Osano vs OneTrust
For a firm that runs OneTrust, or holds a OneTrust quote, with one to a few people doing the privacy work. The two products, measured on the consent, request and vendor duties of the GDPR, the ePrivacy Directive and the California rules, from each vendor’s own pages. read 2026-10-22
Best for a privacy team of one to five
Osano
Its own pages cover consent, requests, vendor risk, records and assessments in one account, and its consent plans start free.
Best when vendor reviews go beyond privacy
OneTrust
Its Third-Party Management Suite adds ethics, sanctions and watchlist screening; Osano rates itself partial on risk beyond privacy.
Best for consent on TV apps as well as the web
OneTrust
One consent platform for websites, mobile apps and connected TV; Osano's pages name web and mobile SDKs, not TV.
The requirements, side by side
Each row is a duty from the rule cited under it. The first three are consent, the next four are privacy requests, the next three are vendors, and the last three are the records behind the program. OneTrust publishes no free plan, so every OneTrust cell is part of a quote; where only some packages carry a row, the note names them. On Osano, “paid plan” means the row starts above the free consent plan.
| Requirement | Osano | OneTrust |
|---|---|---|
| Blocks non-essential cookies until consentePrivacy Art. 5(3) | yes | yesCMP packages |
| Keeps a record of each consent you can exportGDPR Art. 7(1) | yesbanner version and device | yesConsent Receipt |
| Honors Global Privacy Control signalsCCPA regs § 7025(b) | yes | yes |
| Takes access and deletion requests through your websiteGDPR Art. 12(2); Civ. Code § 1798.130(a)(1) | paid planfrom Basic Privacy | yesCMP Suite or Privacy Automation Suite |
| Verifies the requester’s identityGDPR Art. 12(6); CCPA regs § 7060(a) | paid planmulti-factor; subject rights | yes |
| Tracks the response deadlineGDPR Art. 12(3); CCPA regs § 7021(b) | paid plansubject rights module | not stated“regulatory-aware” workflows |
| Keeps a log of each request and your answerCCPA regs § 7101(a)–(b) | paid planaudit trail, CSV export | not stated |
| Assesses vendors before they get your dataGDPR Art. 28(1) | paid planvendor risk module | yes |
| Keeps each vendor’s processing contract (DPA)GDPR Art. 28(3) | paid planon the vendor record | yes |
| Shows a vendor’s own sub-processorsGDPR Art. 28(2) | paid planvendor risk module | not stated |
| Keeps a record of processing (data map)GDPR Art. 30(1) | paid plandata mapping module | yes |
| Runs impact and risk assessmentsGDPR Art. 35(1); CCPA regs § 7150 | paid planassessments module | yes |
| Logs a breach and its notice clockGDPR Art. 33(1), 33(5) | not stated | yesPrivacy Automation Suite |
Source: vendor documentation, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | ||
The table splits on three rows. Osano names a deadline tracker, a request log and sub-processor visibility; OneTrust’s pages do not. OneTrust names incident handling; Osano’s do not, so an Osano firm keeps its Art. 33(5) breach register in a document of its own. Those three rows are the ones to put to both vendors in writing before you compare quotes.
The same jobs, packaged two ways
Osano publishes its self-serve consent plans with their limits; OneTrust publishes package names and the meter each runs on, and every package ends in “Get Pricing”. We show neither vendor’s figures. What decides your quote is which row below you actually need, and how big your number is on its meter.
| The job | Osano sells it as | OneTrust sells it as |
|---|---|---|
| A cookie banner | Free or Plus plan, capped by users, domains and monthly visitors | CMP Base |
| The banner plus a request form | Basic Privacy, a custom plan with basic request workflows | CMP Suite |
| Marketing preferences across systems | Unified Consent & Preference Hub module | Universal Consent & Preference Management |
| Data map, assessments and vendor privacy risk | Data Mapping, Assessments and Vendor Risk modules, by consultation | Privacy Automation Base |
| Requests end to end, plus incidents | Subject Rights module; no incident module named | Privacy Automation Suite |
| Vendor risk beyond privacy (ethics, sanctions) | Partial, by Osano's own rating; no ethics screening named | Third-Party Management Suite; the Base package stops at vendor risk |
Source: osano.com/plans, osano.com/plans/cookie-consent and onetrust.com/pricing, read 2026-10-22. No prices are shown on this site. | ||
| Plan or package | Priced on | Where it says so |
|---|---|---|
| Osano consent plans | users, domains and monthly visitors | osano.com/plans/cookie-consent |
| Osano subject rights | volume, deployment scale and add-on modules | osano.com/products/subject-rights |
| OneTrust CMP Base and Suite | average daily visitors, across all channels and properties | onetrust.com/pricing |
| OneTrust Privacy Automation | users and privacy asset inventory | onetrust.com/pricing |
| OneTrust third-party risk | admin users and third-party inventory | onetrust.com/pricing |
Source: each vendor’s own page, read 2026-10-22. | ||
OneTrust counts average daily visitors across every channel; Osano’s consent plans cap monthly visitors per plan. Divide your monthly figure by the days in the month before you compare: Osano’s 30,000 monthly visitors on Plus is roughly 1,000 a day. Count your apps and TV properties too, because OneTrust’s meter adds them in.
