Three CMPs, Three Different Bets
CookieBeam, Cookiebot, and OneTrust are three of the most frequently compared consent management platforms on the market right now. They all solve the same core problem: collecting and enforcing cookie consent in a way that satisfies GDPR, CCPA, and the growing list of global privacy regulations.
But they solve it very differently. OneTrust is the enterprise governance suite that happens to include a CMP. Cookiebot is the established mid-market player with per-domain pricing and deep EU compliance roots. CookieBeam is the newer, developer-friendly option with built-in server-side GTM hosting and flat-rate pricing.
This guide compares all three on the dimensions that actually affect your day-to-day: pricing, setup difficulty, consent mode support, server-side tagging, customization, and the things each platform does better than the other two. No rankings, no scores. Just the trade-offs so you can pick the one that fits.
Quick take
OneTrust if you're an enterprise with a procurement team and need a full privacy program (DSARs, assessments, vendor management) alongside your CMP. Cookiebot if you want a proven, regulation-first CMP with automatic cookie scanning and don't need server-side tagging. CookieBeam if you want Consent Mode v2 out of the box, built-in server-side GTM, and predictable pricing without per-subpage cost scaling.
Feature Comparison at a Glance
| Feature | CookieBeam | Cookiebot | OneTrust |
|---|---|---|---|
| Starting price | Free tier, paid from ~$9/mo | Free (1 domain, 50 subpages), paid from ~$14/mo | Free tier (limited), enterprise pricing on request |
| Pricing model | Flat per domain, unlimited pageviews | Per domain, tiered by subpage count | Tiered plans, custom enterprise quotes |
| Google Consent Mode v2 | Built-in, all plans | Supported, all plans | Supported via integration |
| TCF v2.2 | Supported | Supported (IAB-registered) | Supported (IAB-registered) |
| Server-side GTM | Built-in hosted sGTM add-on | Not included | Not included |
| Auto cookie scanning | Yes, scheduled Lambda-based scans | Yes, monthly automatic scans | Yes, with cookie classification |
| Microsoft Consent Mode | Clarity + Bing Ads support | Limited | Via custom integration |
| Meta Pixel consent | Built-in signal support | Via configuration | Via integration |
| Setup complexity | One script tag or GTM template | One script tag or plugin | Script tag + portal configuration |
| Banner customization | Visual editor, full CSS control, themes | Templates, color customization | Advanced templates, full CSS |
| Multi-language | 11 built-in, extensible | 47+ languages | 100+ languages |
| DSAR portal | Built-in hosted portal | Not included | Full DSAR workflow suite |
| Ideal for | Devs, SMBs, agencies, sGTM users | SMBs, EU-focused sites | Enterprises, legal/compliance teams |
Pricing: How the Costs Actually Work
CookieBeam
CookieBeam offers a free tier with one banner and basic features. Paid plans start around $9/month for Starter and scale to Professional, Business, and Enterprise tiers. Pricing is flat per domain with unlimited pageviews, which means your bill doesn't spike when traffic does. The optional server-side GTM add-on is priced separately by request volume.
For agencies managing multiple client sites, the per-domain model is straightforward: each domain gets its own banner, and costs scale linearly without subpage counting.
Cookiebot
Cookiebot's free tier covers one domain with up to 50 subpages. Paid plans start at around $14/month and scale based on the number of subpages your site has. This per-subpage pricing model can get expensive for large content sites, blogs, or e-commerce stores with thousands of product pages. A site with 5,000 subpages will pay significantly more than one with 500.
On the other hand, the scanning and compliance features are consistent across all paid tiers, so you're mostly paying for scale rather than feature gates.
OneTrust
OneTrust offers a free "Cookie Compliance" tier with basic functionality. Beyond that, pricing is opaque. Enterprise plans require a sales conversation, and the final cost depends on the number of domains, visitors, and which modules (CMP, DSAR, assessments, vendor risk) you bundle. Annual contracts starting at $500+/month are common for mid-size deployments.
If your organization already runs OneTrust for privacy assessments or DSAR workflows, adding the CMP module is a natural extension. If all you need is cookie consent, the price-to-feature ratio is hard to justify against focused tools like CookieBeam or Cookiebot.
Setup and Integration
CookieBeam: One Tag, Done
Setup is a single <script> tag in your site's <head>, or install the CookieBeam template from the Google Tag Manager gallery. The banner goes live immediately with sensible defaults. Consent Mode v2 signals fire automatically without extra configuration.
