A look at OneTrust, BigID, TrustArc, and other startups helping companies navigate the internet's increasingly fragmented rules and privacy regulations
Companies have sprouted up to help others navigate the varied laws around the world governing websites.
Context & Ripple Effects
The [[a:950274|wave of hundreds of startups formed to help enterprises comply with the California Consumer Privacy Act]] was the origin point for this category; two years later, the New York Times profiles its leaders — OneTrust, BigID, TrustArc — as the job shifts from one state law to a patchwork of rules across jurisdictions. With Congress stalled, state and local governments have kept passing their own privacy and gig-work laws, which is precisely the fragmentation these vendors monetize.
First-order effects
- OneTrust, the category leader last valued at $4.5B, has absorbed an 18% valuation cut from its 2021 peak, laid off roughly 950 employees, and is reportedly exploring a sale, possibly to private equity — signs the compliance-software boom is repricing.
- BigID raised $60M led by Riverwood Capital at a reported valuation above $1B, showing capital still flows to the sector but no longer at peak-multiple levels.
Second-order effects
- Private equity interest in OneTrust signals consolidation pressure on a crowded field: smaller compliance vendors now compete against a potential PE-backed scale player with both OneTrust and TrustArc chasing the same enterprise budgets.
- Every new state and national privacy law adds implementation work without adding headcount at most enterprises, pushing more of the compliance function toward purchased software and services — the same outsourcing dynamic reshaping trust-and-safety work after Big Tech's cuts, where startups like Sero AI now sell the staff reductions back as a service.
Third-order effects
- If regulation stays fragmented rather than unified under one federal standard, compliance becomes a permanent line item and the vendors evolve from consultants into infrastructure — a structural moat created by legislative gridlock itself, echoing Alphabet and Microsoft's discovery that clamoring for rules carries existential consequences for startups.
- The longer pattern points to governance-as-a-product: as governments worldwide move to constrain tech platforms, an entire supplier industry forms around translating each jurisdiction's rules into deployable controls, making regulatory complexity itself a market.
The trend: Fragmented, jurisdiction-by-jurisdiction privacy regulation is turning compliance from a consulting project into durable software infrastructure, with the category's leaders now consolidating as growth-era valuations reset.