If the first two rows are all you use, the choice is wider than these two: our consent management platforms page compares banners on the same consent rows.
Sizing down: what to carry out of OneTrust first
A firm that leaves OneTrust for Osano changes tools; its duties stay where they were. Several records the law requires you to keep may live only inside OneTrust today. Export each one, open it on your own machine to confirm it is complete, and only then set an end date.
| Record | Rule | How long | What to export |
|---|---|---|---|
| Consent records | GDPR Art. 7(1) | while you rely on the consent | The full consent log export, with timestamps and the banner version each visitor saw |
| Request log | CCPA regs § 7101(a)–(b) | at least 24 months | Each request's date, type, how it came in, date answered, the answer, and the reason for any denial |
| Risk assessments | CCPA regs § 7155(c) | while the processing runs, or five years after completion, whichever is later | Every version, original and updated, not only the latest |
| Record of processing | GDPR Art. 30(1) | kept current, no end date | The RoPA with every Art. 30(1) field, in a spreadsheet you can edit |
| Breach register | GDPR Art. 33(5) | no period set in the article | Each incident's facts, effects and remedial action, including the ones you did not report |
| Vendor files | GDPR Art. 28(1), 28(3) | while the vendor processes for you | Each vendor's assessment answers, risk notes and signed processing contract |
Source: GDPR and the CCPA regulations as in force on 2026-10-22. The periods are the rules’ own; your counsel may set longer ones. | |||
OneTrust’s privacy service processes your visitors’ and customers’ data for you, so the processing contract decides what happens to it when you leave.
“at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing”
The choice is yours, and it is made once. Put it in writing before the end date: return of every record in the table above in a named format, then deletion, with written confirmation. If you only ask for deletion and the request log lives only there, the 24 months of records you must keep go with it. Our processing agreement template has the clause for the new vendor’s contract.
Osano’s migration page says it moves cookie consent in 2 to 10 days, subject rights in 3 to 5 and a data map in 3 to 7, and suggests a firm still under contract can use Osano free while it waits the contract out, without saying on what terms. Those are the vendor’s own claims: get the timeline and any free period in the order form. Switch the banner one domain at a time, never with both banners live on the same page.
Six settings that are yours on either platform
Both products can be set up to meet every row below, and both can be set up to miss them. The vendor ships the switch; the business that runs the site is the one the regulator writes to. Check these on the first day, and again after every banner or form change.
| Setting | Rule | What to set |
|---|---|---|
| Reject is as easy as accept | CCPA regs § 7004(a)(2); GDPR Art. 7(3) | A reject or decline button on the first layer, as prominent as accept, and a link back to change the choice later |
| Opt-outs skip identity checks | CCPA regs §§ 7026(d), 7027(e) | Verification off for opt-out and limit requests; on for access, deletion and correction requests |
| GPC counts as an opt-out | CCPA regs § 7025(b) | Signal support on, for every US region where you sell or share |
| Opt-outs reach your vendors in time | CCPA regs § 7026(f)(1) | Connected systems updated within 15 business days |
| The California request clock | CCPA regs § 7021(a)–(b) | Receipt confirmed within 10 business days; answer due in 45 calendar days, extendable once by 45 with notice |
| The GDPR request clock | GDPR Art. 12(3) | One month from receipt, extendable by two further months, with the extension notice sent inside the first month |
Source: CCPA regulations effective 2026-01-01 and GDPR, read 2026-10-22. | ||
In March 2025 the California Privacy Protection Agency fined American Honda $632,500. Its Enforcement Division alleged that Honda made people verify themselves and hand over excessive personal information to opt out, and used “an online privacy management tool that failed to offer Californians their privacy choices in a symmetrical or equal way.” The agency’s announcement names no software vendor: the allegations are about how Honda set up and ran its process.
