OneTrust solution packages are the units in which OneTrust sells its Cloud Services under the Spring 2025 packaging model. The Product Descriptions document lists each package with a service description, a usage metric and the products it includes, followed by standalone and add-on products.[1] The myOneTrust page that links the current Product Descriptions dates them “as of March 30, 2025”.[5] OneTrust says it moved from selling individual modules to solution-based packaging because module purchases led to “complexity and feature-gated pricing that limited value”, and that the packages are “aligned to key use cases”.[3] The pricing page shows the same structure, with six solution groups on its navigation: AI Governance, Consent & Preferences, Data Use Governance, Privacy Automation, Tech Risk & Compliance and Third-Party Management.[4]
OneTrust publishes no prices. Each package on the pricing page carries a “Get Pricing” request, and the page states only the basis on which it is priced.[4]
The package model
The myOneTrust article describes the model in four points.[3]
- Meters. “Solution package pricing is based on usage meters that reflect the value delivered. Customers gain access to all included capabilities and pay according to their usage volume.”
- Meter families. Packages for privacy, technology risk, third-party management and AI governance use Admin Users and the size of the inventory managed (for example Assets, Third Parties or AI Projects). The consent and data use governance packages use Average Daily Unique Visitors for the Consent Management Platform, Data Subjects for UCPM and annual volume scanned for Enterprise Data Discovery.
- Enabling capabilities. “Customers can enable all capabilities in a package without incremental licensing, subject to meter limits.”
- Version differences. Before Spring 2025 usage meters applied to individual products; since then they apply at the package level.
Module-based subscriptions continue for customers who have not moved. The article says module-based subscriptions focus on individual capabilities, while solution packages bundle the capabilities of a complete end-to-end use case, that major new features will be offered only in the new packages, that all other features are available to both kinds of subscription, and that an existing customer who wants to move should contact its account executive, renewal manager or customer success manager for a customised proposal.[3] See Solution packaging.
Solution packages
The Product Descriptions list the following packages.[1]
Consent Management Platform
The Consent Management Platform (CMP) is “a suite of Cloud Services to capture and manage consent collection across web cookies, mobile apps and CTV devices”. The metric is Average Daily Unique Visitors (ADUV) and the included products are Cookie Consent, Mobile App Consent, CTV Consent, Consent Rate Optimization and Privacy Notice Management, which is “only included if ADUV is 50k or more”.[1] The pricing page offers CMP “Base” and “Suite” packages priced on average daily visitors aggregated across all channels and properties.[4] The ADUV definition averages unique daily visitors across web, mobile and CTV, aggregated across properties, over a period of up to 365 days.[2]
Privacy Automation and Privacy Automation Suite
Privacy Automation enables “the automation of internal privacy operations” and simplifies regulatory research. Its metrics are Admin Users and Privacy Assets and its included products are Data Mapping Automation, Assessment Automation and DataGuidance Research. The Privacy Automation Suite adds DSR Automation, Privacy Incident Management and Compliance Automation, and lists “privacy-related frameworks (for Compliance Automation only)” as an additional metric.[1] Compliance Automation within the Suite is limited to two Admin Users and to the privacy-related frameworks that OneTrust identifies; additional users or non-privacy frameworks need a standalone Compliance Automation subscription or Tech Risk & Compliance.[2] The pricing page says Privacy Automation is priced “based on users and privacy asset inventory”.[4]
Third-party packages
Third Party Risk Management covers the third-party lifecycle “from onboarding, assessments, risk mitigation and contracting”; its metrics are Admin Users and Third Parties and its products Third Party Risk Management and Third Party Risk Exchange. The Third Party Management Suite adds Third Party Due Diligence, which includes Dow Jones Screening, and the Annual Screening Volume metric for Third Party Due Diligence only.[1] The pricing page says Third-Party Management is priced “based on admin users and third-party inventory”.[4]
Tech Risk & Compliance
Tech Risk & Compliance helps “automate and scale governance, risk and compliance programs”. Its metrics are Admin Users and Assets, and its products are IT Risk Management, Compliance Automation, Enterprise Policy Management, GRC Incident Management and Questionnaire Response Automation.[1] The pricing page describes it as priced “based on admin users and asset inventory”.[4]
Standalone products and add-ons
The Product Descriptions also list products with their own metric, each marked as standalone or add-on.[1]
| Product | Metric | Standalone or add-on |
|---|---|---|
| AI Governance | Admin Users; AI Projects | Standalone |
| Compliance Automation | Admin Users; Assets | Add-on |
| DataGuidance Research | Authorized Users | Add-on |
| Enterprise Data Discovery | Annual Scanned Volume | Standalone |
| Third-Party Due Diligence | Admin Users; Third Parties; Annual Screening Volume | Standalone |
| Universal Consent & Preference Management | Data Subjects | Standalone |
The Product Usage Terms refine the DataGuidance Research metric: if it is purchased as part of the Privacy Automation Suite, Admin Users apply; otherwise the metric is Authorized Users.[2] The pricing page says AI Governance is priced “based on admin users and AI inventory” and UCPM “based on total data subject profiles captured”.[4]
What the package model means for compliance
The sources support several observations for a licence manager.
- Capabilities are not separately licensed within a package. The packaging article says all included capabilities can be enabled without incremental licensing, “subject to meter limits”.[3] Compliance therefore turns on the meter, not on a module list, but only for packages the customer holds: a capability that belongs to another package is a separate purchase, as the Compliance Automation limit in the Privacy Automation Suite shows.[2]
- Two metrics, one of them an inventory. Admin Users counts people by role; the second metric counts records. A customer can therefore stay within the Admin User count while exceeding the inventory limit by adding assets, third parties or AI projects, and the reverse.[2]
- Meter limits are on the Order Form. The Product Usage Terms say that if no usage limit is specified on the Order Form, no limit applies to that metric.[2]
- Legacy and new subscriptions coexist. An organisation may hold some module-based subscriptions and some solution packages, with different meters and, depending on the date, different versions of the Product Usage Terms.[3][5]
- Excess usage is addressed by the Overuse Policy. The customer must reduce usage or buy a higher tier within three calendar months, or OneTrust may invoice the price difference to the next tier pro rata.[2]
Contract context
Packages are sold under the Master Terms and an Order Form. The Order Form states the Cloud Services, the term and the limits, and prevails over the Master Terms.[6] Each service renews automatically for twelve months on OneTrust’s then-current terms unless either Party gives notice of non-renewal thirty days before the end of the term, so a move from modules to packages generally takes place through a new Order Form or a renewal proposal.[6][3] The Master Terms article covers the terms in detail.
Out of scope
This article does not cover prices, quantities or tiers, which are quoted on request; the module-based product list that existed before Spring 2025; the content of DataGuidance Research beyond its place as an add-on; professional services; or the support tiers (see OneTrust support and Success Packages). It does not describe ESG-related products, since none appears in the Product Descriptions or on the pricing page reviewed.