Consent Management Platform Pricing, Compared
OneTrust cookie consent pricing now starts at a roughly $10,000/year minimum — with no public price list and renewal increases some buyers report at several hundred percent. This is the real 2026 cost picture across eight consent management platforms, the billing models that quietly inflate your bill, and the one cost most pricing pages ignore entirely.
OneTrust does not publish cookie consent pricing — every quote is custom and gated behind a sales call. Based on third-party procurement data (Vendr, Spendflo), the median buyer pays roughly $10,500–$11,800 per year, with a reported ~$10,000 annual minimum as of Q2 2026 and implementation fees of $10,000–$50,000 on top. OneTrust retired its self-serve "Pro" tier and shifted from per-domain to traffic-based metering.
If you only need a compliant cookie banner, self-serve platforms cover the same core job for $0 to about $30/month — Cookiebot, CookieYes, Usercentrics, Termly, iubenda, Osano, and ConsentPixel among them. This is a product comparison, not legal advice; prices were verified in August 2026 and change often.
If you're pricing a consent management platform in 2026, you've probably already hit the wall: the tool everyone names first, OneTrust, won't show you a number. This guide fixes that — with real figures from procurement data and public pricing pages — and then does the part most comparison pages skip: it shows you which billing model will quietly balloon your bill, and the single largest cost that never appears on any CMP invoice.
OneTrust cookie consent pricing, decoded
Let's start with the search that brought most people here. The full OneTrust cost is genuinely hard to pin down because OneTrust publishes no rate card for its cookie consent pricing — every deal is quoted through sales. But enough procurement data has leaked into buying communities to sketch a reliable picture:
- ~$10,000/year minimum. Multiple sources report the OneTrust minimum annual commitment at about $10,000 taking effect in Q2 2026 — a hard floor that effectively prices out small sites that OneTrust's old entry tiers used to serve.
- ~$10,500–$11,800 median annual spend for cookie consent buyers, per Vendr and Spendflo transaction data, with a wide spread (roughly $1,400 to $42,500, and large deployments running $50,000–$300,000+).
- Historical module rate: the Consent & Preference Essentials product was listed around $827–$1,100+/month for a single domain before the model changed.
- The self-serve "Pro" tier was retired — there's no longer a low-cost, no-sales-call way in. Cookie-consent-only buyers get pointed at the enterprise plan.
- Per-domain pricing gave way to traffic metering (average daily unique visitors). Renewing customers have reported uplifts "as high as 500%," plus 5–10% annual escalators baked into multi-year contracts.
- Implementation fees of $10,000–$50,000 are commonly reported on top of the subscription.
OneTrust is a full enterprise privacy-governance suite — data mapping, DSAR automation, vendor risk, AI governance. Cookie consent is one module inside it. When you buy the banner, you're buying into that platform's pricing model, even if you'll never touch the other modules. For a buyer who needs only cookie consent, that's premium pricing for capability you won't use — which is exactly why so many mid-market teams re-evaluate at renewal.
To be fair to OneTrust: for large, regulated enterprises (roughly 1,000+ employees) with a dedicated privacy team and multi-jurisdiction, cross-channel governance needs, the breadth justifies the cost, and none of the lighter tools below replace the full platform. The mismatch is when a small or mid-size site needs "just a compliant banner" and gets quoted an enterprise contract.
Every CMP's pricing, side by side (2026)
Here's the core of this guide: consent management platform pricing across eight tools, with the entry price, the billing model, and what the free tier actually gives you. Every figure was verified against public pricing pages or procurement data in August 2026 and may have changed since.
