Buyer's Guide: Consent and Privacy Management Software

Executive Summary

Consent management software shows website and app visitors a banner, records whether they agree to cookies and tracking, and stops tags from running until the answer allows them. IAB Europe describes consent management platforms (CMPs) as software or solution providers that develop notices, such as cookie banners, to inform users and capture their preferences on the processing of their personal data.

Privacy management software runs the rest of a privacy program: the record of processing activities, privacy and data protection impact assessments, and the requests people make to see, correct or delete their data. Most organizations need both, and most of the vendors in this guide sell both.

Choose by your hardest problem. If it is tags and consent signals on websites and apps, weight scanning, blocking and the price per visitor. If it is finding personal data across many systems to answer requests and keep records, weight discovery and connectors. If requests already reach engineers every week, weight automated fulfillment inside your own systems.

Why Consent and Privacy Requests Carry Legal Deadlines

The rules for consent are set in law. The ePrivacy Directive requires Member States to ensure that storing information, or gaining access to information already stored, in the terminal equipment of a subscriber or user is allowed only if that subscriber or user has given consent, having been provided with clear and comprehensive information. The GDPR defines consent as any freely given, specific, informed and unambiguous indication of the data subject's wishes, given by a statement or by a clear affirmative action. Under the GDPR, the data subject has the right to withdraw consent at any time, and it must be as easy to withdraw as to give consent.

In the UK, the ICO states that you must tell people if you set cookies, clearly explain what the cookies do and why, and get the user's consent, which must be actively and clearly given. The ICO states that an exemption applies where a cookie is strictly necessary to provide a service the user requested, and that cookies that are helpful or convenient but not essential still require consent.

The California Attorney General lists the CCPA rights to know about the personal information a business collects, to delete it with some exceptions, and to opt out of its sale or sharing, including via the GPC. California voters approved Proposition 24, the CPRA, in November 2020; it amended the CCPA and, from January 1, 2023, added rights to correct inaccurate personal information and to limit the use and disclosure of sensitive personal information. The California Attorney General describes the GPC as a 'stop selling or sharing my data switch' in some browsers or browser extensions, and states that under law covered businesses must honor it as a valid consumer request to stop the sale or sharing of personal information.

Requests come with deadlines. The GDPR requires the controller to provide information on action taken on a data subject's request under Articles 15 to 22 without undue delay and in any event within one month of receipt, a period that may be extended by two further months where necessary. The California Attorney General states that businesses must respond to a request to know within 45 calendar days, and can extend that deadline by another 45 days (90 days total) with notice.

Records and assessments are obligations too. The GDPR requires each controller to maintain a record of processing activities under its responsibility. Where processing is likely to result in a high risk to the rights and freedoms of natural persons, the GDPR requires the controller to assess its impact on the protection of personal data before the processing starts. The California Privacy Protection Agency has finalized regulations on automated decisionmaking technology, privacy risk assessments and cybersecurity audits, effective January 1, 2026, with certain compliance deadlines phased in beginning in 2027 and 2028.

Consent Management vs Privacy Management Software: What Is the Difference?

Consent management software works on websites, apps and connected TV. It scans for cookies and tags, shows a banner that fits the visitor’s location, records the choice, and tells each tag what it may do. Privacy management software works inside the business. It keeps the record of processing activities, runs impact assessments, and takes each data subject request from intake through identity checks to the systems that hold the data.

Advertising and analytics tags now read the consent signal. Google's EU user consent policy requires those whose agreement or Google product incorporates it to ensure that certain disclosures are given to, and consents obtained from, end users in the European Economic Area, the UK and Switzerland. When seeking that consent, Google requires you to retain records of consent given by end users and to provide clear instructions for revoking it. Google states that consent mode has two implementations: basic, which blocks tags until consent, and advanced, which loads tags with default settings and adjusts their behavior based on consent.

Ad technology vendors also read a standard consent string. IAB Europe states that TCF v2.3 was launched in April 2025 and that TCF participants had until February 28, 2026 to adopt it. A consent product that serves publishers in Europe needs to support the current version.

Privacy management turns on one question: where does each person’s data live? Every access or deletion request, every record of processing and every impact assessment depends on the answer. Products answer it in three ways: questionnaires sent to system owners, connectors to known business applications, or scans of the data itself. Most programs use a mix.

How do you evaluate Consent and Privacy Management Software?

Test consent on your own properties. Scan every domain and app, including pages behind a login, and compare the tracker list with what your marketing team believes is installed. Check that banners change by location, that the Global Privacy Control signal is honored where the law requires it, and that Google consent mode and the IAB framework receive the right signal.

Test requests end to end. Submit an access request and a deletion request as a customer would, and follow each one through identity verification, discovery, deletion or export, and the response. Count the manual steps and the systems that needed a person to act.

Test discovery where your data is messiest: a legacy database, a heavily customized SaaS app, a file share. Ask what each product finds with a connector, what it finds by scanning, and what still depends on a questionnaire to the system owner.

Check where personal data goes during all of this. Ask whether the product classifies data in your environment, through a gateway you host, or in the vendor’s cloud. For regulated data, the answer can decide the purchase.

Vendors in Consent and Privacy Management Software

Representative vendors include BigID, DataGrail, Ketch, OneTrust, Osano, Securiti (Veeam), Transcend and TrustArc. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors

The approaches below follow two questions: where does the product start, and how much of the privacy program does it run? Two vendors share the discovery-led approach.

The first approach sells privacy as modules of a larger trust and risk platform. OneTrust's banner templates support more than 250 languages and geolocation rules that display different banners and consent models by region, country, or state. OneTrust extends cookie consent to mobile app consent and to OTT and CTV consent. OneTrust automates request intake, identity verification, personal data discovery and deletion, redaction, and secure response to fulfill DSR requests. OneTrust gives a central view of personal data processing across data assets, processing activities and vendors, and auto-generates the record of processing activities (RoPA).

