Usercentrics vs OneTrust

The Munich Consent Specialist vs the Atlanta Privacy Suite

Usercentrics is operated by Usercentrics GmbH, headquartered in Munich, Germany. Founded in 2017 by Mischa Rürup, Vinzent Ellissen and Lisa Gradow, it merged in September 2021 with Danish rival Cybot, the company behind Cookiebot — the consent tool Daniel Johannsen launched in Copenhagen in 2012. The combined group kept both brands: Usercentrics CMP for enterprise, Cookiebot for small and mid-sized websites. By its own figures, Usercentrics now handles more than 7 billion consents a month across 2.3 million websites and apps, and in October 2025 announced it had passed €100 million in annual recurring revenue with 45% growth and profitability.

OneTrust is operated by OneTrust, LLC, headquartered in Atlanta, Georgia. Founded in 2016 by Kabir Barday, it has grown into a broad trust-and-governance platform — consent and preferences, privacy automation, third-party management, tech risk and compliance, data-use governance and AI governance — reporting more than 14,000 customers and over half of the Fortune 500. As a US company, OneTrust is subject to the CLOUD Act and FISA Section 702 regardless of hosting region.

Where our Didomi vs OneTrust comparison looks at a French enterprise CMP and Palqee vs OneTrust at broader privacy-programme tooling, this page focuses on the self-serve end of consent management: Usercentrics and Cookiebot are among the few CMPs that publish prices and offer free tiers — useful for SMBs, agencies and marketing teams that just need a compliant banner without an enterprise sales cycle.

Jurisdiction Comparison

	Usercentrics	OneTrust
HQ	Munich, Germany (Cookiebot: Copenhagen, Denmark)	Atlanta, Georgia, USA
Corporate entity	Usercentrics GmbH (German GmbH); Usercentrics A/S (Danish)	OneTrust, LLC (US)
Founded	2017 (Cookiebot/Cybot: 2012)	2016 (Kabir Barday)
Ownership	Private; investors include Full In Partners, Alstin Capital, Cavalry Ventures; Google ~3% minority (reported 2024)	Private, US-parented; investors include Insight Partners, Coatue, SoftBank, Generation Investment Management
CLOUD Act exposure	No US parent company; hosting providers (Google Cloud, Azure) are US-parented	Yes (US company)
FISA 702 exposure	Not at corporate level	Yes
Consent data hosting	EU (Google Cloud Frankfurt/Belgium; Cookiebot on Azure EU)	Azure regions incl. Germany, US, UK and others
Google-certified CMP	Yes (Usercentrics CMP and Cookiebot CMP)	Yes

Product Capabilities

Web Consent Banners

• Usercentrics: Usercentrics Web CMP (enterprise-grade customisation, A/B testing on Corporate, cross-domain consent sharing) and Cookiebot CMP (automatic website scanning and cookie categorisation, plug-and-play setup). Both support Google Consent Mode.
• OneTrust: CMP Base and CMP Suite for websites, apps and CTV, capturing consent and managing banners across channels; CMP Suite adds privacy notice management and data-subject request automation.

App and CTV Consent

• Usercentrics: App CMP with SDKs (from €49/month for up to 500K daily active users) and a CTV CMP on quote.
• OneTrust: Mobile app and CTV consent within the CMP packages.

Preference Management

• Usercentrics: Preference Manager for marketing and communication preferences beyond cookies.
• OneTrust: Universal Consent & Preference Management (UCPM), priced on data-subject profiles — more mature for complex, multi-channel enterprise preference centres.

Beyond Consent

• Usercentrics: Privacy policy generator, server-side tagging (server-side Google Tag Manager and Meta Signals Gateway hosting) and, since its January 2026 acquisition of New York-based MCP Manager, an MCP gateway for governing AI tool connections.
• OneTrust: Full privacy automation (data mapping, DPIAs, DSARs), third-party risk management, tech risk and compliance, data-use governance and AI governance.

Notable: This is OneTrust’s genuine strength. If you need one platform for the entire privacy and GRC programme, Usercentrics does not replace it. If you need consent done well, at a transparent price, from an EU-incorporated vendor, OneTrust’s breadth is mostly cost you won’t use.

Sovereignty Model

• Usercentrics: German parent (Usercentrics GmbH) with a Danish subsidiary (Usercentrics A/S) for Cookiebot; GDPR under German and Danish supervision; no US parent company. Consent data stays in EU data centres. The caveat: infrastructure is rented from Google Cloud (Google Ireland) and Microsoft Azure (Microsoft Ireland) — EU-located, but those providers have US parents. Usercentrics also has a North American office in New York.
• OneTrust: US parent (OneTrust, LLC); CLOUD Act and FISA Section 702 reach applies to the company as a US entity, even when consent records are hosted in its German Azure region.

Consent records are personal data: consent IDs, timestamps, browser user agents and consent states for every visitor. Usercentrics removes the US corporate parent from the chain; it does not remove US hyperscalers from the hosting layer. For most European organisations that is a meaningful step up from OneTrust; for those whose policy excludes any US-parented cloud, it is worth raising in procurement.

Reference Customers

Usercentrics publishes customer stories featuring brands such as Villeroy & Boch, New Work SE, Einhell and Paul & Shark, and lists Scout24 SE, Free2Move and congstar among its customers.

Typical scenarios where Usercentrics fits:

• A small business or agency site that needs a compliant banner today: Cookiebot Free or Premium Lite, set up in minutes, with automatic cookie scanning.
• A European retailer with several country domains that wants centralised consent with cross-domain sharing and EU-hosted consent logs: Usercentrics Web CMP Pro or Business.
• A publisher or app business that needs IAB TCF and Google Consent Mode across web, apps and CTV from one vendor.