| Platform | Entry price | Billing model | Free tier? | Notes |
|---|---|---|---|---|
| OneTrust | ~$10,000/yr min. | Traffic-metered | No | Quote-gated; enterprise suite; implementation $10k–$50k. |
| Osano | ~$199/mo (Plus) | Visitor-metered | Solo: 5k visitors/mo | Per-domain at the Plus tier; "$500k no-fines" guarantee. |
| Usercentrics Web CMP | ~€7/mo | Session-metered | Up to 1,000 sessions | €7 (1.5k sessions) → €50 (50k sessions, 10 domains). Cookiebot's migration path. |
| Cookiebot | ~€7–€34/mo | Per-domain (subpages) | 1 domain, 50 subpages | Doubled base price Aug 2025; banded by subpages; ~$8–$96/domain. |
| CookieYes | $10/mo (Basic) | Per-domain (pageviews) | 5,000 pageviews/mo | Up to $55/mo; overage $0.30/1,000 views; strong WordPress plugin. |
| Termly | ~$10–$14/mo | Per-domain (banner views) | Yes (limited) | Bundles legal-policy generation; key features gated to Pro+. |
| iubenda | ~€4.99/mo | Per-domain / pageview | Yes (limited) | Cheapest disclosed entry; lawyer-drafted policies; 27 languages. |
| ConsentPixel | $8.99/domain/mo | Per-domain / flat bundles | 14-day trial (no card) | Growth $29.99 (3 domains); Agency Lite $99.99 (10); CIPA session-replay blocking. |
Pricing verified August 2026 against public pricing pages and procurement data (Vendr, Spendflo, TermsFeed, vendor sites); enterprise tools with custom pricing are estimates. Figures change — confirm current rates before buying. ConsentPixel is included in this comparison; we've noted where competitors win.
Two things jump out. First, the gap between OneTrust and everything else isn't incremental — it's a different category of spend. Second, "entry price" is almost meaningless on its own, because how each tool bills you matters more than the headline number. That's the next section.
The three pricing models (and which one bites)
Nearly every CMP uses one of three billing models, and the model — not the sticker price — determines your real bill. Understanding this is the single most useful thing a buyer can take from this guide.
You pay per website (sometimes banded by subpages or pageviews). Cheap for one site; punishing at scale. Five sites on a $10/domain tool = $50/mo. Watch for subdomains counting separately.
You pay by sessions, pageviews, or unique visitors. Predictable on a steady single site — but a viral post or ad campaign can push you past your cap mid-cycle into overage or a forced upgrade.
A set number of domains for a fixed price. The math doesn't move with traffic or (within the bundle) domain count — the easiest to budget, and usually the cheapest once you run more than 2–3 sites.
What a CMP really costs at scale
The headline "from $10/month" hides the real bill. Two worked examples show why:
- A single high-traffic site. A per-domain tool banded by pageviews (Cookiebot's Medium band ≈ $34/mo, CookieYes up to $55/mo) or a session-metered tool (Usercentrics up to €50/mo) climbs as your traffic does. A viral spike can trigger overage or a forced tier bump mid-cycle.
- An agency with 10 client sites. Ten domains at $10/domain/month is $100/month before subdomains or overages — and on some tools each subdomain counts separately. A flat bundle (e.g. ConsentPixel Agency Lite at $99.99/mo for 10 domains, or Complianz's unlimited-WordPress plan) is where per-domain math stops making sense.
The rule of thumb: one site, low traffic → a free tier or a $5–$10/month plan is fine. Two to five sites → budget $15–$60/month or a flat bundle. Many sites or high traffic → flat/bundled pricing almost always wins. For agencies specifically, the per-domain-vs-flat decision is covered in more depth in our Cookiebot alternatives comparison, which breaks down the multi-site economics.
Check the one thing price can't tell you
A CMP's price is meaningless if its banner doesn't actually block trackers before consent. Scan your site free to see which trackers fire before anyone clicks — and whether any keep firing after "Reject." It's the same behavior a plaintiff's firm looks for, in about 10 seconds.
The cost every CMP pricing page ignores
Here's the gap in every competitor's pricing guide. They compare monthly fees down to the dollar — and never mention the single largest potential cost of choosing wrong: a privacy lawsuit the cheap tool didn't protect you from.
In the United States, the fastest-growing website privacy risk isn't a regulator's fine — it's private litigation under the California Invasion of Privacy Act (CIPA). Plaintiffs' firms are sending thousands of demand letters and filing class actions against sites running session-replay tools (Hotjar, Microsoft Clarity, FullStory) and tracking pixels on California visitors before consent. CIPA carries statutory damages of $5,000 per violation under California Penal Code §637.2 — and unlike a regulator's action, any affected individual can sue.
Most CMPs are tuned for the European opt-in model or a basic opt-out — they show a banner but still let session-replay and pixels load on arrival. That can leave the exact fact pattern CIPA plaintiffs target wide open. The "cheapest" tool that leaves this gap can cost you a five-figure demand letter — which makes it, in the only math that matters, the most expensive option on the table.
This is why comparing CMPs on monthly price alone is a mistake. The right question isn't just "what does it cost?" — it's "does the banner actually block the trackers that create legal exposure before consent?" Most pricing pages never ask it. Among mainstream tools, only a few have any explicit CIPA posture; most (CookieYes, Termly, iubenda, Usercentrics) do not. If you serve US traffic and run any session-replay tool, that capability should outweigh a few dollars of monthly price difference.
