What Is OneTrust? Features and Pricing (2026)

OneTrust is software for managing data privacy, customer consent, and compliance risks. Their tools record marketing preferences, respond to privacy requests, and assess how personal data is used.

Gartner associates problems with consent, privacy notices, and data-rights requests with most privacy fines and violations in the US. It estimates that US privacy-related fines reached $3.43 billion in 2025, up about 87% from 2024.

Learn how OneTrust’s six solution areas work, which privacy and compliance tasks they automate, and what to consider when deciding whether the platform fits your business.

What is OneTrust?

OneTrust is an Atlanta-based software company that provides tools for managing data, privacy, and technology risks. Founded in 2016, the company appointed John Heyman as CEO in February 2026. Founder Kabir Barday continues to serve on OneTrust’s board.

OneTrust organizes their platform into six solution areas:

• AI Governance. Maintains an inventory of AI systems and manages risk assessments, approvals, and monitoring from development through use.
• Consent & Preferences. Records cookie consent and marketing preferences, then shares those choices with integrated business systems.
• Data Use Governance. Applies data policies through automated controls in data and AI systems. This solution is in early access.
• Privacy Automation. Maps customer data and automates privacy tasks, including responding to requests to access or delete that data.
• Tech Risk & Compliance. Tracks technology risks and organizes compliance evidence, policies, and controls for audits.
• Third-Party Management. Assesses vendors’ security, privacy, and compliance risks, then tracks issues and corrective actions.

Key OneTrust features

You can choose the tools that meet your most urgent needs, such as consent management or vendor assessments, and add others as your operations grow.

Consent and preferences

Depending on the privacy laws that apply to your business and customers, you may need to record their choices about marketing messages and website tracking.

In the second quarter of 2025, 48% of US online users reported declining cookies on websites at least some of the time. OneTrust’s consent banners and preference centers collect and record these choices, then share updates with connected systems.

According to OneTrust, the cookie consent tools scan your website and draw on a database of more than 45 million categorized cookies to group trackers by purpose. You can customize banners by region, schedule repeat scans, and configure trackers to run only after visitors give the required consent.

OneTrust’s Google Consent Mode v2 integration passes visitors’ choices to Google tags. Google Ads and Google Analytics then adjust cookie storage and data use according to those choices and your configuration to help estimate activity that consent choices keep advertisers from measuring directly.

For Shopify stores, the OneTrust consent management platform integration connects OneTrust consent categories to Shopify’s Customer Privacy API. This allows Shopify to apply tracking choices collected through the OneTrust banner. Adding OneTrust’s banner to checkout requires the Shopify Plus plan.

During setup, open Settings > Customer privacy in Shopify and select the same consent regions configured in OneTrust. Follow Shopify’s third-party cookie banner instructions to coordinate the two systems. Configure email and SMS marketing preferences separately through the relevant marketing settings.

Third-party management

OneTrust’s third-party management tools keep vendor assessments, risk ratings, and supporting documents in one place. Integrations with SecurityScorecard, RiskRecon, and HackNotice add cybersecurity ratings that help evaluate vendors and monitor changes in risk.

For example, a handmade jewelry shop could collect security documentation from their email marketing provider, record issues raised during their review, and assign follow-up tasks.

OneTrust organizes the evidence and tracks those tasks. Your team can then evaluate the findings, then request corrective action or accept the remaining risk.

AI governance

OneTrust’s AI governance tools maintain an inventory of AI systems and track their owners, risk assessments, and approvals. Organizations can review AI projects before launch and monitor risks as those systems operate.

If you’re building a chatbot to answer store FAQs, you could document the data it uses, assign someone to review privacy risks, and record the checks completed before launch. That gives you a record of who approved the project and how the team addressed risks they found.

Staff training and review time also belong in your implementation budget. According to survey findings cited in Stanford’s 2026 AI Index Report, respondents named knowledge and training gaps (59%), resource or budget constraints (48%), and regulatory uncertainty (41%) as obstacles to implementing responsible AI.

If you adopt OneTrust’s AI governance tools, decide who will manage assessments and approvals, and plan staff time for training.

Privacy automation

OneTrust’s privacy automation tools automate the steps of data-rights requests, from intake and identity verification through data retrieval, deletion, and secure responses. The platform also maps personal data and organizes privacy assessments and incident records.

For example, an online cooking school could configure a workflow to verify a student’s identity, retrieve their information from integrated systems, and send a secure response to an access request. Staff can track the request’s progress and review cases that require individual attention.

Tech risk and compliance

Tech Risk & Compliance is OneTrust’s governance, risk, and compliance (GRC) offering. It brings policy management, risk assessments, and audit preparation into one system. Teams can assign evidence-collection tasks and prioritize security issues based on risk.

An ecommerce business evaluating a new inventory app could document its security assessment, assign fixes to the appropriate team members, and track their completion before launch. The resulting record shows what the team checked, which issues it found, and how it resolved them.

Data use governance

OneTrust’s Data Use Governance applies data-use policies through controls in connected cloud data platforms such as Snowflake and Databricks. These controls can hide selected data fields or limit rows according to your policies. OneTrust also helps teams verify where those controls are applied.

For example, a retailer could make purchase data available for analysis while hiding customer email addresses. Their analysts could study shopping patterns while the configured controls restrict access to identifying information.

OneTrust lists this solution as available through early access.

How much does OneTrust cost?

OneTrust uses custom quotes, and Vendr reports a median annual contract of $12,300.

OneTrust’s pricing structure varies by product. Cookie consent pricing depends on average daily visitors across your websites and apps. Third-party management pricing depends on the number of administrator users and the size of your vendor list.

Request a quote on OneTrust’s pricing page for the products and usage levels your business needs. Confirm the implementation services, ongoing support, and renewal terms included in the proposal.

Pros and cons of using OneTrust

OneTrust’s strengths:

• Platform breadth. Privacy, consent, vendor risk, and AI governance tools share one platform.
• Pre-built integrations. Consent updates can flow to connected tools such as Salesforce Marketing Cloud and HubSpot, listed on their Integrations page.
• Automated privacy workflows. Identity verification, data retrieval, and deletion requests run through automated workflows..
• Analyst recognition. International Data Corporation (IDC) named OneTrust a Leader among 16 vendors in their 2025 data privacy compliance software assessment.

Tradeoffs to weigh:

• Quote-based pricing: Comparing costs requires a proposal tailored to your products and usage.
• Configuration effort: Setup involves connecting systems, mapping consent categories, and testing workflows. Vendr says implementation services are often quoted separately.
• Training time: Staff need time to learn the products and workflows you select.
• Limited value for basic needs: A small store that only needs a cookie banner and data-request processing can use Shopify’s built-in privacy settings instead.

Is OneTrust right for your business?

OneTrust may be a good fit for businesses that run privacy, vendor-risk, or AI-governance programs involving several people and systems. Smaller Shopify stores with straightforward privacy may find that Shopify’s built-in privacy settings meet their requirements.

Smaller Shopify stores can use built-in customer privacy settings under Settings > Customer privacy in the Shopify admin to add a cookie banner, privacy policy, and data-sharing opt-out page.

You can also process customer data requests in your Shopify admin: open a customer’s profile, click More actions, then choose Request customer data or Erase personal data. Shopify erases the customer’s personal data from your store and installed apps, but you’re responsible for contacting any other companies you’ve shared it with.