OneTrust vs Cookiebot: how each works with Tag Manager and consent mode
One is an enterprise privacy platform. The other is a widely installed banner that scans your site for cookies. Here's how each connects to Google Tag Manager and consent mode, and how to tell which one your organization needs.
The short answer
Both can send all four consent mode signals to Google's tags, and both have a Tag Manager template. OneTrust is the most configurable platform I've set up, built for organizations with a privacy team and many sites or regions. Cookiebot, a Usercentrics product, scans your site and can block cookies automatically, with far fewer settings to manage. Whichever you choose, test the Tag Manager connection after setup.
On this page
What you're buying
OneTrust sells cookie consent as one part of a platform that covers privacy, data use, AI governance and third-party risk. Its cookie consent product scans your sites, applies different banners by region, country or state, and keeps a database of consent records.
Cookiebot is a Usercentrics product, sold as Cookiebot by Usercentrics since the two companies merged in 2021. It scans your site, sorts the cookies it finds into necessary, preferences, statistics and marketing, and records each visitor's consent. Usercentrics also sells its own consent platform, compared in OneTrust vs Usercentrics.
For all nine platforms side by side, see the full comparison.
How each connects to Google Tag Manager
Cookiebot
Usercentrics publishes the Cookiebot CMP template in Tag Manager's Community Template Gallery. You enter your Cookiebot ID, the domain group ID shown under Your Scripts in your Cookiebot account, and the template loads the Cookiebot script for you. Put it on the Consent Initialization trigger, which fires before every other trigger.
In the template's Default Consent State table, you set a default for each category. A row can carry country codes so it applies only to visitors from those countries, and a row with no region applies everywhere. If you don't add a row for everywhere, the template starts every signal as denied. Its Geo Regions setting can also show a different banner, from a different domain group, to visitors in the regions you list.
The template maps Cookiebot's preferences category to functionality_storage and personalization_storage, statistics to analytics_storage, and marketing to ad_storage, ad_user_data and ad_personalization. When a visitor chooses, Cookiebot sends the updated signals to Google. On later pages the template reads the stored choice from the CookieConsent cookie and sends it before tags fire.
For tags that aren't Google's, Usercentrics also publishes a Cookiebot Consent State variable that reads the visitor's choice, so a trigger can hold a tag until its category is allowed. Outside Tag Manager, Cookiebot can block cookies automatically until a visitor consents, or you mark up each script with the category it needs.
OneTrust
OneTrust's consent mode setup is switched on in each geolocation rule, and its OneTrust CMP template in the Community Template Gallery maps OneTrust's cookie categories to Google's consent types. For other tags, OneTrust adds the visitor's allowed categories to the data layer and fires an event when they change. The full setup is in OneTrust vs Usercentrics.
Consent mode v2 signals
Consent mode v2 has four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. Both platforms can send all four.
- Cookiebot says consent mode v2 activates automatically, and its template sets all four, with the three advertising signals following the marketing category.
- OneTrust maps Performance cookies to analytics_storage and Targeting cookies to ad_storage, ad_user_data and ad_personalization unless you change it. The two newer signals need script version 202311.1.0 or later.
| Platform | On Google's certified CMP list (TCF) | Consent Mode partner tier |
|---|---|---|
| OneTrust | Yes, as "Onetrust / Cookiepro CMP" | Gold |
| Cookiebot | Yes, as "Cookiebot CMP" | Gold |
Copied from the table of Google's lists, which says when each list was checked.
Configuration and day to day
OneTrust is the most configurable platform I've set up. In my experience it's so configurable it's baffling, with many templates, version control and environment options, and documentation layers many organizations don't need. Cookiebot is among the least configurable of the platforms I've set up, in the same tier as Termly.
| Setting | OneTrust | Cookiebot |
|---|---|---|
| Rules by region | Geolocation rule groups, each with a required default rule. Each rule sets the consent model, the banner, GPC handling and consent mode. | Geotargeting on paid plans, and defaults and banners by region in the Tag Manager template |
| Categories | Cookie categories, each mapped to consent mode signals and used in Tag Manager triggers | Necessary, preferences, statistics and marketing |
| Test before live | A test script, not tied to a domain, published before the production script | Not documented |
Where each fits
BuiltWith counted OneTrust on about 149,000 US websites and Cookiebot on about 113,000. Among the top 100,000 sites, OneTrust had 7,467 and Cookiebot 2,388, so OneTrust is on about three times as many large sites.
BuiltWith counts as of November 5, 2026, from its US websites and top 100,000 sites reports. The full table is in CMP market share in the US.
OneTrust fits large organizations with a privacy or legal team, many websites or apps and many regions, where someone owns the platform day to day. Cookiebot fits small and mid-sized sites, especially with visitors in Europe, that want scanning and a banner with fewer settings to manage.
See the OneTrust pricing page and the Cookiebot pricing page.
Test it after setup
Whichever you choose, run the banner test in a browser before and after a choice, and again with Global Privacy Control on. The Measurement & Consent Audit runs that test for every key action, and I can set up or fix either platform.
Questions about OneTrust and Cookiebot
Is Cookiebot the same as Usercentrics?
Cookiebot is a Usercentrics product. The two companies merged in 2021, and Usercentrics also sells a consent platform under its own name. They're separate products, each with its own Tag Manager setup.
Can Cookiebot handle visitors in several regions?
Yes. Its paid plans include geotargeting, and its Tag Manager template can set different consent defaults and show a different banner by region. What each region should default to is a decision for you and your counsel.