Two tests take five minutes. Turn on Global Privacy Control in your browser, load your site and confirm the banner records an opt-out; our GPC checker tells you whether the signal is being sent. Then file a test request and put its arrival date into the DSAR deadline calculator to see whether the platform’s due date matches the rule.
Each platform in short
What each one is, who it fits, how it meets the rows, and what to confirm before you sign. Osano’s own comparison page makes claims about OneTrust’s set-up time, renewals and scanning; we used only what each vendor says about itself.
Osano
What it is
A privacy platform that does only privacy: cookie consent, subject rights, vendor risk, data mapping, assessments and a consent and preference hub, in one account. Consent comes in self-serve plans that start with a free plan for one domain and 5,000 monthly visitors; the other modules are sold after a consultation.
Who it fits
A firm where privacy is one person’s job, or part of it. Osano’s own comparison page says it is built for privacy teams of one to five people.
What the rule requires and whether it meets it
Its feature list covers every consent, request, vendor and record row, though only consent is on the self-serve plans: blocking, consent logs with the banner version, GPC, multi-factor identity checks, automatic deadline calculation, an audit trail with CSV export, vendor risk scores with sub-processor visibility, Article 30 records and DPIA templates. Its tracker discovery runs on scheduled scans, and its comparison page adds that its script catches trackers on real page loads.
Check with the vendor
Its pages name no breach or incident log, so keep the Art. 33(5) record elsewhere. Its own DSAR FAQ calls the GDPR clock “30 calendar days”; the rule says one month, so check what the deadline setting counts. Read the terms behind the advertised fines guarantee before you rely on it.
OneTrust
What it is
A trust and risk platform in which privacy is one part. It sells solution packages: two consent packages, a preference package, Privacy Automation Base and Suite, third-party risk, tech risk and AI governance. Every package ends in a quote.
Who it fits
A firm with a privacy team, or a firm whose vendor reviews also have to cover ethics, sanctions and security, not only privacy. Also a firm that needs consent on connected TV apps as well as its websites and mobile apps.
What the rule requires and whether it meets it
Its pages say yes on blocking, consent receipts with a timestamp and exportable logs, GPC, request intake with ID verification and redaction, vendor assessments and DPAs, an automatically generated RoPA, PIAs and DPIAs, and incident handling with notification guidance per jurisdiction. Its scanner runs on a schedule you set and can scan behind logins.
Check with the vendor
Its pages do not name a request deadline tracker or a request log; ask to see both in a demo, with a test request. Ask which package carries each row: request intake sits in CMP Suite and Privacy Automation Suite, incidents in the Suite only.
How we compared them
This is a head-to-head of the two names in the search: a firm on OneTrust asking whether Osano covers what it actually uses. Each is described from its own plan, packaging and product pages. Other platforms are measured on the same duties on our OneTrust alternatives page, and request-only tools on our DSAR tools page.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-22; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
Is Osano cheaper than OneTrust?
We do not publish prices, and the answer depends on your meter. Osano caps its self-serve consent plans by users, domains and monthly visitors; OneTrust prices consent on average daily visitors across all channels and privacy automation on users and asset inventory. Get both quotes for the same rows of the table above, in writing, with the renewal terms.
Does Osano have a free plan? Does OneTrust?
Osano’s plan page lists a free consent plan for one user, one domain and 5,000 monthly visitors, and its pages offer a free 30-day trial of the paid tools. OneTrust’s pricing and packaging page lists no free plan: every package leads to a quote.
Can I keep my old consent records when I switch?
You must be able to show that each visitor consented (GDPR Art. 7(1)), so export OneTrust’s consent log before you switch the banner off. Whether the new tool can import it, and whether visitors must then be asked again, is a question to put to Osano in writing before you switch.
Does Osano's fines guarantee mean I am covered?
Osano’s plan page offers it on the Basic Privacy plan, for a fine or penalty issued by a regulatory agency “as a result of our platform”, up to a stated cap and per its Terms of Service. A fine for how you set up or use the tool is a different thing. Read the terms before you rely on it; it is not a substitute for the settings on this page.
We have no office in the EU. Can either vendor act as our representative?
Osano’s plan page offers to serve as your GDPR and UK representative under Art. 27; OneTrust’s packaging page lists no such service. If you are not sure you need one, start with whether the GDPR applies to a US company.
What are the alternatives to Osano?
For consent alone, our consent management platforms page measures several banners, Osano among them, on the same rows. For a whole program, see privacy management software.