CMP market share in the US: which consent platforms sites actually use

Which consent platforms US sites use

Sorted by the number of US websites. Every count is BuiltWith's, and the partner tier is Google's rating in its Consent Mode CMP Partner Program.

BuiltWith counts as of November 5, 2026, from its US websites and top 100,000 sites reports. Partner tiers are from the table of Google's lists.

I've also set up Kukie and consentmanager.net. They aren't in the table because I don't have BuiltWith counts for them from the same two reports.

What the numbers say

CookieYes leads on the number of US websites, but among the top 100,000 sites it has about a sixth of OneTrust's count, so most of its installs are on smaller sites. OneTrust is close behind CookieYes overall and far ahead on large sites. Cookiebot ranks high on both lists, third overall and second among the top 100,000. Ketch shows OneTrust's pattern at a smaller scale, with few sites overall and more of the top 100,000 than Termly.

Read Cookiebot and Usercentrics as one company. Cookiebot and Usercentrics merged in 2021, and Cookiebot is now sold as Cookiebot by Usercentrics.

iubenda and Termly both sell legal documents alongside their cookie banners. iubenda's set includes privacy and cookie policies and terms and conditions, and Termly's includes privacy policy, terms and conditions and cookie policy generators. A small business that needs a policy and a banner can buy both in one place, which helps explain how many small sites use them.

How BuiltWith counts

BuiltWith reports which technologies it finds on the websites it crawls, and these counts come from its privacy compliance reports for US websites and the top 100,000 sites. I haven't found a page where BuiltWith explains how it detects each consent platform, so read the counts as estimates. A count built from crawling websites can be off in a few ways.

• A site that shows its banner only to visitors in some regions may not load it for a crawler somewhere else.
• A platform loaded through Tag Manager or a plugin shows up only if the crawler runs the page's scripts.
• A site that switched platforms can carry the old one's code for a while and be counted under both.
• Every site counts once. A small blog and a large retailer weigh the same.

BuiltWith also lists an entry called "Cookie Consent by Osano". I've left it out, because it may count Osano's free, open-source cookie banner code, which is a different product from the Osano consent platform. That count can't be read as Osano's share.

Which kind of site uses which

The counts match what I see in client work.

For smaller teams without a privacy function, I now recommend CookieYes to many clients. I used to recommend Termly. CookieYes packages its features in a way that fits many of my clients better, and it's been a better product fit for them. Termly can be too basic for some, and the way it packages its plans wasn't quite what my clients needed.

Larger organizations with legal or privacy teams tend to land on OneTrust or Usercentrics. OneTrust is so configurable it's baffling, with many templates, version control and environment options, and documentation layers that many organizations don't need. Usercentrics is also very configurable. I liked its tools and the way it structures consent, and it's strong when you need a more granular setup than CookieYes or Termly offer. The two are compared in OneTrust vs Usercentrics, and the two most installed platforms in OneTrust vs CookieYes.

Of the platforms I've set up, here's how much each lets you configure, most first: OneTrust, Usercentrics, Ketch, CookieYes, Kukie, then Cookiebot and Termly. I'd put iubenda below Usercentrics. The order describes how much you can change in my setups, and says nothing about which one is better for your site.

Prices and plans for each platform are in the comparison of nine platforms.

What popularity doesn't tell you

Every platform in the table can be connected wrong. When I test a setup, I check four things.

• Consent defaults are set before any tag runs.
• All four consent mode signals update after a visitor chooses.
• Tags that aren't Google's, such as Meta or LinkedIn, stop when they should.
• Global Privacy Control is handled the way you intend.

Google's certified lists tell you which platforms Google has vetted, and the banner test shows what your own site does.

Head-to-head comparisons

• All nine platforms compared, with prices and fit
• OneTrust vs Usercentrics
• OneTrust vs CookieYes
• iubenda vs Usercentrics

Questions about CMP market share