The best cookie consent management platforms in 2026
Ten CMPs compared on Consent Mode v2, IAB TCF, setup and real prices.
A cookie consent management platform (CMP) shows the banner, blocks trackers until the visitor agrees, stores proof of consent and passes the choice to Google, Microsoft and ad partners. Short answer: pick Cookiebot for most websites, CookieYes for a WordPress or Shopify site on a budget, OneTrust for a large enterprise, and Osano or Ketch for a free start that grows with your company.
We compared 20 tools named in the top Google results for "cookie consent management platform" and ranked 10. Every price below comes from the vendor's pricing page, with its billing cycle.
The ranking is editorial: a sponsored spot is always labeled on its entry, and no affiliate link changes a score.
The best CMP for your site
Free to 50 subpages, then $10/mo
One WordPress or Shopify siteConsent Mode v2 on the free plan
Enterprise privacy programCustom quote
Banner plus privacy policyFrom €4.99/mo per site, yearly
Publishers, apps and CTVTCF v2.2, GPP, custom quote
Many WordPress sites$399/yr for 25 sites
10 cookie consent platforms compared
Prices are in the currency each vendor shows by default, before tax. "Custom quote" means the vendor shows no amount. The "What the price counts" column matters as much as the price: each CMP meters something different, so the cheapest tool for a 30-page site with heavy traffic is not the cheapest for a 3,000-page blog.
| Best for | What the price counts | Free plan | Team size | Visit | ||||
|---|---|---|---|---|---|---|---|---|
| 1 | Cookiebot | Best all-round CMP for most websites | Subpages per domain, not traffic (Free: up to 50) | 4.6/5 | Free, then $10/mo | ✓ | Visit → | |
| 2 | CookieYes | Best value for WordPress and small business | Pageviews per domain (Free: 5,000 a month) | 4.5/5 | Free, then $10/mo per domain | ✓ | Visit → | |
| 3 | Osano | Best for a free start with a path to full compliance | Monthly visitors and domains (Free: 5,000 visitors) | 4.4/5 | Free, Plus $199/mo | ✓ | Visit → | |
| 4 | OneTrust | Best for large enterprises with a privacy team | Average daily visitors across all your properties | 4.4/5 | Custom quote | — | Visit → | |
| 5 | iubenda | Best banner plus legal documents in one plan | Pageviews per site (Essentials: 25,000 a month) | 4.3/5 | €4.99/mo per site, billed yearly | ✓ | Visit → | |
| 6 | Didomi | Best for media and multi-device consent | Monthly unique visitors (MUV), unlimited domains | 4.3/5 | Custom quote | — | Visit → | |
| 7 | Ketch | Best for enforcing consent across your data stack | Monthly unique users (Free: 5,000) | 4.2/5 | Free, then $150/mo | ✓ | Visit → | |
| 8 | Termly | Budget banner with policies included | Banner views per site (Free: 10,000 a month) | 4.2/5 | Free, then $10/mo per site, billed yearly | ✓ | Visit → | |
| 9 | Complianz | Best WordPress-native plugin | WordPress sites per license, no pageview cap | 4.1/5 | Free plugin, Premium $59/yr | ✓ | Visit → | |
| 10 | Secure Privacy | Best for web and app consent on a budget | Consents per domain (Free: 500 a month) | 4.0/5 | Free, then $15/mo per domain | ✓ | Visit → |
Scores are ours, the weighted average of five criteria.
Is your tool missing from this page? Email us: hello@hackceleration.com
How we compared and scored
We started from the tools that the top 10 Google results for "cookie consent management platform" name, read each pricing page in a browser (monthly and annual buttons included) and checked which plan carries Google Consent Mode v2 and the IAB TCF. Compliance coverage weighs most because a banner that does not block trackers or send the right signal to Google fails at its one job.
