PrivacyBox › Expert Article › Cookie Consent & CMP
Expert Article · Practical Knowledge · CMP Comparison 2026

Consent Management Platforms 2026: CMP Providers Overview

Comparison of current Consent Management Platforms with features, prices, free plans, use cases, and technical differences. We also explain Cookie Consent, GDPR, TDDDG, script/iframe blocking, and the correct CMP integration.
Revised: October 24, 2026 · Prices, features, and provider information may change and should be verified against the current provider details before production use.

Table of Contents

  1. Key Points at a Glance
  2. History of Cookies
  3. What Is a Cookie?
  4. Cookie Types & Storage
  5. What Is Cookie Consent?
  6. GDPR & TDDDG
  7. Technical CMP Integration
  8. External Services & Blocking
  9. 12 CMP Providers & Prices
  10. CMP Comparison
  11. Technical Website Test
  12. Common Mistakes
  13. More PrivacyBox Pages
  14. FAQ
  15. Sources

Key Points at a Glance

Cookie Consent Is More Than a BannerThe visible interface must be connected to technical control of the relevant services.
GDPR and TDDDG Must Be Assessed SeparatelySection 25 TDDDG concerns storage on and access to end devices; the GDPR concerns the processing of personal data.
Loading Order MattersA CMP must take effect early, before analytics, marketing, or third-party resources requiring consent are loaded.

A modern Consent Management Platform combines information, choice, documentation, and technical control. For operators, the most important factor is not the most attractive banner design alone, but whether rejection, consent, individual choices, and later withdrawal actually work technically.

1. The Origins of Cookies

HTTP is fundamentally stateless: a web server receives individual requests without automatically knowing which of them belong to the same session. Cookies were developed to store such state in the browser and reuse it for later requests. In the mid-1990s, Netscape established this technology; cookies were later documented and further developed in standards. RFC 6265 describes the HTTP state management mechanism using the headers Set-Cookie and Cookie.

1990sCookies emerge as a technical solution for sessions and recurring state on the web.
2011RFC 6265 consolidates HTTP cookie behavior as a widely used standard.
2018The GDPR becomes applicable and tightens requirements for personal data processing and consent.
2019The CJEU clarifies in the Planet49 case that pre-ticked boxes do not constitute valid active cookie consent.
TodayConsent Management covers not only cookies but also Local Storage, pixels, scripts, iframes, external media, and other access to end devices.

3. What Types of Cookies and Storage Technologies Are There?

Session CookiesTypically states limited to one session, such as shopping cart or login sessions.
Persistent CookiesRemain stored until a defined expiration date or until they are deleted.
First-Party / Third-PartyThey differ according to the domain context in which they are set or used.
Necessary FunctionsMay be technically strictly necessary for a service explicitly requested by the user.
Analytics / StatisticsUsed, for example, for reach and usage analysis and require a separate assessment.
Marketing / TrackingMay support user profiles, conversion measurement, and ad targeting.

The central question is therefore not “Is it a cookie?” but: What is stored or read, why, by whom, and when?

5. GDPR and TDDDG: Two Legal Levels

In Germany, Section 25 TDDDG governs the storage of information on terminal equipment and access to information already stored there. As a rule, this requires consent based on clear and comprehensive information; exceptions apply in particular to operations that are technically strictly necessary to provide a digital service expressly requested by the user.

If personal data is processed, the GDPR also applies. Where consent is used, the requirements relating to freely given, informed, unambiguous, and withdrawable consent are particularly relevant. In Case C-673/17 (Planet49), the CJEU clarified that a pre-ticked checkbox does not constitute valid active consent.

No blanket “cookie = consent” rule: Whether a specific technology requires consent must be assessed based on its purpose, technical necessity, access to the end device, and subsequent data processing. This article does not constitute legal advice.

6. Technical Integration: Place the CMP Early in the <head>

Even the best consent interface is of little use if analytics, advertising pixels, or external embeds have already loaded beforehand. Consent initialization should therefore take place early enough to control the consent-dependent services that follow.