Which CMP should you pick?
Price is one input; fit is the decision. A quick, honest guide — including where each tool genuinely wins:
- You're a large, regulated enterprise needing data mapping, DSAR automation, and cross-channel governance → OneTrust (or a suite like it). The breadth justifies the cost; the lighter tools won't replace it.
- You run one WordPress/SMB site, EU-focused → CookieYes or Cookiebot — strong plugins, generous-ish free tiers, easy setup. iubenda if lawyer-drafted EU policies matter most.
- You want consent + legal policies bundled → Termly keeps the entry price low and packages policy generation.
- You want a compliance guarantee → Osano's "$500k no-fines" guarantee is a differentiator, at a higher ($199/mo) price.
- You're an agency or run several sites → a flat/bundled plan beats per-domain math. Compare ConsentPixel's agency plans against Complianz's unlimited-WordPress plan.
- You serve US traffic and run session-replay → prioritize a tool that blocks trackers before consent and addresses CIPA — that requirement should drive the decision more than price.
For feature-level switching decisions from a specific tool, our Cookiebot alternatives and Termly alternatives guides go deeper than pricing alone.
Where ConsentPixel fits
Full disclosure: ConsentPixel is our product, so weigh this section accordingly — we've tried to be objective, including about where other tools win. ConsentPixel — Privacy · Verified is priced as a self-serve CMP: Starter $8.99/domain/month, Growth $29.99/month (3 domains), Agency Lite $99.99/month (10 domains, white-label + client portal), and Agency Pro $199.99/month (25 domains). There's a 14-day free trial with no credit card.
Where it's designed to be different isn't the price — it's the prevention-first, CIPA-first posture. From a single pixel, it blocks third-party trackers (including session-replay) at the browser level until the right consent or opt-out state, honors the Global Privacy Control signal, logs each decision as evidence, and covers GDPR and US state laws alongside CIPA. In other words, it's built to close the exact gap the "cost every pricing page ignores" section is about — the trackers firing before consent that create US litigation exposure. It's a product comparison, not legal advice, and not a substitute for counsel on your obligations.
If your only pain is cost across many domains, several tools here solve that. If your pain is cost and US litigation exposure from trackers firing before consent, that dual coverage is the specific thing to evaluate.
Key takeaways
- OneTrust cookie consent pricing is quote-gated — ~$10,500–$11,800 median annual spend, a ~$10K/yr minimum floor from Q2 2026, and implementation fees on top. Great for enterprises; overkill for a banner.
- Self-serve CMPs cover the core job for $0–$30/month — Cookiebot, CookieYes, Usercentrics, Termly, iubenda, Osano, and ConsentPixel among them.
- The billing model matters more than the sticker price: per-domain multiplies, traffic-metered spikes, flat/bundled stays predictable. Above 2–3 sites, flat usually wins.
- The largest cost isn't on any invoice — a cheap banner that fires session-replay before consent can invite a CIPA demand letter ($5,000/violation via §637.2).
- Ask "does it block before consent?" not just "what does it cost?" — most mainstream tools have no explicit CIPA posture.
The bottom line
OneTrust's pricing pushed a lot of small and mid-size buyers to look elsewhere in 2026 — and for a site that just needs a compliant, tracker-blocking banner, elsewhere is usually the right call. The self-serve field covers that job from free to around $30/month, and above a couple of domains the pricing model should drive your choice more than the headline rate.
But don't let the cheapest number win by default. The tool that leaves session-replay firing before consent isn't a bargain — it's the one most likely to cost you five figures in a demand letter. Compare on price and on whether the banner actually blocks what creates the risk.
The fastest way to see where you stand is to look at what's firing on your own site today.
See what fires before consent — in ~10 seconds
Before you pay for any CMP, scan your site free to see every tracker that loads before consent — and whether any keep running after "Reject." Then close the gap with a single prevention-first pixel that blocks trackers, honors GPC, and covers CIPA, CCPA, and GDPR.
Scan your site free →ConsentPixel — Privacy · Verified helps website owners and agencies reduce exposure to CIPA, CCPA, GDPR, and US state privacy laws from a single pixel — blocking trackers until the right consent state, honoring opt-out and GPC signals, and logging each decision as evidence. This article is a product comparison for general information, not legal advice, and does not endorse any specific tool for your situation. Pricing was verified in August 2026 and changes frequently; confirm current rates with each vendor. ConsentPixel is included in this comparison and is not a law firm.
