Preference management platforms
For a firm whose customers pick topics, channels and how often they hear from you, beyond the cookie banner. 6 preference management platforms, measured against what the GDPR and the California opt-out rules ask of one person’s record of choices, from each vendor’s own documentation. read 2026-10-22
Best when customers sign in
Transcend
The only one whose own pages say how a device opt-out and an account record are reconciled, by a rule you set.
Best for a small firm starting out
Ketch
A preference center and consent records on every plan, the free one included; marketing topics come later.
Best when choices change by phone
Syrenis
Its agent portal updates the same record a web form does, with an audit trail of every change.
The requirements, platform by platform
Each row is something the rules ask of a preference record, with the article or section it comes from. Read across for one requirement; read down for one platform. If the same firm also answers access and deletion requests, the opt-out side overlaps with our OneTrust alternatives page, which covers the wider suites.
| Requirement | Transcend | OneTrust | Ketch | Didomi | Syrenis | TrustArc |
|---|---|---|---|---|---|---|
| Lets a person choose purpose by purpose and channel by channelGDPR Art. 6(1)(a); Recital 32 | yespurposes + preference topics | yespurposes, topics, preferences | paid planmarketing preferences on Pro | yes | yes | yes |
| Keeps a dated record of each choiceGDPR Art. 7(1) | yestimestamp + audit trail | yesconsent receipts | yesevery plan | yesevents with proofs | yesaudit trail of changes | yesincludes form version |
| Lets the person change or withdraw a choice themselvesGDPR Art. 7(3) | yesmarketing choices after sign-in | yesemail access code | yesevery plan | yescode or magic-link sign-in | yes | yesmagic links |
| Offers one “unsubscribe from all” choiceGDPR Art. 21(3); CCPA regs § 7026(h) | not stated | yes | yes | not stated | not stated | not statedunsubscribe links in email |
| Sends each change to the systems that use the dataGDPR Art. 21(3); CCPA regs § 7026(f) | yesconsent workflows | yes | yes2 integrations below Pro | yeswebhooks + connectors | yesreal time | yestiming varies by connector |
| Applies a browser opt-out signal to the known personCCPA regs § 7025(c)(1) | yesdevice-vs-account rule you set | not stated | partialGPC read; profile link not spelled out | partialbrowser level only stated | not stated | partialGPC supported; profile not stated |
| Takes choices made by phone or in personCCPA regs § 7026(a)(2)–(3) | yescall-centre staff, API | yesAPI and bulk import | yesthrough its APIs | yesbatch import keeps the date | yesagent portal | not stated |
| Offers a data processing agreementGDPR Art. 28(3) | yes | yes | yes | yes | not stated | yes |
Source: vendor documentation, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | ||||||
What the rules ask of a preference record
A cookie banner decides what runs on one visit. A preference record is about a person: what they agreed to hear about, on which channel, and what they took back. The rules test it in three places.
1. Taking a choice back has to be as easy as giving it
“The data subject shall have the right to withdraw his or her consent at any time. … It shall be as easy to withdraw as to give consent.”
If a newsletter box took one click to tick, a preference center that asks for an account, a password and a code to untick it is hard to defend. California says the same for its opt-out: a business may not make a person create an account to stop the sale or sharing of their data (regs § 7026(c)). Sign-in by magic link or one-time code is common in the table above; check how many steps it adds before you switch it on.
2. An objection reaches every system, not just the form
“Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.”
“No longer processed” means the email tool, the CRM and the ad audience, not only the preference page. California spells out the chain: after an opt-out of sale or sharing, the business tells every third party it sold or shared the data with in the meantime to stop, and to pass the request on (regs § 7026(f)(2)). That is why the sync row matters more than the look of the preference center. If a firm also answers access and deletion requests, our DSAR software comparison covers the tools that route those.
3. A browser signal can bind a known person
“If known, the business shall also treat the opt-out preference signal as a valid request to opt-out of sale/sharing for the consumer.”