Pricing

Tier	Usercentrics Web CMP	Cookiebot	OneTrust
Free	€0 — 1 domain, 1,000 sessions/month	€0 — 1 domain, under 50 subpages	No free plan
Entry	Essential €7/month (1,500 sessions)	Premium Lite €7/month	Quote-based
Mid	Plus €15 · Pro €30 (3 domains)	Small €15 · Medium €30 per domain/month	Quote-based (CMP Base, by daily visitors)
Upper	Business €50/month (10 domains)	Large €50 · XLarge €90 per domain/month	Quote-based (CMP Suite / UCPM)
Enterprise	Corporate: custom	Usercentrics Advanced: custom	Custom

Prices as listed on usercentrics.com and cookiebot.com, excluding VAT, as of October 2026. OneTrust prices all consent packages on quote, based on average daily visitors (CMP) or data-subject profiles (UCPM).

Who Should Switch?

Usercentrics is the structural choice for:

• SMBs and freelancers who need a compliant cookie banner without a sales call — Cookiebot or Usercentrics’ free and low-cost tiers
• Marketing teams that rely on Google Consent Mode and want a Google-certified CMP from an EU-incorporated vendor
• Agencies managing many client sites on transparent, per-domain or per-session pricing
• Mid-market European brands that want EU-hosted consent logs and no US corporate parent
• Publishers and app developers needing IAB TCF across web, app and CTV

OneTrust remains the right choice for:

• Organisations running their whole privacy programme (RoPA, DPIAs, DSARs) in OneTrust
• Enterprises that need third-party risk, tech risk, AI governance and consent in one platform
• Teams with complex, multi-channel preference centres already built on OneTrust UCPM

The Bottom Line

OneTrust is the broadest platform in privacy and governance software, and for organisations that use that breadth it is hard to replace. But many European companies buy OneTrust mainly for the cookie banner — and for that job they pay enterprise, quote-only prices to a US company subject to the CLOUD Act.

Usercentrics is the focused EU alternative: a Munich-headquartered GmbH with the Cookiebot brand for SMBs, published pricing from €0, Google-certified CMPs, IAB TCF support and consent data stored in EU data centres. Be clear-eyed about the hosting layer — Google Cloud and Azure — and about the narrower scope. For consent management specifically, it answers jurisdiction and price transparency at once.

---

Looking for more European privacy and compliance alternatives? See also: Didomi vs OneTrust, Palqee vs OneTrust, and Piwik PRO vs Segment.

Frequently Asked Questions

Who is behind Usercentrics and how does it relate to Cookiebot?

Usercentrics is operated by Usercentrics GmbH, headquartered at Sendlinger Straße in Munich, Germany, and founded in 2017 by Mischa Rürup, Vinzent Ellissen and Lisa Gradow. Cookiebot was created in 2012 by Daniel Johannsen at the Danish company Cybot in Copenhagen. On 1 September 2021 the two companies announced a merger under the Usercentrics name, orchestrated by growth-equity investor Full In Partners, which had backed both. Both brands were kept: Usercentrics focuses on enterprise, Cookiebot on plug-and-play cookie compliance for small and mid-sized businesses. Cookiebot is today sold by the Danish entity Usercentrics A/S (formerly Cybot A/S).

How does Usercentrics' jurisdiction compare with OneTrust's?

Usercentrics GmbH is a German company subject to GDPR and German supervisory authorities, with no US parent company. OneTrust is operated by OneTrust, LLC, headquartered in Atlanta, Georgia. As a US company, OneTrust is subject to the US CLOUD Act and FISA Section 702 regardless of whether customer data is hosted in its EU regions. One honest nuance: Usercentrics hosts on Google Cloud (via Google Ireland) and Cookiebot on Microsoft Azure (via Microsoft Ireland) — the data stays in EU data centres, but the hosting providers themselves have US parents.

Where is consent data stored?

According to Usercentrics, Usercentrics CMP processes consent data on Google Cloud in Frankfurt and stores it in Belgium, with backups also in the EU; the hosting contract is with Google Ireland Ltd. Cookiebot's production systems run on Microsoft Azure in EU data centres operated by Microsoft Ireland Operations Ltd. OneTrust hosts on Microsoft Azure with regions including Europe (Germany), the US, the UK and others — but the contracting parent remains a US company.

Is Usercentrics compatible with Google Consent Mode and the IAB TCF?

Yes. Both Usercentrics CMP and Cookiebot CMP appear on Google's list of certified CMPs required for serving personalised ads to users in the EEA, UK and Switzerland, and Usercentrics supports the IAB Transparency and Consent Framework for publishers. OneTrust and Didomi are also on Google's certified list, so this is a requirement all serious vendors meet rather than a differentiator — what differs is jurisdiction, focus and price transparency.

How does pricing compare?

Usercentrics publishes its prices. As of October 2026, Usercentrics Web CMP has a Free plan (1 domain, 1,000 sessions/month), Essential at €7/month, Plus at €15/month, Pro at €30/month (3 domains) and Business at €50/month (10 domains), with Corporate on quote; App CMP Advanced is €49/month. Cookiebot offers a Free plan for one domain under 50 subpages and Premium plans from €7/month (Lite) up to €90/domain/month (XLarge). OneTrust does not publish consent pricing: its CMP Base, CMP Suite and Universal Consent & Preference Management packages are quoted based on average daily visitors or data-subject profiles.

When is OneTrust still the better choice?

When consent is only one part of a broader programme. OneTrust's platform covers privacy automation (data mapping, DPIAs, DSAR handling), third-party risk management, tech risk and compliance, data-use governance and AI governance. If your privacy, legal and security teams already work in OneTrust, replacing just the cookie banner may add integration work rather than remove it. Usercentrics is the stronger fit when the requirement is specifically consent and preference management under an EU-incorporated vendor.