OneTrust Consent & Preferences
Collect it, and prove it. A click is not a consent record — OneTrust Consent & Preferences captures consent across every channel, honours withdrawal, and keeps the timestamped record that proves what a person actually agreed to.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Quick answer
The OneTrust platform family
This page covers Consent & Preferences — the customer edge. The rest of the platform:
Quick facts
30-second orientation- Product
- Consent & Preferences — the customer edge
- What it does
- Collects consent, honours withdrawal, keeps the record
- Inside it
- Universal Consent & Preference Mgmt, plus the CMP
- Where it sits
- In your web, app and marketing stack
- India
- DPDP consent notice and withdrawal are explicit duties
- Honest scope
- A banner is the visible 10% — the record is the product
- Pricing
- Quote-only — no published price
- In India via
- TechBag — INR/GST, scoping and support
Understand consent management before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is OneTrust Consent & Preferences?
Consent captured, honoured and proved — across web, app and marketing, with purpose-level preferences, a withdrawal path, and a timestamped record of what was agreed.
A banner vs a consent record — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | A banner that sets a cookie | Consent & Preferences (OneTrust) |
|---|---|---|
| What you have | A banner that sets a cookie | A record of what was agreed, and when |
| Granularity | One blanket yes | Purpose-level choices a person can change |
| Withdrawal | An unsubscribe link, maybe | As easy as consent — a DPDP requirement |
| Downstream | The choice stops at your database | Propagated to marketing, CDP and analytics |
| When challenged | An assertion | Evidence with a timestamp and notice version |
| What it is NOT | — | Not legal advice on your lawful basis |
It records consent — it does NOT decide whether consent is the right legal basis for your processing. That is your counsel's judgement. And it cannot cover a channel nobody declared.
The four pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Collection at the edge
Consent is captured wherever you meet a person — website, app, form, call centre. The design question is coverage: an unowned channel is the gap a regulator finds.
The preference centre
A preference centre holds purpose-level choices people can change — this purpose yes, that one no. Under DPDP purpose limitation, granularity is required.
The consent record
What was shown, agreed, when and under which notice version — the proof a homegrown banner can’t produce: it collects a click but not what it meant.
Downstream enforcement
A withdrawal that never reaches your marketing platform, CDP and analytics isn’t a withdrawal. Mapping every downstream consumer is the real work.
One consent record from every channel — preferences held granularly, withdrawals enforced in the downstream tools.
Six capabilities. Collect, record, propagate.
OneTrust Consent & Preferences is where the programme meets your customers — capture, withdrawal and the rest of the OneTrust portfolio.
Know what is actually running
Scans the site for cookies and trackers so your notice is honest. Third-party tags added by marketing are the usual surprise.
Collect across every channel
Web, app, forms and offline capture feed one record. An uncovered channel is a gap, however good the banner looks.
Granular, and changeable
Purpose-level choices people can revisit. DPDP requires withdrawal as easy as consent — not a preference centre three clicks deep.
The record that survives a challenge
Timestamp, notice version, what was presented and what was agreed. Without this a consent programme is an assertion; with it, it is evidence.
Push the choice downstream
Consent and withdrawal reach the marketing platform, CDP, analytics and ad tools — where most implementation time goes.
Re-consent when the terms change
When the notice changes materially, versioning shows who must be asked again — unanswerable from a homegrown banner.
Watch the platform in action
The platform demonstrated, and what changed in the 2026 releases.
OneTrust Privacy Automation solution demo
The privacy core that consent records feed into.
Winter Release 2026: AI Assessment Automation
What changed across the platform this release.
Spring Release 2026 — Privacy Automation features
Feature detail from the spring release.
Want a live, India-context walkthrough for your environment?
Book a guided demo →A banner shows something. A record proves it.
Here’s what genuinely sets it apart — and exactly where it stops.
The banner is the visible ten per cent
Most organisations that think they have solved consent have solved the banner. The obligation is to show what a specific person saw, agreed to, when and under which notice version — and prove it months later. A homegrown banner can’t, and the gap usually surfaces during a regulator’s enquiry.
DPDP makes withdrawal as easy as consent
India’s Digital Personal Data Protection Act requires a clear notice, purpose limitation and a withdrawal path as easy as giving consent. A preference centre three clicks into a footer fails that, as does a withdrawal that never reaches the marketing platform. The Rules notified on 13 November 2025 set a timeline for all of it.
Enforcement is where implementations actually fail
Collecting consent is the easy half; making it stick in marketing automation, the customer data platform, analytics, ad pixels and internal systems is the hard half. A withdrawal that misses one isn’t a withdrawal. TechBag maps every downstream consumer during evaluation, because that sets the timeline and no demo shows it.