<head>
  <title>Example Page</title>
  <meta name="description" content="...">

  <!-- 1. Initialize CMP / consent control early -->
  <script id="privacybox-cmp"
          src="https://privacybox-cmp.de/privacybox/loader.php?id=YOUR-ID"></script>

  <!-- 2. Only then load external / consent-dependent services -->
  <!-- Analytics, Marketing, external media, etc. -->
</head>

The specific blocking scheme depends on the respective CMP. The key principle is: Consent status first, consent-dependent processing second. With tag management systems, the individual tags must also be checked; a container alone is not yet consent control.

async and defer

async can make the execution order difficult to predict. defer delays execution until after the HTML has been parsed. For CMPs, the integration method specified by the provider is therefore decisive; services requiring consent must not run before the consent controls take effect.

7. Handling External Services, iframes, and Resources Correctly

Consent Management covers much more than traditional cookies. Typical areas to review include:

Analytics & StatisticsGoogle Analytics, Matomo, Clarity, Hotjar, and similar systems.
Marketing & TrackingGoogle Ads, Meta Pixel, LinkedIn Insight Tag, TikTok Pixel, and retargeting.
MediaYouTube, Vimeo, Spotify, SoundCloud, or other external players.
MapsGoogle Maps, OpenStreetMap, Mapbox, and other geolocation services.
Fonts & IconsExternal font and icon CDNs where third-party connections are established.
Captcha, Chat & WidgetsreCAPTCHA, hCaptcha, support chats, appointment and booking widgets.

A local placeholder is often a sensible approach: the external content is not loaded initially. Only after consent does the website replace the placeholder with the actual iframe or script.

8. Consent Management Platforms Compared: 12 CMP Providers in 2026

The following twelve Consent Management Platforms are sorted alphabetically by provider name. For each CMP, the intended use, key features, and publicly available prices or pricing models are summarized. The information was checked against the official provider information available in each case. Prices and features may change; the current provider website remains authoritative.

1. Captain Compliance

Suitable for: Companies that want to combine Consent Management with personal implementation support and additional privacy workflows.

Captain Compliance combines a Cookie Consent Manager with a Cookie Scanner, Privacy Notice Generator, DSR/DSAR portal, and a Cookie Transparency Page. According to the provider, banners can be adapted geographically; deployment is possible via JavaScript snippet, Google Tag Manager, and plugins for platforms such as WordPress or Shopify. The scanner is intended to detect and classify cookies and other tracking technologies, while consent decisions can be technically enforced and documented.

The Professional plan includes five privacy modules, a dedicated contact (“Captain Compliance Hero”), and implementation support. For more complex environments, the provider lists multi-domain operation, DSAR automation, custom integrations, and optional on-premises or air-gapped deployments in the Enterprise tier. Official provider information states that Professional starts at $499 per month. The plan includes one domain, five privacy modules, up to 500 scanned pages, 150,000 website views, three team seats, and a dedicated contact (“Captain Compliance Hero”).

Cookie ScannerDSAR PortalGeo-TargetingGTM & JavaScriptImplementation Support

Prices

Personal0 $1 domain · up to 2,500 website views/month
Professionalfrom $499 / month1 domain · 5 privacy modules · 500 scanned pages · 150,000 website views · 3 team seats
Enterpriseon requestMulti-domain · higher capacities · custom workflows

Source / last checked: official Captain Compliance pages, reviewed in October 2026.

Captain Compliance

2. CCM19

Suitable for: Websites, companies, and agencies looking for a consent solution developed and hosted in Germany, with a choice of cloud, agency, and on-premises/download operation depending on their needs.

CCM19 is a Consent Management and cookie banner solution from Papoo Software & Media GmbH. According to the provider, its own services are hosted entirely in Germany; an on-premises/download version is also available with the paid plans. The platform supports cookie and script detection, consent logging, customizable banners, iframe blocking, geo and language localization, and Google Consent Mode v2, among other features. TCF 2.4/IAB functionality can be activated as an additional module within the Business scope.

The current pricing table distinguishes between Free, Starter, Business, and Enterprise. The Free plan includes one domain or app and 5,000 impressions per month. Starter includes two domains/apps and 20,000 impressions; Business starts with five domains/apps and 100,000 impressions. For all standard packages, CCM19 states a 14-day free trial without credit card or payment details; trial accounts are automatically closed after the trial if no plan is booked.

