you need.
What is OneTrust used for?
OneTrust sells software for five programmes: AI governance, consent and preference management, privacy automation, technology risk and compliance, and third-party management.1 It defines a solution package as a bundle of the capabilities that support “an end-to-end customer use case”.1
How do customers on OneTrust’s older module pricing move to packages?
OneTrust tells customers on legacy module-based pricing to contact their Account Executive. The Account Executive walks through the new packages and prepares a customised proposal.1 Scrutineer notes that the old line items and the new meters “do not map one to one”. Request the new quote in writing before agreeing to migrate.3
What should a buyer count before asking OneTrust for a quote?
Count each meter for each package you plan to buy. For the risk and governance packages, that means admin users plus the inventory each package manages: AI systems, assets, privacy assets or third parties. For consent, count average daily visitors across all channels and properties. For UCPM, count total data subject profiles.1 Bring those counts to the sales call and ask which tier each one falls into.
Sources checked
Company-owned pages establish what a company says. They do not prove a market conclusion. Each source is dated so readers can judge each claim.