- Compliance coverageAuto-blocking, Google Consent Mode v2, IAB TCF, laws covered.30%
- Ease of setupTime to a working banner on WordPress, Shopify or a custom site.25%
- Price transparencyWhether the vendor publishes an amount and its billing cycle.15%
- Value for small sitesWhat a single site with modest traffic gets for free or cheap.15%
- Scale and governanceMulti-domain, apps, DSAR and privacy modules.15%
No affiliate link changes a score or a rank.
Google and the regulators change the rules every year. Get the updates
Cookiebot
Cookiebot, made by Usercentrics, runs on 2.4 million websites and apps by its own count. It scans your site, sorts cookies into necessary, preferences, statistics and marketing, blocks the non-necessary ones until the visitor agrees, and writes your cookie declaration for you. It is a Google Gold Tier certified CMP partner, supports IAB TCF 2.4 on Premium, and also sends consent to Microsoft UET and Amazon.
Pricing follows the number of subpages, not traffic. Free covers one domain up to 50 subpages, with an initial scan only, a banner in 1 language and consent remembered for up to 1 month (12 months on Premium). Premium Lite costs $10 a month paid monthly, or $120 a year on the Yearly button, and your plan moves up on its own when the scanner finds more subpages. Each subdomain is billed as a separate domain, and the Small tier (50 to 349 subpages) requires at least four domains. Cookiebot belongs to Usercentrics: bigger groups get pushed to Usercentrics Advanced, a quote-based plan with a dedicated contact.
- Google Gold Tier CMP
- IAB TCF 2.4
- Automatic cookie declaration
- ISO 27001 and SOC 2 Type 2
- ✓Free plan for one small domain
- ✓Monthly scans on every Premium tier
- ✓Wix, WordPress, Shopify, GTM integrations
- ✗Free: initial scan, 1 language, 1-month consent
- ✗Each subdomain billed as its own domain
- ✗Daily scans cost extra (+€99/mo)
The safe default if your site runs Google tags. Count your subpages before you subscribe: a blog with thousands of tag pages lands on a higher tier than its traffic suggests. Leaving it later? Read our Cookiebot switch guide.
CookieYes
CookieYes is the plugin you meet first on WordPress: over 1 million active installations on WordPress.org with a 4.8-star rating from more than 3,200 reviews. The free plan already blocks cookies, scans 100 pages, logs consent and passes Google Consent Mode v2.
Paid plans are per domain and per month: Basic $10 (100,000 pageviews), Pro $25 (300,000 pageviews, geo-targeting) and Ultimate $55 (unlimited pageviews, CookieYes branding removed). The annual toggle gives 2 months free. Above the included traffic you pay $0.30 per 1,000 extra pageviews.
- 1M+ WordPress installs
- Consent Mode v2 on Free
- IAB TCF v2.4 from Pro
- Per-domain pricing
- ✓Fast setup
- ✓Clear grid
- ✓Strong reviews from small sites
- ✗Free stops at 5,000 pageviews a month
- ✗IAB TCF only from Pro ($25)
- ✗Every extra domain pays full price
The pick for a single WordPress or Shopify site. If you run ads that need the IAB TCF, budget for Pro, not Basic.
Osano
Osano starts free for one user and one domain up to 5,000 monthly visitors. Plus costs $199 a month for 2 users, 3 domains and 30,000 monthly visitors, and adds privacy and legal templates. Basic Privacy, on a quote, opens unlimited users and domains, compliance checks, subject rights intake forms and the No Fines Guarantee.
That guarantee is the hook: if a regulator fines you as a result of the platform, Osano covers it up to $500,000 under its terms of service. It sits on Basic Privacy, not on Free or Plus.
- Free plan
- No Fines Guarantee up to $500,000
- GDPR representative option
- Unlimited users and domains on Basic Privacy
- ✓Easy to run without developers
- ✓Support praised in the reviews it shows
- ✓Grows into DSAR and data mapping
- ✗Big jump from Free to $199/mo
- ✗Guarantee only from Basic Privacy
- ✗Quote above Plus
Plus at $199 a month is $2,388 a year: fair for 3 domains with legal templates, steep for one blog. Start free and move up when the visitor count forces you.