For teams that use server-side GTM, CookieBeam includes a managed sGTM hosting add-on. You don't need to provision your own Cloud Run instance or manage containers. The sGTM container is provisioned through the CookieBeam dashboard and wired into the consent flow.
Cookiebot: Script Tag + Dashboard
Cookiebot also uses a single script tag. After adding it, you configure your banner appearance and consent settings through Cookiebot's web dashboard. The initial scan runs automatically and categorizes cookies it finds. Cookiebot has mature WordPress, Shopify, and CMS integrations that make the initial install straightforward on common platforms.
Where it gets more involved is custom implementations: if you need to conditionally load scripts based on consent categories, you'll write your own JavaScript around Cookiebot's consent API.
OneTrust: Portal + Script + Configuration
OneTrust setup involves creating an account on the OneTrust portal, configuring your cookie categories, running a scan, customizing the banner template, and then adding a script tag to your site. The portal is powerful but has a learning curve. Expect to spend time understanding the domain grouping, geolocation rules, and template hierarchy before the banner works the way you want.
For teams with dedicated privacy engineers or legal ops, the depth is a feature. For a developer who wants consent working by the end of the day, it's overhead.
Google Consent Mode v2
All three platforms support Google Consent Mode v2, but the depth of integration varies.
CookieBeam fires Consent Mode v2 signals (ad_storage, analytics_storage, ad_user_data, ad_personalization) automatically on every consent action. No manual gtag('consent', 'update', ...) calls needed. It also supports Microsoft Consent Mode (Clarity and Bing Ads) and Meta Pixel consent signaling out of the box.
Cookiebot has solid Consent Mode v2 support. Their script integrates with Google's consent API and fires the correct signals. It's been in the ecosystem longer, so you'll find more community guides and Stack Overflow answers for edge cases.
OneTrust supports Consent Mode v2, but it typically requires additional configuration in the OneTrust portal and may need custom JavaScript for advanced consent signal mappings. The integration works, but it's not as turnkey as the other two.
Server-Side GTM
This is where the three platforms diverge most sharply.
CookieBeam is the only one of the three that offers built-in server-side GTM hosting. You can provision an sGTM container directly from the CookieBeam dashboard, get a custom subdomain for first-party tagging, and manage it alongside your consent configuration. This matters because server-side tagging is increasingly required for accurate conversion tracking as browsers restrict third-party cookies.
Cookiebot and OneTrust don't include sGTM hosting. If you need server-side tagging, you'll provision your own container on Google Cloud Run (or another provider), manage the infrastructure separately, and wire it into your consent flow manually. That's fine if you already have a cloud ops team, but it's another moving part for smaller teams.
If server-side tagging is on your roadmap, CookieBeam's bundled approach saves you from running a separate infrastructure project.
Banner Customization and Design
CookieBeam provides a visual banner editor with live preview, multiple theme support, and full CSS control. You can customize colors, layout, button text, and positioning. The banner supports A/B testing different designs against each other to optimize consent rates without resorting to dark patterns.
Cookiebot offers template-based customization with color and text controls. The banner looks clean out of the box and covers the standard layouts (bar, popup, wall). Advanced CSS customization is possible but requires overriding Cookiebot's default styles.
OneTrust has the most powerful template system of the three, with granular control over every element. However, the configuration lives in OneTrust's portal, which means changes require navigating a complex admin interface. Enterprise teams with dedicated privacy engineers appreciate the depth; developers working solo may find it slower.
Where Each Platform Is the Strongest Choice
Choose OneTrust if...
- You're an enterprise that needs cookie consent as part of a broader privacy program (DSARs, privacy impact assessments, vendor risk management)
- Your legal team wants a single platform for all privacy operations
- You have dedicated privacy engineers to manage the configuration
- You operate in highly regulated industries (finance, healthcare) where audit trails and enterprise SLAs matter
- Budget isn't a primary constraint, and you value vendor consolidation
Choose Cookiebot if...
- You want a proven, regulation-first CMP with strong EU compliance credentials
- Your site runs on WordPress, Shopify, or another platform with a mature Cookiebot integration
- You need 47+ languages and the widest localization coverage
- You prefer a well-established vendor with years of regulatory track record
- Server-side tagging isn't part of your stack
Choose CookieBeam if...
