OneTrust vs TrustArc where a rejected banner still has to stop the tag
OneTrust when cookie auto-blocking is the CMP control, and the DSAR sits on a suite meter you name separately. TrustArc when Cookie Consent Manager auto-block is the tag control, and Individual Rights Manager is a separate case.
Article 12 of the GDPR sets the answer at 1 month from receipt for an access, erasure, or objection request. A further 2 months is allowed only if you tell the person inside that first month, and you give the reason. Miss the notice and the extension is not available.
California Civil Code section 1798.130 sets a verifiable consumer request at 45 days, with one extension of another 45 days if you notify the person inside the first 45. On the same week the banner can say reject while an analytics tag the page already injected keeps running. The choice and the network call are different events.
OneTrust’s pricing page meters the Consent Management Platform, including a Suite that puts banners, privacy notices, and data-subject-request automation on average daily visitors across properties. Universal Consent and Preference Management is a second meter, counted as data subject profiles. TrustArc’s consent and preference page splits the same week into three products: Cookie Consent Manager for device and tracker choices, Consent and Preference Manager for brand and marketing preferences (that page states 300+ connectors), and Individual Rights Manager for the rights case.
On 25 March 2026 Cookie Consent Manager Pro gained a path that can move a Do Not Sell or Share submission into a cookie opt-out. That auto opt-out ships turned off. Cookie blocking and the rights case are different scopes. The rest of this comparison is what a reject does to the tag, then what the case file records inside the 1 month GDPR clock or the 45-day California clock.
| Primary use case | Cookie consent on the CMP, with data-subject-request automation only on the suites that include it | Cookie Consent Manager for the banner, and Individual Rights Manager as a separate rights case |
|---|---|---|
| What a reject has to change | Categorized scripts, through Cookie Auto-Blocking. That block is the CMP. It is not the DSAR | Category trackers, through Execute Auto-block on a location. That block is Cookie Consent Manager. It is not Individual Rights Manager |
| What the request file records | DSR automation covers intake, identity verification, retrieval and deletion, legal-hold checks, redaction, and a secure response. CMP Suite and Privacy Automation Suite both include a DSR path, on different meters | Individual Rights Manager is the case file. The 25 March 2026 release can embed the intake form and, when enabled, tell Cookie Consent Manager Pro to opt the browser out after a Do Not Sell or Share submission |
| Day-to-day workflow | Privacy operations configures purposes and the banner, marketing lives in the preference center, and the rights queue works the case against the statutory clock | The web owner configures Cookie Consent Manager, marketing configures Consent and Preference Manager, and the rights owner works Individual Rights Manager. The bridge between the last two and the banner is a setting |
| License/pricing | No public dollar on the pricing page. CMP on average daily visitors. Universal Consent on profiles. Privacy Automation on users and privacy-asset inventory. See Editions | No public dollar on the product pages opened. Treat the price as quote-required. See Editions |
| Who operates it | Privacy operations owns purposes, notices, and the request queue. Whoever ships the tag still has to make the tag read the choice | Web, marketing, and the rights queue can be three operators. Someone has to turn on CCM Auto Opt-out if a Do Not Sell submission must change the cookie state |
We reviewed OneTrust’s Cookie Auto-Blocking article and pricing page, TrustArc’s location settings for auto-block, the 25 March 2026 Privacy Studio notes, TrustArc’s consent and preference page, the Q1 2026 product update, the acquisition notices, GDPR Article 12, and California Civil Code section 1798.130, on 3 Oct 2026. We did not install either product, so this is not a hands-on benchmark.
OneTrust
TrustArc
OneTrust is still sold under that name. On 10 December 2024 EQS Group acquired OneTrust’s ethics and compliance division, including Convercent. That division is absent from the pricing page opened 3 Oct 2026, and it is not the privacy packages compared here. No completed acquisition of OneTrust itself was on the sources opened that day. TrustArc is still sold under that name. TrustArc’s announcement says Main Capital Partners acquired the company. Main Capital’s portfolio lists 14 October 2025 as the investment date. Bregal Sagemount’s sale note is dated 20 October 2025. Those are two announcement dates for the same sale.
