OneTrust vs Usercentrics: how each works with Tag Manager and consent mode
Both are built for organizations that need more than a basic cookie banner. Here's how each one connects to Google Tag Manager and consent mode, how far you can configure it, and what your choices do to the conversions Google Ads and GA4 receive.
The short answer
Both pass consent mode signals to Google's tags, and both suit organizations that need more than a basic banner. OneTrust is the most configurable platform I've set up, with more templates, versioning and environment options than most teams need. Usercentrics is the next most configurable, and it handles custom, more granular consent setups well. Either way, what decides your numbers is the Tag Manager connection and the defaults, so test those after setup.
On this page
Two platforms for larger sites
OneTrust and Usercentrics come up together when a company has several sites, several regions or a privacy team that wants control over every setting. This page compares the two on the parts that affect your tracking. For all nine platforms side by side, with prices and fit, see the full comparison.
How each connects to Google Tag Manager
OneTrust
OneTrust's consent mode setup is switched on in each geolocation rule, and its OneTrust CMP template in Tag Manager's Community Template Gallery maps each OneTrust cookie category to Google's consent types. Put the template on the Consent Initialization trigger, which fires before every other trigger, so the defaults are in place before any tag runs. When a visitor makes a choice, the template sends the update.
For tags that aren't Google's, OneTrust adds the visitor's allowed categories to the data layer as OnetrustActiveGroups and fires a OneTrustGroupsUpdated event when they change. Triggers in Tag Manager can then hold the Meta or LinkedIn tag until its category is allowed.
Usercentrics
Usercentrics turns consent mode on by default in its admin settings. Its Tag Manager guide recommends loading the Usercentrics script on the page itself, outside Tag Manager. For other tags, Usercentrics pushes a consent_status event to the data layer, and a variable named after each service tells a trigger whether that service is allowed.
Usercentrics can also block scripts itself with its Smart Data Protector, which has to load before every other script and only recognizes services it has a template for.
Consent mode v2 signals
Both platforms can send all four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization.
- OneTrust maps Performance cookies to analytics_storage and Targeting cookies to ad_storage, ad_user_data and ad_personalization unless you change it. The two newer signals need script version 202311.1.0 or later, so an older script sends only two of the four. Defaults are set per geolocation rule.
- Usercentrics has consent mode on by default, and when the TCF is in use its advertiser consent mode derives ad_storage, ad_user_data and ad_personalization from the TCF string. Region settings come from its geolocation rulesets, described below.
Both are on Google's certified CMP list, and both are Gold partners in Google's Consent Mode CMP Partner Program, as checked in November 2026. What those two lists mean is on its own page.
Consent policy configuration
This is where the two differ most. Both let you set different rules by region, group cookies and services into categories, and test changes before they go live. OneTrust gives you more layers of each.
| Setting | OneTrust | Usercentrics |
|---|---|---|
| Rules by region | Geolocation rule groups, each with a required default rule and an option for visitors whose location is unknown. Each rule sets the consent model, the banner, GPC handling and consent mode. | Geolocation rulesets: a default configuration plus regional rules, such as California, each pointing to its own configuration. |
| Categories | Cookie categories, each mapped to consent mode signals and used in Tag Manager triggers | Services grouped into categories, each service named in the data layer |
| Templates | Banner and preference center templates chosen per geolocation rule | One configuration per region, chosen in the ruleset |
| Test before live | A test script, not tied to a domain, published before the production script. Changes to cookies, templates or rules need a republish. | Changes saved as a draft and previewed on the site before publishing |
| Versions | Script versions with end-of-support dates, and an option to pin one version | Draft and live configuration |
In my experience, OneTrust is so configurable that it can be baffling. It has more templates, version control and environment options than most organizations need, and documentation in several layers that many teams never use. If you have a privacy team that wants that control, it's there. If you don't, plan for someone to own it.
Usercentrics is also very configurable. I liked its tools and the way it structures consent, and it's strong when you need a custom, more granular setup than CookieYes or Termly allow.
What happens to conversion counts
What moves your conversion counts is the settings you choose in either platform. Three matter most:
- Which regions start denied. Where the default is denied, fewer visitors are measured with cookies, and GA4 and Google Ads see fewer conversions directly. Since June 15, 2026, ad_storage alone decides whether GA4 data reaches Google Ads.
- Basic or advanced consent mode. In basic mode, Google's tags wait for consent. In advanced mode, they load and send cookieless pings while consent is denied, and Google Ads models conversions with an advertiser-specific model instead of a general one.
- Whether ad_user_data and ad_personalization update. Google says both need to be granted for personalized advertising. A rule that updates only ad_storage leaves remarketing and enhanced conversions short.
How the signals reach Google's tags is in Google Consent Mode and your CMP.
Where each fits
OneTrust is far more common on large sites. BuiltWith counted it on about 7,467 of the top 100,000 websites on November 5, 2026, against 1,338 for Usercentrics. Across US websites overall, the counts were about 149,000 and about 94,000.
OneTrust fits large organizations with a privacy team and many websites or apps. Usercentrics fits growing companies with several brands, regions or apps that want strong configuration without OneTrust's weight. The bigger your team and the more regions you cover, the more OneTrust's extra layers pay off.
Both price by traffic. OneTrust quotes by average daily visitors, and Usercentrics prices by monthly sessions. See the OneTrust pricing page and the Usercentrics pricing page.
Configurability, from my setups
Of the platforms I've set up, here's how much each lets you configure, most first: OneTrust, Usercentrics, Ketch, CookieYes, Kukie, then Cookiebot and Termly. It ranks how much you can change, and says nothing about which is better for your site.
Test it after setup
Whichever you choose, run the banner test in a browser before and after a choice, and again with Global Privacy Control on. The Measurement & Consent Audit runs that test for every key action, and I can set up or fix either platform.