- You want Consent Mode v2, Microsoft Consent Mode, and Meta consent signaling working out of the box
- Server-side GTM is on your roadmap and you don't want to manage Cloud Run yourself
- You prefer flat, predictable pricing that doesn't scale with subpage count
- You're a developer or agency that values quick setup and API-first design
- You want banner A/B testing and consent analytics built into the same dashboard
- You need a built-in consent management platform with DSAR portal included
What About TCF Compliance?
All three platforms support IAB's Transparency and Consent Framework (TCF) v2.2, which is required for programmatic advertising in the EU. Cookiebot and OneTrust are both registered CMP vendors in the IAB's Global Vendor List. CookieBeam supports the TCF protocol and integrates with the GVL.
If programmatic advertising revenue is a significant part of your business, verify that your specific ad tech partners are in the vendor list of whichever CMP you choose. The TCF implementation details (vendor list loading, purpose mapping, legitimate interest signals) work differently across all three.
For most sites that use Google Ads and standard analytics, any of the three will handle TCF correctly. The differences matter more for publishers with complex ad stacks.
Migration Considerations
Switching between CMPs is easier than most vendors suggest. The core consent data (what a visitor chose) is stored in browser cookies and localStorage. When you swap the CMP script, returning visitors will see the banner again and make a fresh choice. This is actually fine from a compliance perspective: it gives visitors a clean opportunity to re-consent under the new tool's categories.
The real migration effort is in your tag configuration. If you've built conditional tag firing rules around one CMP's consent API (e.g., Cookiebot's CookieConsentChanged event or OneTrust's OptanonActiveGroups), those need to be updated to the new platform's API. CookieBeam uses standard Consent Mode signals, so if your tags already rely on Google's consent API rather than CMP-specific events, the switch is minimal.
Plan for a 30-minute to 2-hour migration for most sites, depending on how tightly coupled your tag management is to the old CMP.
Frequently Asked Questions
Can I use CookieBeam, Cookiebot, or OneTrust on multiple domains?
Yes, all three support multi-domain setups. CookieBeam and Cookiebot price per domain. OneTrust bundles domains into enterprise agreements. CookieBeam's flat per-domain pricing means large sites with many subpages don't pay more than small ones on the same plan.
Which CMP is best for Google Consent Mode v2?
All three support Consent Mode v2. CookieBeam fires the signals automatically with zero extra configuration. Cookiebot has mature support with extensive documentation. OneTrust supports it but may require manual configuration for advanced setups. For the fastest time-to-compliance, CookieBeam and Cookiebot are both strong choices.
Do I need server-side GTM if I use a CMP?
You don't need it, but it improves conversion tracking accuracy as browsers restrict third-party cookies. If server-side tagging is on your roadmap, CookieBeam's built-in sGTM hosting simplifies the setup. With Cookiebot or OneTrust, you'll need to provision and manage sGTM infrastructure separately. See our sGTM setup guide for details.
Is OneTrust overkill for a small website?
For most small to mid-size websites, yes. OneTrust's strength is enterprise privacy program management, not lightweight cookie consent. If you only need a cookie banner and consent signals, CookieBeam or Cookiebot will get you compliant faster and at a lower cost. OneTrust makes sense when you also need DSAR automation, privacy impact assessments, and vendor management.
How long does it take to switch from one CMP to another?
Most migrations take 30 minutes to 2 hours. The main work is swapping the script tag and updating any tag management rules that reference the old CMP's consent API. If your tags use Google's standard Consent Mode signals rather than CMP-specific events, the switch is even faster.
The Bottom Line
There's no single "best" CMP. The right choice depends on what you're optimizing for.
OneTrust is the right tool when cookie consent is one module in a broader enterprise privacy program. You're paying for the platform, not just the banner.
Cookiebot is a solid, proven choice for EU-focused sites that want reliable compliance without server-side complexity. Its per-subpage pricing can sting on large sites, but the scanning and categorization are mature.
CookieBeam is built for teams that want consent, analytics, and server-side tagging in one place. If you're a developer, agency, or growing SaaS that wants Consent Mode v2, Microsoft and Meta consent signals, and optional sGTM hosting without managing extra infrastructure, it's purpose-built for that workflow.
Try the one that matches your stack. All three offer free tiers or trials, so you can test before committing.