A banner can honor Global Privacy Control for one browser. When the visitor is signed in, the regulation asks for more: the opt-out applies to the person, and a later visit from a device without the signal does not count as opting back in (§ 7025(c)(5)). Our GPC checker shows whether your own browser is sending the signal, and the guide to the “Do Not Sell or Share” link covers the link-side route.
If EU and California choices land in the same CRM field, one can overwrite the other. One vendor’s own documentation warns that a CPRA event can silently overwrite GDPR consent for the same contact. Map each law’s choice to its own field before you switch on a sync, whichever platform you pick. Our GDPR and CCPA side-by-side explains why the two are different choices: opt-in against opt-out.
The clocks a preference record has to keep
Every row in the comparison ends in a deadline somewhere. A platform that stores a choice but passes it on in a weekly batch can miss the shortest of these; the California regulation’s own example is a marketing firm whose Friday upload went out before its systems caught up with an opt-out. Read across for the rule; the last column links the text.
| The choice | What the rule asks | How fast | Rule |
|---|---|---|---|
| Email unsubscribe (US) | Honor the opt-out; the unsubscribe route keeps working for at least 30 days after the message is sent | 10 business days | CAN-SPAM, FTC guide |
| Opt-out of sale or sharing (California) | Stop selling or sharing, and tell third parties who got the data in the meantime | As soon as feasibly possible, no later than 15 business days | regs § 7026(f) |
| Asking again after that opt-out | Wait before asking the person to consent to sale or sharing again | At least 12 months | regs § 7026(k) |
| Objection to direct marketing (EU) | The data is no longer processed for that marketing | No grace period in the text | GDPR Art. 21(3) |
| Withdrawing consent (EU) | Withdrawing is as easy as giving was | At any time | GDPR Art. 7(3) |
| Marketing email to existing customers (EU) | A free, easy chance to object, at collection and in every message | Every message | ePrivacy Art. 13(2) |
Source: the rule texts and the FTC’s CAN-SPAM guide, read 2026-10-22. Information, not legal advice. | |||
The 15 business days is a ceiling, not a target: the California regulation’s own example says a business that can stop at once must stop at once. Response times for access and deletion requests run on different clocks; our DSAR deadline calculator counts those.
Each platform in short
What each one is, who it fits, how it meets the rows, and what to confirm with the vendor before you sign. Whichever you choose, the processing terms should cover what our DPA template lists.
Transcend
What it is
A consent and preference platform that pushes each choice into the systems behind it: purposes that are on or off, with preference topics (frequency, content type) under each.
Who it fits
A firm whose customers sign in, so a choice made on one device has to follow them to another.
What the rule requires and whether it meets it
It is the one platform here whose own pages describe the conflict California cares about. When an anonymous choice and an account record disagree, it applies the rule you set: most recent wins, most restrictive wins, or the account record governs. Its docs name call-centre staff as a source of choices, and consent workflows send each change downstream.
Check with the vendor
In its Privacy Center, marketing choices are for signed-in users; anonymous visitors get the Do Not Sell opt-out. Plan how someone who only gets your emails reaches their choices. The pages we read do not describe a single “unsubscribe from all”.
OneTrust
What it is
The preference product of the OneTrust suite: purposes, topics and purpose preferences, recorded as consent receipts per collection point.
Who it fits
A firm already on OneTrust for its banner or requests, or one that needs pre-built syncs into Salesforce, Marketo, Snowflake or Adobe.
What the rule requires and whether it meets it
Receipts carry the date of each interaction, a preference center can carry an “Unsubscribe All” button that withdraws every purpose at once, and choices taken elsewhere arrive through the receipts API or a bulk import. Its processing addendum is part of its master terms.
Check with the vendor
Its preference center can ask for a one-time code sent by email before it shows anything; weigh that step against “as easy to withdraw as to give”. The pages we read do not say how a GPC signal reaches a person’s preference record.
Ketch
What it is
A privacy platform with a self-serve free plan. Every plan includes a privacy preference center and consent record storage.