Frequently asked questions
How much does OneTrust cookie consent cost?
OneTrust does not publish cookie consent pricing — every quote is custom and requires a sales call. Based on third-party procurement data (Vendr, Spendflo), the median buyer pays roughly $10,500 to $11,800 per year, with a reported minimum annual commitment of about $10,000 as of Q2 2026 and implementation fees of $10,000 to $50,000 on top. Historically the Consent & Preference module was listed around $827 to $1,100+ per month for a single domain, but OneTrust retired its self-serve tier and shifted to traffic-based metering, with some renewing customers reporting increases up to 500%. Figures are estimates verified in August 2026 and may change.
Why is OneTrust so expensive for just a cookie banner?
Because cookie consent is one module inside a broad enterprise privacy-governance suite that also covers data mapping, DSAR automation, vendor risk, and AI governance. When you buy the banner, you're buying into that platform's pricing model even if you never use the other modules. Combined with a reported ~$10,000 annual minimum, the retirement of the self-serve tier, implementation fees, and 5–10% annual escalators, the total cost is far above what a standalone banner needs. For large regulated enterprises the breadth justifies it; for a small or mid-size site that only needs a compliant banner, lighter self-serve tools cover the same core job for a fraction of the price.
What are the cheapest OneTrust alternatives for cookie consent?
For self-serve cookie consent, the lowest entry prices in 2026 come from iubenda (from about €4.99/month), Cookiebot (from around €7/month per domain), Usercentrics Web CMP (from about €7/month, session-metered), CookieYes ($10/month Basic), Termly (about $10–$14/month), and ConsentPixel ($8.99/domain/month, with flat agency bundles). Several also offer free tiers capped at low traffic on one domain. The cheapest option depends on how many domains you run and your traffic — per-domain tools get expensive across multiple sites, while flat/bundled plans stay predictable. This is a product comparison, not an endorsement; verify current pricing with each vendor.
What's the difference between per-domain and traffic-based CMP pricing?
Per-domain pricing charges per website (sometimes banded by subpages or pageviews) — cheap for one site but it multiplies fast across a portfolio, and some tools count each subdomain separately. Traffic-based (or session/pageview/visitor) metering charges by how much traffic you have — predictable on a steady single site, but a viral post or ad campaign can push you past your cap mid-cycle into overage charges or a forced upgrade. A third model, flat or bundled pricing, includes a set number of domains for a fixed price and stays predictable regardless of traffic. Above two or three sites, the billing model usually affects your total cost more than the headline entry price.
Is a free cookie consent tool enough to be compliant?
Sometimes, for a very small, low-traffic single site. Most CMPs — CookieYes, Cookiebot, Usercentrics, Termly, iubenda, Osano and others — offer a genuinely free tier, but they typically cap traffic tightly (often 1,000–10,000 monthly pageviews, sessions, or visitors), gate features like IAB TCF support and branding removal, and cover only basic scenarios. More importantly, "has a banner" isn't the same as "blocks trackers before consent." A free tool that still fires session-replay or pixels on page load can leave you exposed to US litigation under CIPA regardless of price. Check that the banner technically blocks non-essential trackers before consent, not just that it displays a notice.
Does a cheaper CMP mean more legal risk?
Not because it's cheaper, but because many low-cost tools are tuned only for a basic opt-in or opt-out banner and still let session-replay tools and pixels load before consent. In the US, that's the exact fact pattern behind the wave of California Invasion of Privacy Act (CIPA) lawsuits, which carry statutory damages of $5,000 per violation under Penal Code §637.2 and can be brought by any affected individual. So the real cost of a CMP isn't just its monthly fee — it's whether the banner actually blocks the trackers that create exposure. A tool that leaves that gap can be far more expensive than its price tag suggests. This is general information, not legal advice.
How much should a small business budget for a CMP?
For a single low-traffic site, a free tier or a $5–$10/month plan is usually enough. A small business running up to five sites should budget roughly $15–$60/month, or look at a flat multi-domain bundle to avoid per-domain costs stacking up. Agencies managing many client sites and enterprises negotiating custom contracts sit well above both. Factor in the billing model (per-domain multiplies, traffic-metered can spike), any implementation time, and — most importantly — whether the tool blocks trackers before consent, since a compliance gap carries a cost no subscription tier reflects. Verify current pricing with each vendor before committing.