OneTrust
OneTrust is the enterprise reference: more than 750,000 websites use its Cookie Consent product, which scans cookies, tags and pixels, auto-blocks them and lets you A/B test banner templates. It is a Google certified CMP and integrates IAB Europe's TCF. Around it sit consent and preferences, DSAR, vendor risk and AI governance modules.
OneTrust publishes no amount: its Consent and Preferences package is priced on average daily visitors across all your channels and properties, and you book a call for a quote. Plan a real project, with a partner or an internal owner, rather than a one-afternoon install.
- Google certified CMP
- IAB TCF
- Banner A/B tests
- Full privacy suite
- ✓Covers web, apps and many entities
- ✓Deep integrations
- ✓One vendor for consent and governance
- ✗Custom quote only
- ✗Heavy for a single website
- ✗Priced on daily visitors across every property
Worth it when consent is one part of a privacy program with a team behind it. For one website, it is too much tool. Thinking of leaving? See OneTrust alternatives for switchers.
iubenda
iubenda sells consent and legal documents as one product: the banner, a privacy and cookie policy generator, a permanent consent log and, on higher plans, terms and conditions. It is a Google certified CMP partner with Consent Mode built in and an IAB-validated TCF CMP.
The grid shows euros by default, per site and per month when billed yearly: Essentials €4.99 (25,000 pageviews, one language), Advanced €19.99 (50,000 pageviews, all languages, geo-targeting), Ultimate €79.99 (150,000 pageviews, hourly scans, mobile SDK). Extra traffic costs €0.05 per 1,000 pageviews.
- Policy generator included
- Google certified CMP partner
- IAB TCF
- Mobile SDK on Ultimate
- ✓One bill for banner and policies
- ✓Cheap entry plan
- ✓Agency tools
- ✗Prices in euros by default
- ✗One language on Essentials
- ✗Pageview overage adds up on busy sites
A low-priced way to get the policies with the banner: €4.99 a month per site, billed yearly. Pick Advanced if your site speaks more than one language.
Didomi
Didomi supports IAB TCF v2.2, the Global Privacy Platform (GPP), and is certified for Google Consent Mode V2, with Microsoft UET Consent Mode and Amazon Consent Signal too. Its console lets marketing, legal and IT work on the same notices, and cross-device consent covers web, app and CTV.
The offers page lists Essential, Advanced and Premium, each with "Contact us": pricing is based on monthly unique visitors (MUV), with unlimited domains. Sourcepoint, a CMP many publishers used, announced it is joining Didomi; existing Sourcepoint customers keep their plan.
- IAB TCF v2.2 and GPP
- Google Consent Mode V2 certified
- Web, app and CTV
- Now includes Sourcepoint
- ✓Built for publishers
- ✓Notice A/B testing
- ✓Unlimited domains
- ✗Custom quote only
- ✗Overkill for a small site
- ✗Cross-device consent on request
A strong pick for media groups and apps. Ask for the MUV band in writing. More in our Didomi switch guide.
Ketch
Ketch prices on average monthly unique users across web and app properties, whether or not they touch the banner. Free covers up to 5,000 unique users and is not a trial. Starter is $150 a month billed monthly for up to 30,000, Plus from $499 a month billed annually for up to 100,000, and Pro is custom. Ketch is a Google Certified CMP Partner.
Its pitch is enforcement: choices flow to the downstream systems. DSR automation, data mapping, marketing preferences and risk assessments are sold separately from consent management.
- Free up to 5,000 unique users
- Google Certified CMP Partner
- 2 data system integrations
- Published prices
- ✓Clear grid
- ✓Counts people, not pageviews
- ✓Good for multi-site setups
- ✗Starter at $150/mo is a jump
- ✗Privacy modules priced apart
- ✗Plus only on annual billing
Starter for a year is $1,800. Worth it if consent must reach your CDP and ad tools; a plain blog does not need it.
