OneTrust vs Cookiebot: Pricing, Features and DSAR Coverage Compared

Short answer: Cookiebot is the right pick when the job is a certified cookie banner on a website, at €7 to €90 a month per domain with a 14-day trial. OneTrust is the right pick when you are buying a whole privacy program (consent, data mapping, assessments, vendor risk and subject rights) under one enterprise contract, with a reported floor near $10,000 a year. The split that matters once real requests arrive: Cookiebot lists no data subject request handling on any plan, and OneTrust only sells it inside that platform contract.

Cookiebot prices below were read from cookiebot.com in September 2026 and are published in euros only. OneTrust does not publish prices, so its figures are aggregated buyer-reported procurement data rather than a quote.

OneTrust vs Cookiebot at a glance

How much does Cookiebot cost?

Cookiebot costs €0 to €90 a month per domain, depending on how many subpages the site has. The free plan covers one domain up to 50 subpages, and Premium Lite adds the paid features for €7 a month on that same small footprint. Premium Small is €15 a month per domain up to 350 subpages, Premium Medium €30 up to 3,500, Premium Large €50 up to 7,000, and Premium XLarge €90 above that.

The per-domain wording is the line to read twice. A US company running a marketing site, a docs site and an app on three domains pays each plan three times. At Premium Medium that is €90 a month, or €1,080 a year, which is still cheap next to any enterprise suite. Every paid plan starts with a 14-day trial and no card. Billing is in euros, so the dollar amount on your card statement moves with the exchange rate.

How much does OneTrust cost?

OneTrust costs roughly $10,000 a year at the floor and a reported median of about $11,970 a year, based on 307 tracked purchases from 153 unique buyers. Recorded contracts run from about $1,620 to $48,230, and buyers report negotiating a little over 20 percent off the first quote. We break the number down module by module in our OneTrust pricing guide.

That median is pulled down by a large number of cheap consent-only purchases, because cookie consent is the single most commonly bought OneTrust module. So if you are comparing OneTrust to Cookiebot for a banner alone, the lower end of the range is the relevant one. If you also want data mapping or request automation, you are buying into the platform, and the floor applies before the modules you actually came for.

Is Cookiebot better than OneTrust?

For a cookie banner, usually yes. Cookiebot is faster to install, far cheaper, and its scanner and consent log are what most small and mid-size sites need to show a regulator. OneTrust is better when consent is one of several programs you have to run and prove, and when you have the people to operate a large platform. The mistake is buying OneTrust for the banner, or expecting Cookiebot to cover anything beyond it.

A practical note on the banner itself: consent walls affect how many visitors reach your signup or checkout page, and the default templates on both tools differ in how aggressive they look. Whichever you pick, it is worth checking how the banner affects your conversion rate before and after it goes live, because a banner that covers the hero on mobile can cost more than the subscription.

Can Cookiebot handle data subject access requests?

No. None of Cookiebot's plans lists a data subject request feature, and the Usercentrics pricing page does not list one either. Cookiebot records consent and gives you a downloadable consent log, which answers "did this person agree to cookies". It does not take in an access or deletion request, verify who is asking, search your systems for the person, or track the response deadline.

That matters for US businesses in particular. Under the CCPA and the newer state laws, the obligations that carry penalties are mostly about requests: honoring opt-outs, and answering access, deletion and correction requests within 45 days. A banner does not help with any of that. See CCPA compliance software for CCPA requests for what the California rules actually require of a request workflow.

Does OneTrust handle DSARs?

Yes, and well. OneTrust shipped one of the first DSAR portals when GDPR took effect in 2018, and its Privacy Rights Automation module handles intake, identity verification, workflow and fulfillment at very high volume in more than 100 languages. The catch is commercial rather than technical. The module is reported near $275 a month at list, but it is not sold on its own, so you clear the roughly $10,000 platform floor first. We cover that trade-off in detail on our OneTrust DSAR alternative page.

Which one should a US business choose?

Start from what is actually landing on your desk. If your problem is the banner (an agency flagged your site, or your EU traffic needs prior consent), Cookiebot solves it this afternoon for less than a software seat. If your problem is a privacy program (you are mapping data across dozens of systems, running assessments, managing hundreds of vendors), OneTrust is built for that, and the price reflects it.

Most small and mid-size US companies are in neither place. They need a banner, they have started receiving access and deletion requests, and they do not have a privacy team. For them the proportionate setup is two tools: a cheap consent platform for the banner, and a focused request tool for the part that carries legal exposure.

What does a request actually cost to answer by hand?

More than a year of either banner. Gartner has put the cost of answering a single request manually at around $1,400, because someone has to search the CRM, the help desk, billing, email and file storage, then decide what to withhold and write the letter. At three requests a month that is a larger line than the OneTrust median, spent on staff time instead of software. It is the reason the choice between these two tools rarely settles the compliance question on its own.

That work is what DSAR automation removes. Obtainer finds where a person's data lives across your systems, compiles one reviewable manifest with a source on every item, drafts a deadline-safe response and tracks the GDPR one-month and US state 45-day clocks with deadline tracking. Nothing is disclosed until a human approves the redactions. It sits behind whichever banner you choose, self-serve from $49/mo billed yearly.

Are there cheaper OneTrust alternatives that include DSAR handling?

Yes. Several small-business privacy tools bundle a request workflow with the banner at a published price. Termly includes a DSAR form on every plan, iubenda puts its subject rights tool on the $99.99 Ultimate plan, and Enzuzo includes a DSAR workflow from its Growth plan at $22 a month billed yearly, capped at 20 requests. All three handle intake; none of them searches your systems for the person. Our Enzuzo pricing and alternative page walks through what that leaves manual, and the OneTrust alternative page compares the enterprise options.

Pros and cons

Cookiebot

• Pros: published prices, one-line install, strong automatic scanner, consent log ready for an audit, 14-day trial with no card.
• Cons: priced per domain, billed in euros, consent only, with nothing for access, deletion or correction requests.

OneTrust

• Pros: the broadest privacy suite on the market, mature request automation, scales to very high volumes and many languages.
• Cons: no published pricing, a reported $10,000 floor before the module you need, and a real implementation project with partner costs on top.

If you are weighing these two because requests have started arriving, the banner is the smaller decision. Pick the consent tool that fits your site, then put a request workflow behind it that can find the data and meet the clock.