OneTrust licensing is the set of contract terms and usage measures under which OneTrust sells its cloud platform for privacy, consent and preferences, data use governance, third-party management, technology risk and compliance, and AI governance. Customers buy subscriptions to Cloud Services under the OneTrust Master Terms of Service together with an Order Form. The Order Form states the Cloud Services, the subscription term and the usage limits, and it prevails over the Master Terms if the two conflict.[1] Since the Spring 2025 release the Cloud Services have been sold as solution packages whose price is “based on usage meters that reflect the value delivered”.[4] OneTrust publishes no price list: its pricing page states, for each package, only what the price is based on, and quotes are issued on request.[5]
The documents are unusually specific about how usage is counted. The Product Usage Terms define each metric and set an Overuse Policy with a three-month grace period.[2] The contract is a standard form that OneTrust describes as reflecting a “one-to-many delivery model”, and its legal center states that OneTrust does not agree to termination for convenience.[6] This article summarises the structure; the following articles treat the Master Terms, the usage metrics and Overuse Policy, the solution packages and support in more detail.
Document set
OneTrust’s agreement is “made up of” the Master Terms together with any Order Forms and other documents incorporated by reference.[1] The documents that matter for licence management are:
| Document | What it governs | Version reviewed |
|---|---|---|
| Master Terms of Service | Provision and restrictions, fees, renewal, termination, liability, components, reseller orders | Version 5.1, effective 2026-03-23 [1] |
| Order Form | Cloud Services, subscription term, usage limits, contracting entity; prevails over the Master Terms | Per customer [1] |
| Product Usage Terms | Usage metrics for Cloud Services and the Overuse Policy | As of 2025-03-26 [2] |
| Product Descriptions (Solution Packages) | Packages, included products and metrics | As of 2025-03-30 [3] |
| Support Description | Essential, Plus, Premier and Signature Success Packages | Last updated 2025-09-02 [7] |
| Data Processing Addendum | Personal data processing, incorporated by reference | Current version at the legal center [1] |
The myOneTrust article that links the current Product Descriptions and Product Usage Terms also lists earlier versions, including the Product Usage Terms of August 26, 2024, so a customer on an older order may be governed by terms that differ from those summarised here.[8] The Master Terms say that a customer’s agreement renews on “OneTrust’s then current terms” available at the legal center, so the terms in force at renewal can differ from those at signature.[1]
What is licensed
The Master Terms define Cloud Services as the software-as-a-service products set out in the Order Form or otherwise provided by OneTrust, including updates and related hosting, content, APIs and tools, but excluding third-party services.[1] The customer’s right to use them is limited to one production tenant unless the Order Form says otherwise, and the use must be for the customer’s own “internal business or compliance purposes”.[1] The legal center explains that customers receive a single production tenant in which all subscribed services are made available, that some subscriptions include a non-production environment, and that further production and non-production environments can be bought.[6] Where a service is delivered with a component to install on the customer’s systems or websites, such as scripts, the customer receives a limited, revocable licence to use it for the Subscription Term and must remove it within thirty days afterwards, with a right for OneTrust to audit compliance.[1] See Component licence.
Solution packages and metrics
Under the Spring 2025 model the catalogue is arranged in solution packages, each with a metric or pair of metrics:[3][2]
| Package or product | Metric |
|---|---|
| Consent Management Platform | Average Daily Unique Visitors |
| Privacy Automation and Privacy Automation Suite | Admin Users and Privacy Assets |
| Tech Risk & Compliance | Admin Users and Assets |
| Third Party Risk Management and Third Party Management Suite | Admin Users and Third Parties; Annual Screening Volume for due diligence |
| AI Governance | Admin Users and AI Projects |
| Enterprise Data Discovery | Annual Scanned Volume |
| Universal Consent & Preference Management | Data Subjects |
The pricing page confirms the pairing in its own words: AI Governance is “based on admin users and AI inventory”, Privacy Automation “on users and privacy asset inventory”, Tech Risk & Compliance “on admin users and asset inventory”, Third-Party Management “on admin users and third-party inventory”, the Consent Management Platform “on average daily visitors aggregated across all channels and properties”, and Universal Consent & Preference Management “on total data subject profiles captured”.[5] The myOneTrust article groups these into two families: packages that support privacy, technology, third-party and AI programs are metered on Admin Users and the size of the inventory managed, and the consent and data use governance packages on visitors, data subjects or scanned volume.[4]
Capability access within a package
The myOneTrust article states that customers “can enable all capabilities in a package without incremental licensing, subject to meter limits”.[4] This is a change from module-based subscriptions, where usage meters applied to individual products: before Spring 2025 meters applied to individual products and after it they apply at the package level.[4] The same article says major new features and capabilities will be offered only in new solution packages, while other features are available to both module-based and solution-based subscriptions, and that existing customers who want to move should ask their account team for a proposal.[4] See Solution packaging.