Hosting in GermanyCloud & On-PremisesGoogle Consent Mode v2Cookie & Script ScannerOptional TCF 2.4

Prices

Free€01 domain/app · 5,000 impressions/month
Starter€7.90 / month2 domains/apps · 20,000 impressions/month
Business€19.90 / monthfrom 5 domains/apps · from 100,000 impressions/month
Enterpriseon requestfor larger companies, corporate groups, and public authorities

Source / last checked: official CCM19 product and pricing pages, reviewed in October 2026. According to the provider, the standard prices shown on the German pricing page include 19% VAT.

CCM19

3. consentmanager

Use case: European websites, publishers, and organizations looking for a Google-certified CMP with EU data storage, cookie crawling, and IAB support.

consentmanager combines automatic cookie blocking with crawling, customizable consent layers, and Google Consent Mode v2. According to the provider, consent data is stored exclusively in European data centers. The platform supports predefined designs, geo-targeting for EU/non-EU scenarios, and more than 35 available languages; the number of languages that can be used simultaneously depends on the plan.

From the Essential plan upward, consentmanager additionally lists IAB TCF-compatible CMP features and IAB GPP as well as A/B testing and optimization. The Enterprise plan adds white-labeling, a personal account manager, and individually scalable websites, apps, and traffic volumes.

Google-certifiedEU data storageIAB TCF & GPPCookie CrawlerA/B Testing

Prices

Starter23 € / month1 website/app · 100,000 views/month
Essential59 € / monthup to 3 websites/apps · 1 million views/month
Enterprisecustomcustom limits and features

Source / last checked: official consentmanager pricing and feature pages, reviewed in October 2026.

consentmanager

4. Cookiebot by Usercentrics

Suitable for: Small and growing websites as well as companies looking for automated cookie and tracker scanning, an established consent banner, and integrations with Google and marketing environments.

Cookiebot CMP automates the scanning and categorization of cookies and trackers and can block non-essential cookies and associated scripts until the appropriate consent has been given. The platform supports Google Consent Mode, Google Tag Manager, geo-based banner delivery, consent records, and multilingual banners. According to the current product page, Cookiebot supports more than 47 banner languages; additional languages can be added individually.

Cookiebot Core pricing is tiered according to the number of subpages per domain rather than website traffic. The Free plan is limited to one domain with up to 50 subpages. According to the official pricing page, Premium plans start at €7 per month; a 14-day trial without a credit card is available before upgrading. For larger organizations, Usercentrics also offers an Advanced version with session-based billing and expanded organization and governance features.

Automated ScanningAutomatic BlockingGoogle Consent Mode47+ LanguagesIAB TCF

Prices

Free€01 domain · up to 50 subpages
Cookiebot Core Premiumfrom €7 / monthpricing tiered by subpages per domain · no traffic limits
Usercentrics Advancedon requestsession-based enterprise solution with expanded features

Source / last checked: official Cookiebot product, pricing, and support pages, reviewed in October 2026. According to Cookiebot Support, euro prices are shown excluding VAT.

Cookiebot

5. OneTrust

Typical use: large companies and international organizations with extensive consent, preference, and governance requirements across multiple channels.

OneTrust offers Consent Management for websites, mobile applications, and OTT and CTV environments. The platform can automatically detect and categorize cookies, SDKs, and tracking technologies and, according to the provider, draws on a database of more than 45 million categorized tracking technologies. Consent banners and preference centers can be branded, geolocated, and provided in more than 250 languages.

For technically complex setups, OneTrust supports IAB Europe TCF v2.3, GPP, GPC, and Google Consent Mode v2, among other standards. Additional features include A/B testing, consent logging, integrations with tag managers and marketing systems, and no-code blocking or script rewriting until consent is given.

Web, Mobile & CTV45+ million tracking technologies250+ languagesIAB TCF 2.3Google Consent Mode v2

Prices

Enterpriseon requestcustom packages depending on scope, products, and usage

OneTrust does not publish a directly comparable standard entry price on its CMP pricing page. Third-party prices are therefore not presented as an official list price.

OneTrust

6. Osano

Suitable for: Companies that want to combine Consent Management with broader privacy management features and international data protection requirements.

