Consent and preference management

OneTrust holds a wide lead across global consent and privacy compliance recommendations. Didomi and Usercentrics receive frequent mentions for dedicated cookie banners and mobile consent management.

• What the user consented to
• Date/time and jurisdiction
• Consent version
• Purposes/categories
• Notice/privacy-policy version
• Withdrawal or preference changes

You want to be able to demonstrate what consent was obtained and under what conditions, not simply say that a banner was displayed.

• Consent/decline rates
• Consent by jurisdiction
• Consent changes/withdrawals
• Unclassified trackers
• Blocked technologies
• Vendor inventory
• Audit logs
• Configuration/version history

Security and governance

Also evaluate the CMP itself as a data processor/vendor. Ask about:

• SOC 2 / ISO 27001
• Encryption
• Data residency
• Subprocessors
• Retention/deletion controls
• SSO/SAML and RBAC
• Audit logs
• API security
• Incident response
• DPA availability
• Whether the vendor itself uses your consent data for analytics or advertising

One especially important distinction

I'd separate “consent management” from “privacy management.”

A CMP is excellent for:

“Can this website/app process this person's data for this particular purpose?”

A broader privacy-management platform may also need to handle:

“What personal data do we have, where did it come from, who has it, what rights does the person have, and can we delete/export it?”

For example, California's privacy regime now includes additional requirements around risk assessments, cybersecurity audits and automated decision-making for certain businesses, effective January 1, 2026. cppa.ca.gov So a cookie-consent product alone shouldn't be marketed internally as your complete privacy-compliance solution.

My procurement checklist

I'd score vendors roughly like this:

Best buying test: give each vendor a staging site containing Google Analytics, advertising pixels, a few obscure third-party trackers, and a tag that fires server-side. Ask them to demonstrate exactly what happens before consent, after consent, after withdrawal, and when GPC is enabled. That will reveal much more than a product demo.

Also, have counsel/privacy professionals validate the legal configuration for your actual jurisdictions; a CMP can help implement compliance, but it doesn't by itself make an organization's processing lawful.www.edpb.europa.eu

If you tell me your company size, jurisdictions (e.g. EU + U.S.), website/app stack, and whether you're mainly concerned with cookies or broader privacy rights, I can also give you a shortlist of CMP vendors and compare them feature-by-feature.

My practical take

• OneTrust — the strongest fit if you want a broad enterprise privacy platform, not merely a cookie banner. Its Universal Consent & Preference Management product lets users manage consent, communication preferences, and first-party data through a unified portal, while its CMP covers web, mobile, OTT and CTV.OneTrust+1
• Usercentrics — particularly compelling if consent signals, advertising/analytics integrations, and global regulatory adaptation are central. It supports GDPR, CCPA/CPRA and other frameworks, with geo-adaptive experiences and preference management across channels.Usercentrics+1
• Didomi — worth considering when the priority is a polished, customer-centric preference center for communication interests, topics, permissions and zero-party data, rather than a broader privacy-operations suite.Didomi

If I were evaluating vendors for a multinational company, I'd put OneTrust and Usercentrics through a detailed bake-off, with Didomi as a strong alternative when preference UX is the centerpiece. That's a comparison of capabilities, not an overall ranking.

One important distinction: consent management ≠ complete privacy management. If you need DSARs, data mapping, privacy assessments, records of processing, vendor risk, retention, etc., you should evaluate the broader privacy-management platform as well—not just the CMP.

If you tell me company size + countries/regions + web/app/B2B/B2C + whether you need marketing preferences, cookie consent, or full privacy operations, I can make a much more specific comparison, including OneTrust vs Usercentrics vs Didomi vs Transcend.