Termly
Termly bundles a cookie banner, a cookie policy, a script auto-blocker and a policy generator. Free covers 10,000 banner views a month and one basic policy. Starter is $10 per site per month billed annually or $14 monthly, with 2 policies and 50,000 banner views. Pro+ is $15 billed annually or $20 monthly, with unlimited policies and banner views, multi-language banners and regional consent rules.
Watch what Starter leaves out: no consent logs (Pro+ and Agency only), no multi-language banner and no regional consent rules. Free and Starter get Basic Consent Mode; Advanced Consent Mode and IAB TCF 2.3 need Pro+.
- Policy generator
- Free plan
- IAB TCF 2.3 on Pro+
- WordPress plugin
- ✓Low price
- ✓Simple setup
- ✓Legal documents included
- ✗No consent logs below Pro+
- ✗Starter: one language, no regional rules
- ✗Advanced Consent Mode only from Pro+
With European visitors, go straight to Pro+: $15 per site a month billed annually, or $20 paid monthly, for consent logs, multi-language banners and regional rules. Starter ($120 a year against $168 paying monthly) suits a US-only site.
Complianz
Complianz is a WordPress plugin: the free version lives on WordPress.org, and Premium costs $59 a year for 1 website, $179 for 5 and $399 for 25, each with one year of support and updates. The free plugin already blocks third-party cookies and passes Google Consent Mode v2. Premium adds the IAB TCF, A/B testing, full records of consent, data request forms and a hybrid cookie scan; a WordPress Multisite network needs the Agency license.
The plugin works exclusively on WordPress; Shopify gets a separate app. Complianz is part of iubenda, and there is a 30-day money back guarantee.
- Runs inside WordPress
- Yearly license
- Multisite on Agency
- 30-day refund
- ✓Consent Mode v2 in the free plugin
- ✓No pageview or consent-record caps
- ✓Legal documents included
- ✗WordPress only
- ✗Shopify is a separate app
- ✗Updates stop if you do not renew
An economical choice for agencies with many WordPress sites: $399 a year covers 25, about $16 per site. Pair it with a good host (see our WordPress review).
Secure Privacy
Secure Privacy is a Google Partner CMP at Gold Tier and an IAB TCF v2.3 certified CMP. Free covers up to 10 domains and 500 consents a month with Google Consent Mode V2. Small costs $15 per domain per month billed monthly (5,000 consents), Business $59 (50,000 consents) and Advanced $249 (5 million consents).
Annual billing gives 2 months free. Note the metric: consents, not pageviews or sessions, so a site with a high opt-in rate uses its quota faster.
- Google Gold Tier
- IAB TCF v2.3
- Web and app SDKs
- Free for small sites
- ✓Published prices
- ✓Mobile coverage
- ✓Free plan across 10 domains
- ✗Free stops at 500 consents a month
- ✗Priced per domain
- ✗$249 per domain a month on Advanced
A good fit if you need app consent without an enterprise contract. Check your monthly consent count before choosing a tier.
CMPs we compared but did not rank
You will meet these names in other lists. Here is where each one fits, and why it is not in our top 10.
consentmanager: traffic-based plans from Europe
From €23/moA Google certified CMP that also covers apps and CTV. Starter costs €23 a month with 100,000 views a month included and €0.10 per extra 1,000; Essential costs €59 a month with 1 million views. It sits just outside our ten because its entry plan costs more than CookieYes Basic ($10) or iubenda Essentials (€4.99 billed yearly) for a small site.
CookieScript: unlimited pageviews from €9
Free planGoogle certified, with a free plan up to 10,000 pageviews a month. Lite costs €9 a month billed yearly (€108) or €11 paid monthly, and every paid plan has unlimited pageviews; Plus, at €29 a month billed yearly, is the one with all the GDPR tools. A good CookieYes rival for a busy site with few pages.
Usercentrics: the enterprise side of Cookiebot
The company behind Cookiebot. Its own plans are free under 1,000 monthly sessions on one domain, then priced by sessions; Usercentrics Advanced is the enterprise tier of Cookiebot, which is why it has no fiche of its own here.