Osano positions Consent Management as part of a broader privacy platform. According to the provider, the Cookie Consent solution localizes banners for more than 45 languages and 95+ privacy regulations in more than 50 countries. Depending on the product tier, features for Subject Rights Management, Data Mapping, Vendor Privacy Risk Management, Assessments, and other privacy processes are added.

For Consent Management, Osano distinguishes between Free, Plus, and Premier. Free and Plus include Consent Management features; Premier expands the scope with the broader privacy suite. Osano offers a 30-day free trial for Plus. Consent Management pricing is traffic-based: Osano measures how often the CMP library is delivered per device within 24 hours and uses a rolling three-month average for billing. Public fixed list prices for Plus and Premier are not shown on the official pages currently reviewed.

45+ languages95+ regulations50+ countriesDSAR & Data Mappingtraffic-based billing

Prices

Free0 $basic Consent Management for small or test setups
Pluson requestConsent Management · 30-day trial of the full platform
Premieron requestexpanded privacy suite with additional modules

Source / last checked: official Osano product, demo, and documentation pages, reviewed in October 2026. Commercial CMP pricing is calculated based on traffic and is not published as a general fixed list price.

Osano

7. Piwik PRO

Best suited for: Companies that want to combine privacy-oriented web analytics and tag management with an external consent solution, or that have already licensed the former Piwik PRO Consent Manager.

Piwik PRO is primarily a privacy-oriented Analytics Suite with Analytics, Tag Manager, and Data Activation. Consent information can be incorporated into tag delivery: tags requiring a specific consent category are triggered only when the relevant consent has been given. This allows the consent decision to be closely integrated with analytics and tag management processes.

For a current CMP comparison, it is important to note that the integrated Piwik PRO Consent Manager is explicitly described in the official documentation as Consent Manager (legacy) and is no longer offered to new Piwik PRO accounts. Existing accounts whose subscription includes the legacy module can continue to use it. For new setups, Piwik PRO instead describes integrating an external consent solution; the current documentation specifically mentions Cookie Information CMP for this purpose.

The public Piwik PRO pricing page refers to the Analytics Suite and not to a separately purchasable Piwik PRO Consent Manager. Therefore, no separate CMP price for new customers is shown here.

Privacy AnalyticsTag Manager integrationConsent-controlled tagsLegacy Consent Managerexternal CMP can be integrated

Prices

Piwik PRO Suiteon requestAnalytics Suite · terms according to the current offer
Consent Managerno new-customer priceLegacy module · no longer offered to new accounts

Source / last checked: official Piwik PRO pricing page and Piwik PRO Help Center on the Consent Manager, reviewed in October 2026.

Piwik PRO – Pricing

8. PrivacyBox

Suitable for: Websites, SMEs, and agencies looking for a Consent Management Platform developed and hosted in Germany with domain-based pricing and unlimited page views.

PrivacyBox combines Cookie Consent with script and iframe blocking, dynamic service detection, and Google Consent Mode v2. The current service registry includes 104 known services and technologies in the areas of statistics & analytics, marketing & tracking, external services & media, functional services, and essential technologies. Technical integration is handled centrally via a JavaScript loader.

PrivacyBox supports 12 languages and, according to the available product information, provides the full feature set in all plans. Differences between the paid plans mainly result from the number of managed domains; page views are not limited by plan. The 30-day trial for one domain requires no payment details and does not renew automatically.

Made & Hosted in Germany104 services & technologies12 languagesGoogle Consent Mode v2unlimited page views

Prices

Test0 € / 30 days1 domain · full feature set
Single5,30 € / month1 domain · unlimited page views
Plus22,30 € / monthup to 5 domains
Agency39,30 € / monthup to 10 domains · priority support

Source / last checked: current PrivacyBox product information, October 2026.

PrivacyBox Pricing

9. Sourcepoint

Use case: Media companies, publishers, and larger digital offerings with complex consent, monetization, and compliance requirements.

Sourcepoint combines consent and preference management with geotargeting, granular opt-in/opt-out rules, and automated third-party discovery. The integrated scanner can detect and categorize scripts, trackers, and data processing activities; unauthorized third parties can also be blocked. Different consent experiences can be presented for different countries, regions, or U.S. states.