Editions and pricing
Neither vendor posted a dollar figure on the pages checked 3 Oct 2026. The rows below are the meters and the package boundaries. A currency figure from anywhere else is quote-required.
| How you buy it now | CMP Base is banners and a tracker inventory across web, mobile, and CTV. CMP Suite adds notices and DSR automation on that same visitor meter. Universal Consent and Preference Management is the profile meter for marketing choices. Privacy Automation Suite repeats DSR fulfillment on a meter of users and privacy-asset inventory, and adds incident notification | Cookie Consent Manager, Consent and Preference Manager, and Individual Rights Manager are separate products on TrustArc’s own table. Cookie Consent Manager Pro is the tier that received the March 2026 rights-form integration. Consent and Preference Manager is the product that states 300+ connectors, including Salesforce, Marketo, HubSpot, Adobe Experience Platform, and Mailchimp |
|---|---|---|
| Public price (3 Oct 2026) | No dollar. The pricing page says CMP price follows average daily visitors aggregated across channels and properties, Universal Consent follows total data subject profiles captured, and Privacy Automation follows users plus privacy asset inventory. The page also sells AI Governance, Tech Risk and Compliance, and Third-Party Management. Those meters are a different purchase from the banner and the request | No dollar on the consent, preference, or rights pages opened, and no public unit such as visitors or cases. Quote-required. A reseller range is not a price for these products |
| What the count includes | Visitors are aggregated across properties, so a second domain is not a free banner. Profiles are people captured in Universal Consent, which is not the same counter as website visitors. A DSR on the CMP Suite meter and a DSR on the Privacy Automation meter are two package paths to the same kind of case | Not published. Do not assume a cookie domain, a preference profile, and a rights case share one counter |
| Main buying consideration | Which meter will the DSAR sit on, visitors or users-plus-inventory, and is the marketing preference center a third meter of profiles? | Are you buying three products, and does a Do Not Sell request change the cookie state only after someone enables the March setting? |
How a reject reaches the tag
| How auto-block treats a reject | Cookie Auto-Blocking can stop scripts that drop a categorized cookie until that category is allowed. On an opt-out model, the article says cookies are allowed on the first visit, and a reject then blocks that category. The OtAutoBlock script has to load synchronously. Loaded asynchronously, scripts can run before consent. A script with data-ot-ignore is not blocked | Execute Auto-block is a location setting, after the auto-block deployment steps. When it is on, Default Consent decides which categories fire before a choice. A category set to Yes stays on until the visitor opts out. A script marked data-ta-type=”ignore” is skipped. Integration Studio says a script already executed is not undone without a page reload |
|---|---|---|
| CMP scope, not the DSAR | This row is the banner script. CMP Suite and Privacy Automation Suite can include DSR automation on their own meters. The auto-block article does not say a deletion request rewrites the banner | This row is Cookie Consent Manager. Individual Rights Manager is the case file. Consent and Preference Manager is the brand and marketing record, with 300+ connectors on TrustArc’s consent page. Those are not the auto-block script |
| From a rights request back to the cookie | The DSR product page says intake and the secure portal are integrated with the CMP and Trust Center. It does not say a deletion request rewrites the cookie banner by default. A rewrite of the banner was not found on that page | 25 March 2026: Cookie Consent Manager Pro can embed an Individual Rights Manager form. If CCM Auto Opt-out is enabled, a Do Not Sell or Share submission can move the user to an opt-out consent state. The release says the setting is disabled by default. That bridge is not auto-block |
| What a withdrawn choice does next | OneTrust’s tag-manager notes say a tag that was allowed and is later blocked stays blocked on a later page load. The button does not rewind a request the page already sent | Integration Studio says the same limit from the other side: a script that already ran needs a reload before the stricter choice takes effect. The 25 March 2026 notes also say a missing Content-Security-Policy entry for *.trustarc.com can block the banner resources, and they told customers to update that policy before 22 May 2026 |
| Recent product change | 202605.1.0 on the developer changelog: cookie-receipt bulk export APIs, limited to six bulk exports per month, listed under existing public-preview features. The changelog page does not print a calendar day. Whether the export later left preview was not on that page. The export is an audit file, not the tag block | The 25 March 2026 auto opt-out is the consent change used here. TrustArc’s Q1 2026 update also says Cookie Consent Manager Pro’s default templates are WCAG 2.2 aligned and adds 20+ Indian languages. That post does not print a calendar day, and the March notes do not restate the template claim |
| Main buying consideration | Will OtAutoBlock load before the tags, and is the DSAR on CMP Suite or on Privacy Automation rather than assumed from the banner? | Is Execute Auto-block on for that location, and will anyone enable CCM Auto Opt-out if a Do Not Sell submission must change the cookie? |
Both help centers describe a block on categorized scripts, and both describe an ignore attribute that lets a script through. The November 2024 comment below is about a wait on refuse. It is not a tag log.
The comment names TrustArc and a 2 minute processing state on refuse. There is no tag log attached. A wait state is one way the button and the stop come apart.