TrustArc: enterprise governance
Enterprise privacy governance sold on quote, in the same league as OneTrust. Worth a look only if a privacy team will run DSARs, assessments and vendor risk on the same platform.
Sourcepoint and InMobi CMP: built for publishers
Sourcepoint, a CMP built for publishers, is now part of Didomi. InMobi CMP, formerly Quantcast Choice, is a free CMP aimed at publishers that monetize with programmatic ads.
Axeptio, CookieHub, Captain Compliance, Termageddon
Axeptio is a friendly banner from France, popular in Western Europe. CookieHub is a Google certified CMP with session-based plans from €6 a month, close to CookieYes in scope. Captain Compliance and Termageddon also come up when people compare CMPs; Termageddon is a policy generator first.
How to pick your cookie consent platform
Start with your platform, your traffic and whether you sell ads.
One small site on WordPress, Shopify or Wix
CookieYes Free or Cookiebot Free covers you until 5,000 pageviews or 50 subpages. Already shopping for a site? See our website builder picks.
A business site that runs Google Ads and Analytics
Make sure the plan sends Advanced Consent Mode v2 and, if you serve ads to Europe, the IAB TCF: Cookiebot Premium, CookieYes Pro, Termly Pro+. Check your setup in Google Tag Manager after install.
A company with DSARs, many domains or apps
Look at Osano, Ketch, Didomi or OneTrust, and compare them with our GDPR compliance software picks and our consent and preference management ranking.
Visitors from California: honor Global Privacy Control
Global Privacy Control (GPC) is a browser signal that says "do not sell or share my data". Under the CCPA, a business that sells or shares personal information must treat it as a valid opt-out request. Check the plan: on CookieYes, GPC support starts on Pro; Cookiebot and Osano list GPC among their features.
Keep the banner from slowing your pages
Every CMP adds a script to the head of each page, and the consent default has to run before any Google tag sends data. Load the CMP first, with the async attribute when the vendor's snippet allows it (Cookiebot's does), and check your page speed before and after install.
- Count your pageviews, sessions, unique visitors and subpages: each vendor meters a different one.
- Check that the banner blocks scripts before consent, not only after.
- Look for Google Consent Mode v2 on the exact plan you buy.
- Ask whether IAB TCF is included if you run programmatic ads in Europe.
- Compare monthly and annual prices on the same plan.
The four features that hide behind a plan
Google Consent Mode v2, the IAB TCF, automatic blocking and a consent log are the four features that decide whether a banner is compliant for ads. Here is the first plan that carries each one, for five CMPs that publish a full grid. OneTrust and Didomi sell them inside a quote.
| Consent Mode v2 · IAB TCF | Auto-blocking · consent log | |
|---|---|---|
| Cookiebot | Consent Mode v2 on Free · TCF 2.4 on Premium | Automatic blocking on Premium (manual on Free) · records kept up to 12 months on both |
| CookieYes | Consent Mode v2 on Free · TCF v2.4 from Pro ($25/mo) | Auto-blocking and consent log on every plan, Free included |
| Termly | Basic Consent Mode on Free and Starter, Advanced from Pro+ · TCF 2.3 on Pro+ | Script auto-blocker on every plan · consent logs from Pro+ |
| Complianz | Consent Mode v2 in the free plugin · TCF with Premium ($59/yr) | Third-party cookie blocking in the free plugin · records of consent with Premium |
| Secure Privacy | Consent Mode V2 on Free · TCF 2.3 from Small ($15/mo per domain) | Automatic blocking from Small |
First plan that carries each feature, from each vendor's pricing grid in 2026.
Pay less and stay compliant with your CMP
Small moves from pricing pages and user threads.
Match the meter to your site
Cookiebot counts subpages, CookieYes and iubenda pageviews, Usercentrics sessions, Ketch unique visitors, Secure Privacy consents. Pick the meter that fits your site: many pages and little traffic suit a pageview meter, few pages and heavy traffic suit the subpage meter of Cookiebot.