Additional features include Consent Reporting, A/B testing, and a customizable Message Builder. The Pro plan adds Compliance Monitoring; Enterprise adds expanded Preference Management and Data Subject Request features, among other capabilities. Billing is based on page views for websites and monthly active app users for apps.

Publishers & MediaGeotargetingThird-Party DiscoveryA/B TestingConsent Reporting

Prices

Essentials500 $ / monthCore consent and preference features
Pro1.250 $ / monthadditional Compliance Monitoring
Enterpriseon requestexpanded Preference Management and DSR

Source / last checked: official Sourcepoint pricing page, reviewed in October 2026.

Sourcepoint

10. Termly

Suitable for: small and medium-sized businesses that want to combine Consent Management with additional generators for privacy and legal texts.

Termly combines a Consent Management Platform with a Cookie Scanner, Cookie Policy Generator, and other policy generators. The Starter plan includes the CMP and two policy generators with up to 50,000 banner views per month. Pro+ expands the feature set to include unlimited banner views, multiple languages, weekly cookie scans, and automatically updated policies, among other features.

For more advanced consent setups, Termly lists IAB TCF v2.3, Google Consent Mode v2, regional consent rules, Consent Logs, and subdomain scanning as part of Pro+, among other features. An Agency plan is aimed at resellers and organizations with multiple websites and adds multi-domain management, user permissions, onboarding, and support services.

Cookie ScannerPolicy generatorsGoogle Consent Mode v2IAB TCF 2.3Agency option

Prices

Free0 $limited feature set
Starter14 $ / month$10/month when billed annually
Pro+20 $ / month$15/month when billed annually
Agencycustomfor multiple websites and resellers

Source / last checked: official Termly product and pricing information, reviewed in October 2026.

Termly

11. UniConsent

Typical use: Publishers, AdTech environments, and websites that want customizable banners, IAB frameworks, and coverage across multiple platforms or apps.

UniConsent offers Consent Management with Cookie Scanning, a consent-based Tag Loader, Analytics & Insights, and customizable banners. According to the provider, even the Basic plan supports IAB TCF 2.3, CCPA, GPP, Google Consent Mode 2.0, and Microsoft UET Consent Mode, as well as more than 52 languages and several preconfigured banners.

Higher plans add Mobile SDKs for iOS, Android, and Flutter, Google DFP support, programmatic ads features, and WP Consent API. The Pro plan also adds a Consent Audit Trail and an Insight Data API, among other features. This makes UniConsent particularly suitable for publishers and technical environments where standardized advertising and consent signals are important.

IAB TCF 2.3GPPGoogle Consent Mode 2.052+ languagesMobile SDK

Prices

Basic20 £ / monthup to 300,000 users/month · up to 3 websites
Value50 £ / monthup to 500,000 users/month · up to 5 websites or 1 app
Pro200 £ / monthup to 2 million users/month · up to 20 websites or 5 apps

Source / last checked: official UniConsent pricing page, reviewed in October 2026. The page also shows discounted annual billing.

UniConsent

12. Usercentrics

Suitable for: Websites, apps, and larger organizations with multilingual consent requirements and extensive marketing, AdTech, and multi-channel integrations.

Usercentrics offers CMP products for web, apps, and CTV. Depending on the plan, the web CMP supports multiple privacy regulations, up to 60 banner languages, and an unlimited number of subpages and users. Web pricing is primarily tiered by sessions and number of domains.

For larger installations, higher session limits, multiple domains, and corporate offerings are available. Usercentrics supports Google Consent Mode v2 and also addresses app and CTV scenarios, making the platform particularly attractive to organizations that manage consent across more than a single website.

Web, App & CTVup to 60 banner languagesmultiple privacy regulationssession-based14-day trial

Prices

Essential7 € / month1 domain · up to 1,500 sessions
Plus15 € / monthup to 3,000 sessions
Pro30 € / month3 domains · up to 15,000 sessions
Business50 € / month10 domains · up to 50,000 sessions

Source / last checked: official Usercentrics pricing page, reviewed in October 2026. A 14-day free trial without a credit card is offered for all packages listed there.

Usercentrics

9. CMP Comparison 2026 at a Glance

The table summarizes the twelve Consent Management Platforms described in the article. It is not a ranking: the right provider depends on domains, traffic, integrations, jurisdictions, support needs, and the technical environment.