Who it fits
A small firm that wants to start with privacy choices now and add marketing topics later.
What the rule requires and whether it meets it
It keeps a timestamped log of every preference change, offers a global unsubscribe, and processes GPC automatically. Its Opt-Out Sync links the banner, the web form and the preference center, so a choice made in one reaches the others.
Check with the vendor
Topic, channel and cadence choices (its Marketing Preference Management) are listed on the Pro plan only, and plans below Pro include two data-system integrations. Ask whether a GPC signal from a signed-in visitor lands on their profile.
Didomi
What it is
A consent and preference platform: preference centers, embedded forms and single-question widgets that write consent events, with proofs attached, to one store.
Who it fits
An EU-heavy firm that wants to ask one question at a time and send the answers to HubSpot, Mailchimp or Braze.
What the rule requires and whether it meets it
Preferences sit under purposes and can be split by channel. Batch import keeps the original collection date, so choices taken on paper or by phone can be loaded later. Its terms reference a data processing agreement.
Check with the vendor
Its webhooks send GDPR events by default; other laws’ events are switched on by request, and its own docs warn that a CPRA event can overwrite GDPR consent if both map to one field. Its Consents API is sold separately from the preference product.
Syrenis
What it is
A consent and preference platform built around one record per customer, with a self-service preference center and a portal for staff.
Who it fits
A firm where preferences change on the phone or in a service conversation: its agent portal updates the same record a web form does.
What the rule requires and whether it meets it
Topic, channel and frequency choices, an audit trail of every change, and real-time updates across connected systems. Its identity consent links choices to known people, not only to a browser.
Check with the vendor
The pages we read do not mention Global Privacy Control, a single unsubscribe-from-all, or a data processing agreement. Ask for all three in writing.
TrustArc
What it is
A consent and preference manager sold beside TrustArc’s cookie banner, with 300+ connectors.
Who it fits
A firm running several brands or languages that wants forms, magic links and reports from one place.
What the rule requires and whether it meets it
Purpose- and channel-level choices, consent history with the form version each person saw, and magic links so a person reaches their own choices without re-typing details. Its processing addendum is published.
Check with the vendor
Its own pages say timing and field mapping vary by connector, so test that each destination actually applies a change. Choices by phone or in person and a single unsubscribe-from-all are not described.
How we compared them
We started from platforms that sell preference management as a product of its own, separate from a cookie banner: each keeps choices per person, offers a preference center and sends changes to other systems. Banner-only tools are compared on our consent management platforms page instead.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-22; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
How is a preference management platform different from a consent management platform?
A consent management platform runs the cookie banner: what loads on this visit in this browser. A preference platform keeps a record per person (topics, channels, how often, and what they withdrew) and sends it to the email tool and the CRM. Many firms need both. Banners are compared on our consent management platforms page.
Does the GDPR require a preference center?
No. It requires that withdrawing consent be as easy as giving it (Art. 7(3)) and that an objection to direct marketing stops that marketing (Art. 21(3)). A preference center is one way to meet both; an honest unsubscribe link that works is another. No tool makes a firm compliant on its own.
Can I make people sign in before they change their preferences?
Be careful. Under the GDPR, withdrawing must be as easy as giving. Under the California regulations, a business may not require a person to create an account to opt out of sale or sharing (§ 7026(c)). A magic link in the email footer, which opens the person’s own choices without a password, is the common middle path.
How fast does an unsubscribe have to take effect?
For US marketing email, the FTC says within 10 business days. For a California opt-out of sale or sharing, as soon as feasibly possible and no later than 15 business days. For an EU objection to direct marketing, the data is no longer processed for it, with no grace period in the text. The table above sets these side by side.
After someone opts out, when can I ask them again?
For California’s opt-out of sale or sharing, the regulations say to wait at least 12 months from the request before asking the person to consent again (§ 7026(k)). The platform has to remember the date of the opt-out, not just that it happened, which is one more reason the dated record matters.