What it is
TrustArc is the privacy management platform that started life in 1997 as TRUSTe, the website privacy seal. It now sells two halves on one platform. The Privacy Studio covers the customer-facing work: Cookie Consent Manager, Consent & Preference Manager, Individual Rights Manager for subject requests (DSARs), and a public Trust Center. The Governance Suite covers the program: PrivacyCentral, Data Mapping & Risk Manager, Assessment Manager, and Nymity Research, a regulatory library of more than 50,000 expert-written references across 140+ jurisdictions. Alongside both sit the TRUSTe certifications and the EU-U.S. Data Privacy Framework verification and dispute-resolution services, which no other platform vendor runs.
It is the closest thing to OneTrust at a smaller scale. Bregal Sagemount sold it to the Dutch private-equity firm Main Capital Partners in October 2025 on undisclosed terms. Two months later, on December 18, 2025, TrustArc made Arc generally available: a rebuilt interface, a shared Evidence Library, and Arc Intelligence, an AI layer whose assistant Ask Arc answers regulatory questions with citations. On October 8, 2026 TrustArc made Ask Arc agentic. It can now read, create, update and delete records (a vendor record, a data-map entry, a vendor risk assessment from an approved template), with a person approving every write. The same release added MCP in both directions: Arc reads from Salesforce, Atlassian and other MCP tools, and privacy teams can query Arc from Claude, ChatGPT or Microsoft 365 Copilot.
Why it shows up in Legal Ops stacks
- It is the usual second quote against OneTrust. Most privacy suites are bought at a OneTrust renewal, and TrustArc is the one with comparable module coverage, so it sets the price ceiling in that negotiation.
- Research is built in. Nymity Research sits next to the assessments, so a DPIA under GDPR or a new US state law pulls the legal requirement into the same screen as the evidence. Small privacy offices that cannot afford a separate research subscription use this heavily.
- Certification is a buyer-facing asset. If your sales team fields privacy questions in security reviews, a TRUSTe seal or DPF verification answers them in one line. TrustArc’s 2025 DPF annual report lists 246 verified participants.
Pricing reality
There is no public price list and no self-serve tier; every route is “book a demo”. Vendr’s February 2026 buyer guide puts the median contract at $15,120 a year, with transactions ranging from about $8,200 to $43,800. That median reflects mostly one- or two-module deals. The same guide’s module estimates are higher: $15,000–$40,000 a year for cookie consent on 1–5 domains and $30,000–$70,000 for vendor risk on 50–200 vendors, with implementation of $10,000–$50,000+ and 3–7% annual escalators. Vendr’s own page is internally inconsistent on deal counts and tiers, so treat the median as the reliable number and the module bands as the upper end.
Our working estimate from those numbers: about $15,000 a year for a single module and $40,000–$90,000 a year for a three-to-four-module governance program at a mid-sized company. Vendr reports 20–35% off list for multi-year or competitively bid deals, and TrustArc’s fiscal year closes in December, so year-end quotes carry the most room.
Best for
Privacy leads at 500–5,000-employee companies running GDPR plus several US state laws with a privacy team of one to five people, who need consent, DSARs, a data map and assessments in one system and want regulatory research included. It also fits companies that need a recognized certification or DPF verification for customers.
Do not buy it if the privacy program is mainly a cookie banner on one or two sites; a dedicated consent tool costs a fraction of the median contract. Do not buy it either if engineering will own consent and deletion inside production systems; an API-first tool fits that ownership model better.
Versus the alternatives
OneTrust is the market leader by a wide margin (IDC put it at 29.7% share in 2022). Pick OneTrust when you need the broadest module catalog, third-party risk at enterprise scale, or AI governance tied to the privacy inventory. Pick TrustArc when the program is assessment- and research-led and you want lower list prices; Vendr estimates OneTrust lists 10–25% higher for comparable scope.
Securiti, bought by Veeam in December 2025, wins when data discovery across cloud data stores is the real job and security co-owns the budget.
DataGrail, Ketch and Transcend are the fast-moving mid-market entrants, each shipping AI agents and MCP support in 2026. Pick DataGrail for a lean team that needs DSARs and data mapping live quickly, Ketch for marketing consent and opt-out enforcement, and Transcend when engineering wires privacy into code paths.
Vanta fits when the driver is SOC 2 or ISO 27001 evidence rather than privacy law.
Watch-outs
- New owner, new pricing incentives. Main Capital has owned TrustArc for one year, and a new owner can reprice renewals or retire slower modules. Guard: cap annual increases at 5% in the order form, add a change-of-control termination right, and keep terms at 24 months or less.
- Support responsiveness is uneven. G2 rates TrustArc 4.2 from 328 reviews, but about 15 reviews cite slow support responses and unaddressed feedback. Guard: write response-time commitments into the contract and get a named customer success manager before signing.
- Agentic features are new. Agentic Ask Arc and MCP shipped in October 2026, with three named customer quotes and no published usage data. Guard: buy on the modules you need today, test Ask Arc on one workflow (for example, vendor records feeding the vendor due-diligence skill), and review which records an external assistant can reach before enabling MCP.
- Data map quality decides everything. DSAR fulfillment, such as the DSAR intake flow, is only as good as the data map behind it. Guard: name an owner for the data map and schedule a quarterly review before rollout.