No.CMPTypical FocusEntry / PriceBilling / Note
1Captain ComplianceConsent + privacy workflows + personal supportFree; Professional from $499/monthDomain, traffic, and feature limits
2CCM19German hosting, cloud/on-premises, websites & agenciesFree; Starter €7.90/monthDomains/apps + impressions · on-premises from paid plans
3consentmanagerEU websites, publishers, IAB/GoogleStarter €23/monthViews + websites/apps
4Cookiebot by UsercentricsAutomated cookie/tracker scanning and blockingFree; Premium from €7/monthBy subpages per domain · no traffic limits
5OneTrustEnterprise, multi-channel, governanceon requestcustom enterprise packages
6OsanoPrivacy suite, consent, international regulationsFree; Plus/Premier on requesttraffic-based · 30-day trial for Plus
7Piwik PROPrivacy Analytics + Tag Management + consent integrationno separate CMP price for new customersConsent Manager is legacy and no longer available to new accounts · external CMP can be integrated
8PrivacyBoxWebsites, SMEs, agencies30 days €0; then from €5.30/monthby domains · unlimited page views
9SourcepointPublishers, media, complex consent environmentsEssentials $500/monthamong other factors, page views/app users
10TermlySMEs, CMP + policy generatorsFree; Starter $14 monthly / $10 per month when billed annuallyplan-dependent; Agency custom
11UniConsentPublishers, AdTech, IAB/GPPBasic £20/monthby users + websites/apps
12UsercentricsWeb/App/CTV, multilingualEssential €7/monthsessions + domains
Price check October 2026: We assume no liability for the timeliness, completeness, or accuracy of prices, plan components, limits, or other terms published on the respective provider websites. The information and terms of the respective provider that are valid at the time the contract is concluded always apply.

10. How to Perform a Technical Cookie Consent Test

  1. Open a private browser window and start the developer tools before loading the page.
  2. Without making a selection, check cookies, Local Storage, network requests, and iframes.
  3. Select “Necessary only” and reload: optional services must remain blocked.
  4. Enable statistics separately and check which requests are added.
  5. Enable marketing or media separately and repeat the test.
  6. Withdraw consent, reload, and check whether blocking takes effect again.
  7. Document the results with the date, CMP version, and configuration.
Scanner + browser test: An automated scanner is a good starting point, but dynamic content, single-page apps, checkout steps, and services loaded after clicks are not always captured completely.

11. Common Cookie Consent Mistakes

  • Analytics or marketing starts before the first decision.
  • A banner is visible but has no technical blocking effect.
  • Only cookies are checked; external requests, iframes, and Local Storage are ignored.
  • New plugins or campaign tags are added without updating the CMP configuration.
  • Rejecting is unnecessarily more difficult than accepting.
  • The withdrawal option is hidden or does not reliably change the technical state.
  • The privacy policy and the services actually used do not match.

12. Further Information

13. Frequently Asked Questions

Does every website need a cookie banner?

Not automatically. What matters is what information is stored on or accessed from the end device and what personal data is subsequently processed. Technically necessary operations may be assessed differently from analytics, marketing, or external media services.

Does the CMP really have to load before Google Analytics?

If Google Analytics is to be activated only after consent, consent control must be technically effective before the relevant processing starts. In a tag-based implementation, this typically means that consent defaults and CMP logic must take effect before the affected tags.

Why is a scanner not enough?

Scanners can detect many static resources, cookies, and external requests, but may miss dynamic content, states after interactions, single-page applications, or protected areas. Therefore, an additional check in the browser using developer tools should always be performed.

What distinguishes PrivacyBox in this comparison?

According to its product page, PrivacyBox combines central JavaScript integration, a registry of 104 known services and technologies, a status display, 12 languages, unlimited page views, and the full feature set in all plans. In addition, PrivacyBox can be tested free of charge for 30 days at €0 on one domain – without payment details and without automatic renewal. Resellers and agencies can benefit from a 20% commission.

What is the difference between Cookie Consent and a Consent Management Platform?

Cookie Consent refers to the visitor’s consent decision. A Consent Management Platform (CMP) is the technical solution that requests and stores this decision, passes it on to connected services, and, depending on the configuration, blocks or controls scripts, iframes, or other external resources until approval is given.