Program management with regulatory research starts from the law and works toward the systems. TrustArc offers access to 1,229+ full-text laws analyzed by its in-house experts, with summaries and comparisons across 244+ global jurisdictions. TrustArc offers 10+ ready-to-use privacy assessments, including DPIAs, PIAs, vendor risk, transfer impact assessments and AI risk reviews. TrustArc's Individual Rights Manager supports jurisdiction-aware handling of access, deletion, correction, portability, restriction, objection and applicable opt-out requests, with 300+ no-code integrations that can help locate data and trigger downstream actions in connected systems. TrustArc says you can optimize digital experiences to support GPC browser signals, Do Not Sell or Share opt-outs, IAB TCF 2.2, IAB GPP and Google Consent Mode. TrustArc has been acquired by Main Capital Partners, a private equity firm based in The Hague, Netherlands.

Discovery-led platforms find personal data first and run privacy work from what they find. BigID states that it discovers and classifies sensitive data at petabyte scale. BigID automates DSARs, PIAs, RoPA, consent, retention and compliance workflows using live data intelligence. BigID's cookie consent automation supports GDPR, CPRA, Law 25, LGPD, GPC, IAB TCF 2.2 and Google Consent Mode v2. BigID states that it never copies or moves data to find, classify or protect it.

Securiti states that it can automatically find all personal data of an individual across hundreds of structured and unstructured data systems, building real-time people data graphs. On December 11, 2025, Veeam announced the completion of its acquisition of Securiti AI. Veeam announced the Veeam DataAI Command Platform on May 12, 2026. Veeam describes the DataAI Command Platform as the result of its acquisition of Securiti AI.

Privacy infrastructure for engineering teams connects to the company’s own systems and carries out requests there. Transcend verifies each requester, then executes access, deletion and opt-out requests across connected systems, including vendors with no API. Sombra, the containerized part of Transcend that connects to your data, can be self-hosted, and when it is, Transcend's cloud has no access to your data systems. Transcend states that data is encrypted with AES-256 before it leaves your firewall. Transcend's Airgap is a script that intercepts and blocks tracking events before they fire when consent is needed. Transcend logs every consent choice, including Do Not Train signals, with a timestamp and full audit trail.

Consent and data permissioning treats each consent as a record that downstream systems must follow. Ketch records every consent with its purpose, legal basis, jurisdiction and identity. Ketch offers age gating for minors, one-step Do Not Sell compliance and native SDKs for iOS, Android and React. Ketch automates privacy rights requests from intake to fulfillment, with enforcement that reaches historical data across 1,000+ systems, apps and models. Ketch's data classification runs in the customer's own environment, labeling databases and warehouses such as Snowflake, Postgres and S3 without exposing or extracting raw data.

SaaS-focused privacy operations start from the business applications a company already uses. DataGrail states that its AI identifies known use cases and processing risks across 2,000+ business apps through the DataGrail Intelligence Library, with no scanning required. DataGrail generates and maintains audit-ready Records of Processing Activities with its AI agent. DataGrail's Smart Verification uses pre-existing data to authenticate user identities. DataGrail has been confirmed as a Google CMP Partner with Gold Status. DataGrail's consent banner deploys through a Google Tag Manager integration or a direct embed.

Packaged privacy for smaller teams sells a ready-made program with self-service entry plans. Osano provides pre-built rule sets for 95+ regulations in 50+ countries to keep banners compliant. Turning on Support Global Privacy Control (GPC) in Osano's cookie consent settings lets Osano detect and apply GPC signals according to jurisdiction-specific rules. Osano states that if you incur a fine while managing subject rights requests with Osano workflows and processes, it will pay.

Eight vendors are named across seven approaches; BigID and Securiti share the discovery-led one. All eight held this guide’s evaluation in the previous edition and were kept, and the approaches were written before any of them was placed. No row is for sale. The roster check for this edition covered 16 vendors, including consent specialists and privacy tools for developers, and any of them can present its own product in the Spotlight below.

How Is Consent Management Software Priced?

Consent management is usually priced on traffic. Privacy management is priced on users, the systems or data covered, and the modules bought. Model your own visitors, domains, systems and request volume in each vendor’s unit before comparing totals.

Some vendors publish their consent prices. Ketch lists a Free plan at $0 for up to 5k unique website visitors a month, Starter at $150 a month for up to 30k, Plus at $499 a month for up to 100k, and custom pricing for Pro. Osano lists a Free consent plan at $0 a month for 1 domain and 5,000 monthly visitors, and a Plus plan at $199 a month for 3 domains and 30,000 monthly visitors.

Larger platforms quote, and say what the quote counts. OneTrust prices its Consent Management Platform (CMP) Base package on average daily visitors aggregated across all channels and properties. OneTrust prices its Privacy Automation Base package on users and privacy asset inventory. BigID offers Express, Business and Enterprise packages, sized to a first project or a whole estate. Securiti sells its platform as modules procured by use case.

The larger cost is often internal. Each connected system needs an owner who confirms what the platform found and completes deletion tasks the platform cannot. Discovery scoped to a pilot also understates the bill once every database and warehouse is in scope. Ask for a written quote at your current traffic and request volume, and at twice both.

How long does implementation take for Consent and Privacy Management Software?

Consent goes live first because it touches every visitor and is visible to regulators. Requests and data mapping take longer because each system needs an owner and a connection.

What should you ask vendors about Consent and Privacy Management Software?

Ask each vendor to answer in writing and to demonstrate on your own sites, systems and test identities.

Related Resources