Ketch

What it is

Ketch is a privacy platform built around one job: capturing a consumer’s consent or opt-out once and enforcing it everywhere that person’s data goes. It was founded in 2020 by Tom Chavez and Vivek Vaidya out of their super{set} startup studio and raised $43 million in two 2021 rounds led by CRV and Acrew Capital. The core product is a consent management platform (banners, preference center, law templates, tracker scanning, tag orchestration and consent records). On top of that it sells DSR automation, data mapping, risk assessments and marketing preference management as separately priced modules.

Three 2026 releases define what you are buying today:

• Opt-Out Sync (January 14, 2026) links the cookie banner, the opt-out webform, identity resolution and backend enforcement into one flow. A “Do Not Sell or Share” choice made in either place is pushed to CRM, CDP, ad platforms and partner systems, with identity-based logs that show where each opt-out landed.
• Marketing Preference Management (March 11, 2026) brings email and channel subscription preferences into the same consent record, priced by contact count.
• The Ketch Agent Network (announced late May 2026) adds agents for data mapping (discovering systems and reading vendor contracts and DPAs into a record of processing), risk management (checking live configurations against regulations and policy), and assessments (pre-filling DPIAs, PIAs, TIAs and AI impact assessments, then routing questions to subject-matter experts).

Ketch says it serves 3,500+ consumer brands and processes 67.2 billion consent transactions a month. Both figures come from the vendor and are not independently verified.

Why it shows up in Legal Ops stacks

• Opt-out enforcement is where the fines are. The Opt-Out Sync release cites the Honda, Healthline Media and Jam City settlements, which the release reads as regulators demanding opt-out flows that are frictionless and complete. If your exposure is a California-style Do Not Sell obligation across ad tech, Ketch is built for that exact problem rather than for the program-management side of privacy.
• It is the cheaper second quote against OneTrust. Ketch runs a OneTrust migration program called Ketch Switch, which tells you who it expects to replace.
• Marketing can own it. Consent, preferences and the opt-out flow sit with growth and marketing ops as much as with the privacy lead, and Ketch’s UX is built for that shared ownership.

Pricing reality

Ketch is one of the few privacy vendors with a public price page (checked November 5, 2026). Tiers are set by monthly unique visitors:

• Free: $0, up to 5,000 visitors a month, full consent platform, 2 integrations.
• Starter: $150 a month, billed monthly, up to 30,000 visitors.
• Plus: from $499 a month billed annually (about $6,000 a year), up to 100,000 visitors, with DSR rights workflows and extra integrations as add-ons.
• Pro: custom quote, 100,000+ visitors. This is the only tier that includes DSR automation, data mapping, risk assessments and marketing preference management.

Crossing a visitor cap moves you up a tier rather than triggering an overage fee. Modules beyond consent are priced on their own meter: data mapping by connected systems, marketing preferences by contact count. There is no reliable public data on what Pro contracts cost; Vendr shows only six Ketch purchases. Our working estimate is that a Pro deal with consent, DSRs and data mapping lands in the low-to-mid five figures a year, in the same range as TrustArc’s $15,120 Vendr median. Ask for the quote broken out by module and by meter so you can see which one drives renewal increases.

Best for

Privacy or marketing-ops leads at consumer brands (retail, media, subscription, fintech) with real ad-tech exposure, who need Do Not Sell and consent choices enforced across CRM, CDP and ad partners, and a team of one to three people running privacy. It also fits a company leaving OneTrust whose real use was the consent banner and opt-outs.

Do not buy it if the program is assessment- and research-led (TrustArc fits better) or if engineering owns deletion and consent inside production code (Transcend fits that ownership model better). A single small B2B site with no ad tech needs only the free tier, or a cheaper cookie tool.

Versus the alternatives

OneTrust is the market leader by a wide margin. Pick OneTrust when you need third-party risk, AI governance and the broadest module catalog in one contract. Pick Ketch when consent and opt-out enforcement are the job and you want public pricing below enterprise.

Usercentrics (Cookiebot) is the big European consent specialist. Pick it for a cheap, compliant EU cookie banner across many sites. Pick Ketch when the opt-out has to travel to backend and partner systems, not just block tags.

TrustArc wins when the program needs assessments, Nymity regulatory research and certifications.

Transcend and DataGrail are the fast-moving mid-market entrants. Pick Transcend when engineering wires consent and deletion into code paths; pick DataGrail when a lean team mainly needs DSRs and a data map live quickly.

Vanta fits when the driver is SOC 2 or ISO 27001 evidence rather than consumer privacy law.

Watch-outs

• The pricing page covers only consent. Free, Starter and Plus are consent tiers; DSRs, data mapping and assessments push you to a custom Pro quote. Guard: price the full Pro scope before you sign up for Plus, so you know the step-up cost before you depend on it.
• Opt-out sync is only as good as your identifiers. Enforcement relies on matching a person across browsers, devices and systems. G2 reviewers ask for better retry and monitoring tooling and duplicate-record rules. Guard: in the pilot, submit test opt-outs (logged in, logged out, two devices) and confirm each one in the downstream logs of your CRM and top ad partners.
• Agentic features are new and unproven. The Agent Network shipped in mid-2026 with no named customers or usage data in the launch. Guard: treat agent-built data maps and assessments as drafts, require a named reviewer before export, and pair them with a human-run DSAR intake flow until you trust them.
• Funding is old. The last disclosed round was in 2021, and privacy vendors have been consolidating (Securiti to Veeam, TrustArc to Main Capital). Guard: add a change-of-control termination right and data-export commitments, and keep the term at 24 months or less.

G2 rates Ketch 4.6/5 from 200+ reviews (per Ketch’s own G2 widget), with onboarding and ease of setup the most cited strengths. For the legal basics behind consent and opt-outs, see GDPR for legal teams.