Which cookies or access to stored information may be permissible without consent?

Section 25 TDDDG provides exceptions in particular where storage or access is strictly necessary to provide a digital service expressly requested by the user. Whether a specific technology falls under this exception must be assessed based on its actual purpose and technical function; the label “necessary” alone is not sufficient.

Is a simple OK button sufficient for valid consent?

A generic OK button is problematic if it does not clearly show what the user is consenting to. Valid consent must be informed, unambiguous, and freely given. The purpose, categories or services, and a genuine choice should be presented clearly.

Must rejecting be as easy as accepting?

Consent must be freely given. A design that makes acceptance significantly easier while hiding or unnecessarily complicating rejection can undermine that freedom of choice. In practice, rejection should therefore be directly accessible and technically just as effective.

When must consent be obtained again?

The GDPR does not specify a blanket expiration date for every consent. However, consent may need to be requested again if purposes, services used, recipients, or the consent logic change materially, or if earlier consent is no longer sufficiently current or demonstrable. Changes should be versioned and documented.

How should a CMP document consent?

For demonstrability, the CMP should at least be able to record when a decision was made, which categories or services were affected, and which banner or configuration version the choice was based on. At the same time, only what is actually needed as evidence should be stored.

Does Google Consent Mode v2 replace a cookie banner or CMP?

No. Consent Mode sends consent signals to supported Google tags and influences their behavior. It replaces neither the legal consent decision nor the user interface of a CMP. A robust consent logic is needed first; Consent Mode can complement it technically.

How should YouTube, Google Maps, or other external iframes be handled?

If an external service is to load only after consent, the original iframe or an equivalent request must not already be active when the page loads. A placeholder is commonly used to load the external content only after the appropriate approval. The actual network traffic is decisive, not just the visible interface.

What is the difference between TDDDG and GDPR for Cookie Consent?

The TDDDG concerns, in particular, the storage of information on terminal equipment and access to information already stored there. The GDPR, by contrast, governs the subsequent processing of personal data. With tracking technologies, both legal frameworks may therefore be relevant at the same time and require different assessment steps.

Can consent be shared across multiple websites or domains?

Cross-domain consent is technically possible, but is not automatically appropriate or lawful. The affected websites, controllers, purposes, and services must be transparent to the user. In addition, the CMP used must implement the sharing or recognition of the decision correctly and in compliance with data protection requirements.

14. Conclusion

No single overall winner can be credibly identified from this comparison because the CMPs differ significantly in target audience, billing model, feature set, and technical focus.

PrivacyBox offers a comparatively low entry price in the comparison reviewed. The paid entry point is €5.30 per month for one domain. At the same time, according to current PrivacyBox product information, unlimited page views, the full feature set, 12 languages, Google Consent Mode v2, and technical control of known services and technologies are offered. There is also a 30-day free trial with the full feature set, without payment details and without automatic renewal.

Usercentrics also offers a comparatively low entry price. The Essential plan starts at €7 per month for one domain and up to 1,500 sessions. Usercentrics also offers solutions for websites, apps, and larger organizations, supports multiple privacy regulations, and, depending on the plan, offers numerous banner languages as well as Google Consent Mode v2. Session-based billing can be attractive for smaller websites, but with strongly growing traffic it should be checked whether the respective session limits fit the site’s usage profile.

Termly also offers a comparatively low entry point. In addition to a free plan, the Starter plan begins at $14 per month or $10 per month when billed annually. Termly combines Consent Management with a Cookie Scanner and generators for privacy and legal texts. Higher plans add Google Consent Mode v2, IAB TCF, consent logs, multiple languages, and regular cookie scans, among other features. Termly is therefore aimed primarily at small and medium-sized businesses that want supporting privacy tools from one platform in addition to Cookie Consent.

Captain Compliance combines Consent Management with additional privacy workflows and personal support. In addition to the Cookie Consent Manager, the platform offers Cookie Scanning, a DSR/DSAR portal, geo-targeting, and integrations via JavaScript and Google Tag Manager, among other features. One advantage lies particularly in the combination of a technical consent solution and accompanying implementation support. With a dedicated contact and several privacy modules, the Professional plan is aimed more at companies that want to centrally manage additional privacy processes beyond the banner.

