OneTrust vs CookieYes: the two most-used CMPs in the US, compared for Tag Manager and consent mode
They're installed on about the same number of US websites, and on very different ones. Here's how each connects to Google Tag Manager and consent mode, how much setup each takes, and how to tell which one your team needs.
The short answer
OneTrust and CookieYes are the two most installed consent platforms on US websites, with very different customers. OneTrust is the most configurable platform I've set up, with more than many teams need. CookieYes is the one I now recommend to many smaller clients, because its features are packaged well for them. Both connect to Tag Manager and consent mode, so whichever you pick, test the connection after setup.
On this page
Same install count, different sites
BuiltWith counted CookieYes on about 150,000 US websites and OneTrust on about 149,000, as of November 5, 2026. Among the top 100,000 sites, OneTrust had 7,467 and CookieYes 1,233. Most CookieYes sites are smaller ones, and OneTrust is the platform large sites use most. The other platforms are in CMP market share in the US.
How each connects to Google Tag Manager
CookieYes
CookieYes has a CookieYes CMP template in Tag Manager's Community Template Gallery. You add your CookieYes website key, set the default consent for each category, by region if you need to, and fire the tag on the Consent Initialization trigger, which fires before every other trigger. If you use the template, CookieYes says to take its script out of the page head, so the banner loads once.
CookieYes maps Google's consent types to its own categories. ad_storage, ad_user_data and ad_personalization follow its Advertisement category, and analytics_storage follows Analytics. When a visitor chooses, CookieYes updates consent mode. Its Support GCM setting gives you basic consent mode, and turning on "Allow Google tags to fire before consent" switches to advanced mode, where Google's tags send cookieless pings before a choice.
For tags that aren't Google's, CookieYes recommends a custom event trigger. You create a first-party cookie variable that reads the cookieyes-consent cookie, then a trigger on the cookie_consent_update event that fires only when the right category is allowed, such as analytics:yes. Outside Tag Manager, CookieYes blocks many common third-party scripts automatically until the visitor consents, and you can add others by their URL.
OneTrust
OneTrust's consent mode setup is switched on in each geolocation rule, and its OneTrust CMP template in the Community Template Gallery maps OneTrust's cookie categories to Google's consent types. For other tags, OneTrust adds the visitor's allowed categories to the data layer and fires an event when they change. The full setup is in OneTrust vs Usercentrics.
Consent mode v2 signals
Both platforms can send all four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization.
- CookieYes maps all four to its categories. A site set up with the older consent mode v1 template needs the template updated to send ad_user_data and ad_personalization.
- OneTrust maps Performance cookies to analytics_storage and Targeting cookies to ad_storage, ad_user_data and ad_personalization unless you change it. The two newer signals need script version 202311.1.0 or later.
In Google's Consent Mode CMP Partner Program, CookieYes is a Gold partner and OneTrust is a Gold partner, as listed in the table of Google's lists.
Configuration effort
In my experience, OneTrust is so configurable it's baffling. It has many templates, version control and environment options, and documentation layers that many organizations don't need. CookieYes sits in the middle of the platforms I've set up for configurability, and the way it packages its features fits many of my smaller clients.
| Setting | OneTrust | CookieYes |
|---|---|---|
| Rules by region | Geolocation rule groups, each with a required default rule. Each rule sets the consent model, the banner, GPC handling and consent mode. | Two banners at once, for example one for the EU and UK and one for US states, on the Pro and Ultimate plans. The Tag Manager template sets defaults by region. |
| Categories | Cookie categories, each mapped to consent mode signals and used in Tag Manager triggers | Functional, analytics, performance and advertisement, plus necessary and uncategorized, in its Cookie Manager |
| Test before live | A test script, not tied to a domain, published before the production script | Tag Manager's preview mode, which CookieYes's guide uses to check the setup |
How the platforms I've set up compare on configurability is in CMP market share in the US.
Where each fits
OneTrust fits large organizations with a privacy or legal team, many websites or apps and many regions, where someone owns the platform day to day. CookieYes fits smaller teams without a privacy function, running one or a few sites, that need a working banner, consent mode and region settings without a long setup.
If you're on Termly and looking at CookieYes, I made the same move. I used to recommend Termly, and I now recommend CookieYes to many clients because its features were packaged better for them and Termly could be too basic. Termly's row in the comparison has its details.
Both publish their plans. See the OneTrust pricing page and the CookieYes pricing page.
If you switch
Moving from one consent platform to another changes how consent reaches your tags. Retest these after the switch.
- Consent defaults, set before any tag runs.
- Which categories control which tags.
- All four consent mode signals, before and after a choice.
- Pixels that aren't Google's, such as Meta and LinkedIn.
- Global Privacy Control.
Run the banner test on the new setup, or have the Measurement & Consent Audit check it for every key action. I can also set up or fix either platform.
Questions about OneTrust and CookieYes
Is CookieYes enough for a mid-size company?
Often, yes, if you run one or a few sites and don't have a privacy team that needs detailed controls. CookieYes connects to Tag Manager and consent mode, and its higher plans add separate banners by region. If you cover many regions, brands or apps, or your legal team wants versioned scripts and a test environment, look at OneTrust or Usercentrics. What the law requires of your site is a question for your counsel.
Do I need OneTrust for consent mode v2?
No. CookieYes and OneTrust can both send all four consent mode signals, and both are partners in Google's Consent Mode CMP Partner Program. Whether your signals come through correctly depends on how the platform is connected to your tags, so test it after setup.