How a request uses the month
The 1 month and the 45 days are statutes, cited above. Neither product is the statute. The case file has to be configured to the deadline that applies to that person, including the notice you owe if you extend. DSAR tools cover the wider set of request products. Cookie consent tools cover banners that are not a rights case.
| Intake | DSR automation takes the request through a secure portal. The product page ties that portal to the CMP and Trust Center so the person is not sent to a separate email thread for the reply | The 25 March 2026 release lets Individual Rights Manager intake forms be embedded on another site with a JavaScript tag, with domain allow-listing, and adds the website source on the REST response |
|---|---|---|
| Identity check | The pricing page and the DSR page both name identity verification on the fulfillment path, along with retrieval, deletion, and redaction. The pages do not name the verification vendor | TrustArc’s Q1 2026 update says Individual Rights Manager supports international identity verification through IDology, including optional document scan and challenge questions. Outcomes are written to the request activity history. A failed first check can get a second attempt. Requests that do not pass can sit in an Unverified state. The 25 March 2026 notes do not restate IDology, and the Q1 post does not print a calendar day |
| What the file does not do by itself | A configured workflow can retrieve and delete, and it can check a legal hold before deletion. It does not, on the pages read, file the GDPR response inside the 1 month or the California response inside 45 days without someone owning the queue | Integration recipes in the Q1 update can accept, reject, update, or delete in connected systems based on a match. The recipe still needs the match, and the statutory reply is still the operator’s |
| Main buying consideration | Is the request queue the same tenant as the banner, on a visitor meter or on the privacy-inventory meter? | Does the case need IDology on the activity history, and a separate decision about whether that case flips the cookie banner? |
Where they overlap
An evaluation that says “banner, preference center, rights intake, and a regulatory library” will draw both. Overlap is that shared privacy-operations week. OneTrust’s regulatory library on the privacy packages is DataGuidance. TrustArc’s is Nymity, including the Q1 update’s law tables. Each can record a cookie choice and open a rights case. Each now ships an AI layer on the marketing site. Each markets an AI layer beside those products. That packaging is not the cookie block, and it is not a SOC 2 evidence product.
The split that remains is scope. Cookie auto-blocking is the CMP job on both sides, and it does not close a DSAR. OneTrust publishes the visitor meter, the profile meter, and the user-plus-inventory meter, and it offers DSR fulfillment on the suite meters, not as a side effect of the banner script. TrustArc names three products, and the bridge from a rights request to the cookie state is the 25 March 2026 setting, which ships turned off. Buying either one to replace the tag manager, or to collect SOC 2 controls, is a different purchase.
When to use both
Two cookie banners on one hostname produce two answers to the same reject. The split that can work is by property and by record. Use TrustArc Cookie Consent Manager Pro on the sites where the Do Not Sell form has to change that banner, after CCM Auto Opt-out is enabled, and after the content-security policy allows *.trustarc.com. Use OneTrust Universal Consent where marketing preferences are counted as profiles and have to sync from a preference center. Keep one rights queue. If both tenants would open a case for the same person, the operator needs one file that is allowed to close, and the other system should not start a second clock.
Choose OneTrust when OtAutoBlock has to load before the tags, and the DSAR is a named suite (visitors for CMP Suite, or users and privacy-asset inventory for Privacy Automation Suite), with Universal Consent as a separate profile meter if marketing preferences are in scope. The spring 202605.1.0 receipt export is an audit file, not the block. Choose TrustArc when Cookie Consent Manager, Consent and Preference Manager, and Individual Rights Manager stay separate products, the rights form has to embed on the site, and you will turn on the 25 March 2026 CCM Auto Opt-out before a Do Not Sell or Share submission is allowed to change the banner.
FAQs
Is this a SOC 2 or GRC automation comparison?
No. The comparison is the cookie choice, the preference record, and the data-subject request. OneTrust’s pricing page also sells technology-risk and third-party packages. Those are outside this pair. A product whose week is control evidence for a security audit is a different purchase.
Do both products handle cookie consent and DSARs?
Yes. OneTrust puts DSR automation on CMP Suite and again on Privacy Automation Suite. TrustArc uses Individual Rights Manager for the case and Cookie Consent Manager for the banner. The difference is the meter, the product boundary, and whether a Do Not Sell or Share request changes the cookie state before you enable CCM Auto Opt-out.
What public prices were actually checkable?
No dollar figure on the OneTrust pricing page or the TrustArc product pages opened 3 Oct 2026. The meters are in Editions and pricing. Any number from a reseller is quote-required.
Does either product answer the person inside the 1 month or the 45 days by itself?
No. Article 12 sets 1 month from receipt, and it allows a further 2 months only with notice inside that first month. California Civil Code section 1798.130 sets 45 days, with one 45-day extension if you notify the person inside the first 45. The products store the case, the identity check, and the downstream update. Someone still has to own the reply.
Is this a hands-on bake-off?
No. The comparison uses first-party pricing, product, changelog, and release pages, the acquisition notices, the two statutes, and three community comments.