CCM19 combines German hosting with flexible deployment models. In addition to the cloud version, the provider offers an on-premises/download option with the paid plans. Features include cookie and script scanning, consent logging, iframe blocking, Google Consent Mode v2, and optionally activatable TCF 2.4/IAB functionality. Plans are tiered by domains or apps and impressions; a permanently free plan and a 14-day trial for the standard packages are available.

consentmanager is particularly geared toward European websites, publishers, and more complex consent requirements. The platform offers automatic cookie blocking, a Cookie Crawler, geo-targeting, Google Consent Mode v2, and support for IAB TCF and GPP. According to the provider, consent data is stored in European data centers. Another advantage is the combination of technical control, multiple languages, A/B testing, and optimization features. This makes consentmanager particularly suitable for operators who want to continuously optimize their consent rate both technically and in terms of design.

Cookiebot by Usercentrics focuses on automated scanning and largely automatable consent control. Cookiebot Core can detect and categorize cookies and trackers and block non-essential technologies until consent is given. It supports Google Consent Mode, Google Tag Manager, geotargeting, multilingual banners, and IAB TCF, among other features. Core plans are based on the number of subpages per domain and, according to the provider, have no traffic limits; Usercentrics Advanced is also available for larger organizations with session-based billing.

OneTrust is one of the most comprehensive enterprise solutions in the comparison. The platform supports Consent Management for websites, mobile apps, and OTT and CTV environments and is therefore aimed primarily at international companies with many digital offerings. Its strengths include automated detection and categorization of tracking technologies, geo-targeting, multilingual consent interfaces, preference centers, and support for IAB TCF, GPP, GPC, and Google Consent Mode v2. The broad feature set makes OneTrust particularly attractive where Consent Management is to be linked with governance, marketing, and preference processes.

Osano combines Consent Management with a broader privacy platform. In addition to cookie and consent control, features such as Consent Analytics, Audit Logs, Data Mapping, Vendor Risk Management, and DSR/DSAR processes can be used depending on the product scope. The advantage therefore lies less in having the simplest possible cookie banner and more in combining different privacy management tasks within one platform. Osano may be particularly interesting for companies that want to manage international data protection requirements and internal compliance processes together.

Piwik PRO closely integrates privacy-oriented web analytics, Tag Management, and consent control. Consent information can be incorporated directly into tag delivery so that certain tags are triggered only after the appropriate consent has been given. The integrated Piwik PRO Consent Manager is now classified as a legacy module and is no longer offered to new accounts. Existing customers with the legacy module can continue to use it; for new setups, Piwik PRO supports integrating external CMPs and consent-dependent tag control in the Tag Manager.

Sourcepoint is aimed particularly at publishers, media companies, and larger digital platforms. The solution combines consent and preference management with geotargeting, third-party discovery, granular opt-in and opt-out rules, and Consent Reporting. Additional features include A/B testing, Compliance Monitoring, and a customizable Message Builder. A key advantage is its strong focus on complex media and monetization environments where different jurisdictions, advertising technologies, and consent scenarios must be considered simultaneously.

UniConsent is particularly interesting for publishers, AdTech environments, and internationally oriented websites. The platform supports IAB TCF 2.3, GPP, Google Consent Mode, Microsoft UET Consent Mode, and more than 52 languages, among other features. Higher plans add Mobile SDKs, programmatic advertising features, Consent Audit Trails, and APIs for analytics. One advantage of UniConsent is therefore its strong support for standardized advertising and consent frameworks, as well as the ability to cover websites and apps within a single technical consent infrastructure.

Price alone should still not determine the choice. What matters is whether a CMP fits the organization’s technical environment, can reliably control the required services, supports the desired languages and jurisdictions, and offers a transparent pricing model. For larger publishers, international corporations, or highly regulated organizations, platforms with advanced governance, preference, IAB, app, or multi-channel features may be the better choice even if their entry prices are significantly higher.

All information was taken from the websites of the respective CMP providers. We make no guarantee as to the accuracy, completeness, or timeliness of this information.

15. Sources and Further Information

Status: October 2026.
EDV Sachverständigen- und Datenschutzbüro Michael J. Schüssler