Take the annual button when you know you will stay
Termly Starter is $120 a year against $168 paid monthly. CookieYes and Secure Privacy give 2 months free on annual billing.
Check your cache after install
A page cache can keep serving a version of your pages built before the CMP was installed, with trackers firing before any choice. Clear the cache and check the network tab once you go live.
Keep Accept and Reject at the same weight
Give Accept and Reject buttons the same size and place, and put both on the first layer of the banner.
Do not lose your Google data
With Advanced Consent Mode v2, Google receives cookieless pings when visitors decline and models the gap. Check it in GA4; our Google Analytics switch guide covers privacy-first options.
Agencies: buy licenses in bundles
Complianz Agency covers 25 WordPress sites for $399 a year; iubenda and CookieYes have agency programs. Small business with GDPR duties? See our GDPR tools for small business.
Your case, your CMP
Start from what your site does, not from the brand you heard of first.
Google certified, IAB TCF v2.4 from $25 a month per domain.
Your site has few pages but heavy trafficCookiebotPriced on subpages, so traffic never moves the bill.
You run a dozen WordPress sites for clientsComplianz$399 a year for 25 sites, no pageview cap.
You need consent in a mobile app tooSecure PrivacyiOS and Android SDKs next to the web banner.
Consent must reach your CDP and ad toolsKetchFree to 5,000 unique users, then $150 a month.
You also need DSARs and a fines guaranteeOsanoNo Fines Guarantee up to $500,000 on Basic Privacy.
A new CMP enters the ranking or a plan changes? You'll hear first
Cookie consent platforms · FAQ
Do I need a Google certified CMP?
Yes, if you serve personalized ads through AdSense, Ad Manager or AdMob to visitors in the European Economic Area, the UK or Switzerland: Google then requires a CMP it has certified that integrates with the IAB TCF. The rule covers personalized ads. All ten CMPs ranked on this page are on Google's certified list, and so is the European regulations message that Google offers in the Privacy & messaging tab of its ad products.Does a US website need a cookie banner?
Often, yes. US state laws such as the CCPA/CPRA ask for an opt-out of the sale or sharing of data, and any EU or UK visitor brings GDPR rules. Most CMPs here ship a US opt-out template and a GDPR opt-in template and pick one by visitor location.Do all websites need cookie consent?
No. Under EU rules, cookies used only to carry a communication, such as load balancing, and cookies strictly necessary for a service the visitor asked for, such as a shopping basket or a login, need no consent. Tracking cookies for analytics, behavioral advertising or social plug-ins do, so a site that runs Google Analytics needs a banner.Is a cookie banner enough for GDPR?
No. The banner covers consent for cookies, but GDPR also asks you to explain in clear and plain language how you use personal data, and to answer requests from people who want to exercise their rights within 1 month, extendable by 2 months for complex cases. That is why Osano, Ketch and OneTrust sell request intake next to the banner.Can I use Google's own consent message for AdSense?
Yes, for Google's ads. The European regulations message built in the Privacy & messaging tab of AdSense, Ad Manager and AdMob is certified for the TCF requirement, lists the ad technology providers your site uses and asks for consent to personalized ads. You can also ask consent for your own site's use of data, but checking that the message meets the law stays your job, and it does not scan your site for other trackers the way a CMP does.Does my website have to honor Global Privacy Control?
Yes, if you sell or share the personal data of California residents. California's Attorney General lists a user-enabled global privacy control as an acceptable way for consumers to opt out; it is a "stop selling or sharing my data" switch built into browsers such as Firefox, DuckDuckGo and Brave, or added as an extension. So pick a plan that reads it.What is Google Consent Mode v2?
It is the way your CMP tells Google tags what the visitor accepted. In Basic mode, Google tags wait for consent; in Advanced mode, they send cookieless pings when consent is denied so Google can model conversions. Termly, for one, keeps Advanced for its Pro+ plan.