What it does not do
This module records and propagates consent. It doesn’t decide your legal basis, write your notice or make collection lawful — that is your counsel’s call — and it can’t cover a channel nobody told it about. What it delivers is consent that is provable, granular and enforced downstream, where organisations usually fail.
The numbers behind the platform
What your consent rollout looks like
Inventory the channels
List every place you collect personal data — site, app, forms, call centre, offline. An unlisted channel stays uncovered.
Scan what is actually running
Cookies and trackers on the site, including third-party tags marketing added. You can’t write an honest notice about unfound scripts.
Design the preference centre
Purpose-level granularity and withdrawal as easy as consent — DPDP requires that parity, so a buried footer link fails.
Wire the downstream systems
Marketing automation, CDP, analytics, ad tools. This is the real project: a withdrawal that does not reach them all is not a withdrawal.
Test with a real withdrawal
Withdraw consent for a test identity and verify every downstream system stops — demos never show marketing’s newest tool.
Version the notice
When terms change materially, versioning shows who to ask again — a question a homegrown banner can’t answer.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We had a banner and thought consent was handled — until we couldn’t prove what one customer agreed to in 2024.”
“DPDP requiring withdrawal to be as easy as consent forced a redesign of our preference centre and marketing stack.”
“Solid platform. Budget for integration — capture went in quickly; wiring every downstream system took far longer.”
“It does what it says, but we could not get a straight price without a full sales cycle, and nothing public was close to our eventual quote.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the consent management market — tap any vendor to see why it sits where it does.
TechBag Consent Management Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Deepest consent record and propagation.
Consent-Record Depth × Propagation
The grid nobody publishes — depth of the consent record vs how far the choice actually propagates.
Purpose-level, versioned, propagated downstream.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Consent & Preferences vs the alternatives
Against a data-first platform, a homegrown banner, and doing nothing — on proof, granularity and propagation.
| Dimension | OneTrust Consent | Securiti | A homegrown banner | Doing nothing |
|---|---|---|---|---|
| Proof of consent | Timestamped record | Yes | A click | None |
| Granular preferences | Purpose-level | Yes | Rarely | None |
| Downstream propagation | Integrations | Yes | Manual | None |
| DPDP withdrawal parity | Designed for it | Yes | Usually fails | Fails |
| Cost | Quote-only | Quote-only | Engineering time | Free |
| Does it decide your legal basis? | No — by design | No | No | No |
Which approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Consent & Preferences if…
- You need to PROVE what a specific person agreed to, not just that a banner appeared
- DPDP withdrawal parity applies to you and a footer link will not meet it
- Consent has to reach marketing, CDP and analytics — not stop at your own database
- You have mapped, or will map, every channel that collects personal data
A homegrown banner may be enough if…
- You collect very little personal data through very few channels, and can evidence it
- Nobody downstream acts on consent, so propagation is not a problem you have
- Be honest about this: most organisations that believe it discover otherwise under enquiry
Do not buy this expecting…
- Legal advice — whether consent is your lawful basis is a judgement your counsel makes
- Coverage of channels nobody told the implementation about; the scan sees the site, not your app SDK
- A published price; there is none, and the quote depends heavily on scope
What does an unprovable consent cost you?
Drag the sliders (monthly consent interactions; IT-hour cost as a loaded rate). Estimates model the engineering and legal time spent maintaining a homegrown banner and answering challenges without a record — the avoided regulatory exposure is the larger, unpriced win. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models your actual environment and modules.
Three ways to consume it
Quote-only — OneTrust publishes no price. TechBag scopes the channels and downstream systems, then quotes in INR with GST.
Consent & Preferences
Best for provable consent
- Capture across web, app and marketing
- Purpose-level preference centre
- Timestamped record with notice version
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ the wider platform
Best across several obligations
- Consent records feed privacy operations
- One inventory under every module
- Only pays off beyond a single obligation
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Have you listed EVERY channel that collects personal data — including the mobile app SDK and offline capture?
Can you produce what a specific person agreed to, when, and under which notice version? If not, that is what you are buying.
Is withdrawing as easy as consenting? DPDP requires it explicitly, and a footer link three clicks deep does not qualify.
Which systems act on consent — marketing, CDP, analytics, ad tools? Every one must receive the withdrawal.
Do you know every third-party tag on your site? Marketing-added scripts are the usual surprise in the first scan.
Is consent even the right basis for this processing? The platform records it; your counsel decides it.
When the notice changes materially, who needs asking again? Versioning answers this; a banner cannot.
Can you approve without a list price? There is none. Fix the metering metric in the FIRST contract.
Questions buyers ask
Ready to evaluate OneTrust Consent & Preferences?
Scope the channel inventory and the downstream systems that act on consent, or let a TechBag advisor test your current banner against what DPDP actually requires.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.