The Sale That Never Happened — And Why That Matters More Than the Sale Itself
In November 2025, The Information broke the story: OneTrust, the privacy software giant last valued at $4.5 billion, was in active discussions with private equity buyers. The headlines landed hard. Industry Slack channels lit up. Privacy teams started asking questions they’d never had to ask before.
Eight months later, no deal has been announced. No buyer has been named. No signed term sheet has made it to the press.
And that silence? It speaks louder than any acquisition announcement would.
What Happens to a Company That’s on the Block
There’s a pattern that plays out every time a mature software company enters sale discussions, and it doesn’t matter whether you’re watching it from Silicon Valley or from your organisation’s procurement dashboard: the building stops.
Not officially, of course. Publicly, everything looks fine. There are still product updates. There are still marketing campaigns. The customer success team still picks up the phone. But behind the scenes, the calculus changes entirely. Capital allocation decisions get deferred. Bold product bets get shelved. Engineering roadmaps get quietly deprioritised in favour of making the financials look clean for a buyer’s due diligence team.
The goal of a company in sale talks is not to win the next three years of the market. The goal is to close a transaction.
That’s not a moral failing — it’s just the mechanics of how acquisitions work. Nobody ships a bet-the-company feature overhaul when the entire executive team is in rooms with investment bankers.
OneTrust reportedly crossed $550 million in annual recurring revenue, serves more than 14,000 customers, and counts 75% of the Fortune 100 among its client base. It’s a dominant, cash-generative business. Which is precisely the kind of asset that attracts private equity interest — and precisely the kind of business that can coast on stability while a deal gets done.
For buyers, “stability” is a selling point. For the privacy teams relying on the platform, it’s a risk they may not have priced in.
The Timing Could Not Be Worse
Ask any privacy professional what’s keeping them up at night in 2026, and the answer won’t be cookie banners or DSAR workflows. It will be AI.
Governance frameworks for AI systems. Data flows that didn’t exist eighteen months ago. Agentic tools that process personal data in ways no one mapped during the last round of data inventories. New regulatory obligations landing faster than organisations can absorb them — the privacy tech market recorded over 264 regulatory changes globally in a single month in 2025. Add the EU AI Act, US state-level AI legislation, and the continuing evolution of GDPR enforcement, and you have a compliance landscape that looks fundamentally different from the one your current tech stack was built for.
This is exactly the moment where your privacy platform needs to be investing aggressively. New infrastructure for AI governance. Automated data lineage tools that can trace how AI models consume personal data. Risk frameworks built for agentic workflows, not just static processing activities.
A company navigating a potential acquisition is structurally unable to make those bets at the pace the market demands.
Maintenance Mode, Dressed Up as Stability
There’s a phrase worth holding onto: maintenance mode dressed up as stability.
It describes a particular kind of vendor risk that doesn’t show up on a feature checklist or an analyst quadrant. It’s the gap between what a platform communicates — “we’re continuing to invest in innovation” — and what the organisational incentives actually support.
When a business is for sale, product managers don’t get rewarded for shipping ambitious new capabilities. Engineers don’t get greenlit for multi-quarter infrastructure rebuilds. The entire internal reward structure tilts toward keeping the metrics tidy, the churn low, and the EBITDA attractive.
Customers experience this as a slow drift. Support tickets take a little longer. Roadmap items get pushed. The product you bought eighteen months ago is essentially the product you have now, with a fresh coat of marketing on top.
And if private equity does complete an acquisition? The historical pattern across comparable deals — Thoma Bravo’s acquisitions of Sophos and Proofpoint, Vista Equity’s enterprise software playbook — points toward price increases, tighter feature tiering, and an emphasis on margin expansion over product development. PE firms acquire to transform and exit at a multiple. That transformation rarely looks like accelerated innovation for existing customers.
The Question Every Privacy Team Should Be Asking Right Now
If your OneTrust renewal is approaching — or if you’re mid-contract and starting to think about what comes next — there is one question worth sitting with:
Is the platform I’m betting the next three years of my privacy programme on actually investing in the next three years?
Not in what it built in 2023. Not in what its last round of funding implied. In what it’s building right now, for the problems you’re going to face in 2027.
Because the risk here isn’t just vendor stability in the traditional sense — the risk of a company going under or being absorbed into a bloated conglomerate. The risk is subtler: a platform that remains technically functional while falling behind on the capabilities that matter most, leaving your privacy team to patch the gaps with workarounds, manual processes, and tools that were never designed to work together.
What Proactive Privacy Teams Are Doing
The organisations responding most effectively to this uncertainty aren’t panicking. They’re asking harder questions during renewal conversations. They’re benchmarking what “AI governance readiness” actually looks like in competing platforms. They’re mapping the specific capabilities — automated AI impact assessments, real-time data flow monitoring, agent-aware consent frameworks — that they’ll need within the next 24 months, and asking vendors to demonstrate those capabilities in working software, not slide decks.
They’re also paying attention to the signals the market is already sending. A third of net-new clients going to OneTrust competitors — a figure cited by insiders — doesn’t happen because people are dissatisfied with cookie banner templates. It happens because forward-looking privacy teams are evaluating platforms on where they’re going, not just where they’ve been.
The Market Has Already Answered Whether OneTrust Is for Sale
Here’s the thing about the OneTrust situation that often gets lost in the noise: the question of whether a deal eventually closes is almost secondary.
The fact that a business of this size and market position has been in sale discussions for the better part of a year — with no resolution — tells you something about the strategic clarity inside the organisation. It tells you something about where the leadership team’s attention is. And it tells you something about what your renewal contract is actually buying you: a seat on a platform whose roadmap is, at best, on hold.
Privacy and data governance are no longer peripheral compliance functions. They’re core infrastructure for how organisations build AI products, manage data relationships, and maintain customer trust. The platform underpinning that function needs to be run by an organisation that is, unambiguously, in build mode.
What to Look For in a Platform That’s Actually Building
If you’re reassessing your privacy tech stack — or if you’re preparing to make the case internally for a change — here are the capabilities that separate platforms investing in the next era from those managing the last one:
- AI governance tools built into the platform, not bolted on as an afterthought — including automated AI system registration, risk classification, and impact assessments aligned to the EU AI Act
- Real-time data flow visibility that covers AI model training data, not just traditional processing activities
- Agentic workflow coverage — the ability to track consent and lawful basis across systems that make decisions without direct human instruction
- Regulatory intelligence that keeps pace with change — with 264+ regulatory updates recorded in a single month, static compliance libraries are already a liability
- Transparent roadmap communication — vendors who can show you what they shipped in the last quarter and what’s committed for the next two
The Bottom Line
OneTrust remains a significant platform with a large installed base and genuine capabilities built over nearly a decade. None of that is in dispute.
What is in dispute is whether it is the right foundation for what comes next.
Eight months into a sale process with no buyer announced, that question deserves a direct answer — not from a vendor in renewal mode, but from an independent assessment of what your programme actually needs to stay ahead of AI governance requirements, regulatory change, and the complexity that comes with both.
The market has already answered whether OneTrust is for sale.
The only question left is whether you’re going to wait for the announcement.
PrivIQ helps privacy and compliance teams stay ahead of regulatory change with intelligent, AI-ready privacy management tools built for the pace of modern data governance. Learn more →