OneTrust in the Consent Gap Index
OneTrust is a consent management platform. It is the software that draws the cookie banner, stores the answer you give it, and passes that answer to the rest of the page. If you clicked a cookie dialog on a large company's website this year, there is a reasonable chance OneTrust drew it. In this index it is the most widely deployed consent platform of the nine recorded, appearing on 853 of the 5,294 sites measured, or 16.1 percent of the set.
The widest deployment of the nine platforms here
853 sites is rank 1 of the nine consent platforms in this index. That scale is the first thing worth knowing about OneTrust, because it changes what the rest of its numbers mean. A platform seen on a few dozen sites describes a niche; a platform seen on 853 describes a large slice of the commercial web that already decided it needed a banner. The sites in question are not a random sample of the 5,294 measured. They are, by construction, sites that expect visitors covered by consent law and that run a stack substantial enough to need managing. Everything below is a portrait of that group, not of the web at large.
What a typical OneTrust site carries
The median site running a OneTrust banner contacts 6 distinct companies, of which 1 is classified as a tracker, across 41 requests to third-party hosts. Among the nine consent platforms indexed here, that median request count ranks 3rd and the median company count ranks 5th — middle of the field on companies, toward the top on raw request volume. The gap between 6 companies and 41 requests is the ordinary shape of a modern page: a handful of parties, each of them talked to repeatedly. A single analytics vendor can account for a dozen calls on its own without any of them being visible to the person reading the page.
Early contact on 814 of 853 sites
On 814 of the 853 OneTrust sites, at least one third-party company was contacted inside the window before a banner answer could be registered. That is 95.4 percent, which ranks 7th of the nine platforms in this index — six platforms show a higher share, two show a lower one. The median OneTrust site had 5 companies contacted in that window. After the window closes, the median site adds no further companies at all: the figure recorded for companies contacted after the consent window is 0. Whatever a OneTrust site is going to load, it has largely loaded by the time the banner is answerable.
First contact lands at 681 ms
The median OneTrust site made its first third-party request 681 milliseconds after navigation began — the second-latest median of the nine platforms here. The fastest first contact recorded on any OneTrust site was 66 milliseconds. Two thirds of a second sounds like a delay, and on a fast connection it is roughly the time between clicking a link and seeing text appear. It is not, however, time in which a person can do anything. Reading a banner, locating the reject control and clicking it takes several seconds at minimum, so 681 ms is comfortably inside the stretch of a page load in which no answer can yet have been given.
Twelve of the 853, by name
The index keeps a named sample for every entity. On discord.gg, 7 companies were contacted and all 7 fell inside the early window, with first contact at 325 ms. netflix.com and spotify.com both show 6 of 6 inside the window, at 1,003 ms and 550 ms respectively. zoom.us shows 5 of 5 at 440 ms; intuit.com shows 9 of 9 at 795 ms. Not every site looks like that. epicgames.com contacted 6 companies with none of them in the early window and a first contact at 2,087 ms, the latest in this sample. cloudflare.com sits at the light end with 2 companies, both early, and cloudflare.net at 4 companies with 2 early. bit.ly shows 7 companies of which 5 were early. The spread across a dozen sites carrying the same banner software is wide enough that the banner alone predicts very little about the page behind it.
Reading these numbers correctly
The one comparison worth resisting is the causal one. A site running OneTrust is not heavier because it runs OneTrust; it runs OneTrust because it is the sort of operation that has a compliance team, an ad stack and European traffic. If you want to see the same measurement run against a page you are actually looking at, rather than one of the 5,294 in this snapshot, that is what the MurmStack extension does in the browser.
| Site | Companies | Before consent | First contact |
|---|---|---|---|
| cloudflare.com | 2 | 2 | 1242 ms |
| fastly.net | 7 | 3 | 670 ms |
| netflix.com | 6 | 6 | 1003 ms |
| cloudflare.net | 4 | 2 | 343 ms |
| spotify.com | 6 | 6 | 550 ms |
| zoom.us | 5 | 5 | 440 ms |
| workers.dev | 2 | 2 | 1063 ms |
| discord.gg | 7 | 7 | 325 ms |
| bit.ly | 7 | 5 | 920 ms |
| unity3d.com | 7 | 6 | 992 ms |
| intuit.com | 9 | 9 | 795 ms |
| epicgames.com | 6 | 0 | 2087 ms |
| Tool | Sites |
|---|---|
| OneTrust | 853 |
Questions
What does OneTrust do on a page?
It renders the consent banner, records the visitor's choice, and exposes that choice to the other scripts on the page so they can decide whether to run. The enforcement depends on how the rest of the site is wired to it, which varies from site to site and is not something this index measures.
Does a OneTrust banner mean the site loads less?
Not in this data. The median site carrying a OneTrust banner contacts 6 companies across 41 requests, and 814 of the 853 saw at least one company contacted before an answer could be registered. Selection explains most of that: banners appear on commercially heavy sites in the first place.
Why do some OneTrust sites show zero early contact?
Because no third-party company was contacted within the measured window. epicgames.com is the clearest example in the named sample: 6 companies contacted overall, none of them early, first contact at 2,087 ms. A slow-starting page produces this pattern whether or not it was designed to.
How many sites is this drawn from?
5,294 sites were measured in total for this snapshot, and 853 of them carried a OneTrust banner. That is 16.1 percent of the corpus, and rank 1 of the nine consent platforms recorded here.