Exceeding a limit
The Product Usage Terms permit OneTrust to monitor usage against each “Usage Limit”. If the customer exceeds a limit during the Subscription Term it must reduce usage or buy a higher tier. If neither happens within three calendar months, OneTrust may invoice an Additional Fee equal to the price difference to the next highest tier that would allow continued use, calculated pro rata from the start of the grace period to the end of the term.[2] The Master Terms separately let OneTrust collect Usage Data to monitor usage limits.[1] The myOneTrust article adds that exceeding licensed usage may require a contract amendment or upgrade.[4] If the Order Form specifies no limit for a metric, no limit applies to it.[2] See Overuse Policy.
Term, renewal and termination
The initial term is stated on the Order Form. The term of each Service other than Professional Services renews automatically for twelve months on OneTrust’s then-current terms, unless either Party gives notice of non-renewal at least thirty days before the end of the term.[1] Fees are payable within thirty days of the invoice date unless the Order Form says otherwise, and payment obligations are non-cancellable and non-refundable except as the agreement states.[1] Either Party may terminate for an uncured material breach after thirty business days’ notice or on the other’s insolvency; OneTrust may suspend access on fourteen days’ notice for non-payment, a breach of the restrictions, or to protect the Cloud Services; and after termination the customer may export Customer Content for sixty days.[1] Liability for each Party is capped at the fees paid and payable for the Services in the twelve months before the first event giving rise to a claim, with payment obligations, indemnities, intellectual property violations and wilful misconduct outside the cap.[1] The Master Terms article covers these clauses.
Channels
The Master Terms apply to purchases made through an Authorized Reseller under a separate Reseller Agreement. In that case the reseller issues invoices and receives payments, OneTrust may share information about use with the reseller, the reseller cannot make warranties for OneTrust, renewals follow the Order Form between OneTrust and the reseller, and the customer may choose another reseller or renew directly with OneTrust.[1] See Reseller order.
Evaluation and free services
The Master Terms define “Additional Services” as Free Services and non-production tenant environments. Such services may contain forward-looking code, are for evaluation only and are provided as-is, with OneTrust’s liability limited to $1,000.00 where an exclusion is prohibited.[1] The Support Description adds that Success Packages do not apply to Cloud Services provided as a free trial or a proof of concept.[7] See Additional Services.
Restrictions that affect scope
Among the restrictions in section 2 of the Master Terms, the customer may not permit third parties other than Authorized Users to access the Cloud Services, may not input Protected Health Information into them, and may not use them to build, train or configure any artificial intelligence model not provided by OneTrust.[1] Authorized Users are the customer’s and its Affiliates’ employees, contractors, vendors and consultants, so employees and contractors of the customer’s Affiliates may use the services as Authorized Users, while access by anyone outside those groups is a restricted use.[1] These restrictions apply regardless of the metric on the Order Form.
Out of scope
This article does not cover professional services statements of work, the Data Processing Addendum, OneTrust’s DataGuidance content licences beyond their listing as an add-on, marketplace listings, partner or reseller agreements, or any price. It does not address OneTrust products that are no longer sold, apart from the statement that module-based subscriptions coexist with solution packages for customers who have not moved.[4]