Consent Management (CMP)
CCM19
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Papoo Software & Media GmbH · www.ccm19.de
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
CCM19 at a glance
- Vendor
- Papoo Software & Media GmbH
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention Germany source, captured 29 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 29 Oct 2026
- Starting price
- “Starter EUR 7,90 Pro Monat / inkl. 19% USt” (vendor’s words) source, captured 29 Oct 2026
- Panel verdict
- The AI panel rates CCM19 3.5/5, the mean of 6 judges. CCM19 is a consent management platform from Papoo Software & Media GmbH, offered as a cloud service or a download version. how scores are made
- As of
- Vendor pages captured 29 Oct 2026 to 1 Nov 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
CCM19 is a consent management platform from Papoo Software & Media GmbH, offered as a cloud service or a download version. Its strongest mark is sovereignty, with scores clustered at 8: a German contracting entity (HRB 22721), hosting at OVH GmbH in Frankfurt or Hetzner Online GmbH in Gunzenhausen, a published data processing agreement with German subprocessors and 30-day change notice, and a download version keeping banner and logs on the customer's own server. Scanning and classification and standards and platforms follow at 6-7, built on automatic blocking of 210,000+ known cookies and a maintained database of over 1,000 providers. Pricing transparency and consent records sit lowest at 5-6: Free at 0 €, Starter at 7,90 € and Business at 19,90 € per month are public, but we found no public price for Enterprise from 100 domains, the agency rate, the TCF module or impression overage, and no public information on consent records tied to the banner version shown. Persona-weighted totals range from 6.0 to 6.7, with the widest spread on prior blocking at 5-7 and no substantial split.
Speaks for it
- Sovereignty scores cluster at 8, with the German contracting entity (HRB 22721), named German hosts, and a published data processing agreement with 30-day subprocessor change notice and objection rights
- An open-source download version keeps the banner and consent logs entirely on the customer's own server with no external transfer
- Scanning and classification scores sit at 6-7, with scheduled crawls from every 8 days on the free plan to daily on Business and a maintained database of over 1,000 providers
- Prior blocking scores run 5-7, covering 210,000+ known cookies blocked automatically before consent, iframes such as YouTube and Google Maps, and Google Consent Mode v2 in basic and advanced modes
- Tier prices are public — Free at 0 €, Starter at 7,90 € per month and Business at 19,90 € per month including VAT — with a 14-day trial without credit card or payment data
Held against it
- Pricing transparency scores sit at 5-6: we found no public price for the Enterprise tier from 100 domains, the agency per-domain rate, the TCF module, NoLabel licences, the installation service or impression overage
- Consent records scores sit at 5-6: we found no public information on records tied to the banner version and texts shown, a stated retention period, or withdrawal recorded as its own event
- The captured pages give different statements on TCF, one describing the product as not based on it and another listing certified TCF v2.4 as an activatable module
- We found no public information on a documented browser or tag-manager test that nothing loads before consent, or on consent passed to forms and CAPTCHAs
- We found no public information on a registered IAB CMP ID, Microsoft UET consent mode, GPP or GPC signals, or iOS and Android SDKs
Best for
- You need consent tooling with verifiably German hosting, or a self-hosted version that keeps all visitor data on your own server
- You run WordPress or Shopware sites and want automatic blocking plus a dynamic, self-updating cookie table for your privacy page
- You are an agency managing many client domains and want a multi-client version with white-label and a hosting API
- You want to start on published tier prices with a 14-day trial that closes automatically and requires no payment data
Avoid if
- You must defend consent records in a supervisory-authority dispute with each entry tied to the banner version and texts the visitor actually saw
- You must compute your full annual cost in advance — we found no public price for the Enterprise tier from 100 domains, the agency per-domain rate, the TCF module or impression overage
- You depend on a consistent TCF position for programmatic advertising — the captured pages give different statements on TCF
- You rely on forms or CAPTCHAs that must load before consent — we found no public information on consent being passed to them
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 3.5 of 5 |
| Prior blocking & script control | 3 of 5 |
| Scanning & cookie classification | 3.5 of 5 |
| Consent records & proof | 3 of 5 |
| Frameworks, signals & platforms | 3.5 of 5 |
| European sovereignty | 4 of 5 |
| Pricing transparency | 3 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Known scripts and cookies are blocked automatically before consent — the vendor cites more than 210,000 automatically blocked cookies and a tag-manager mode in which scripts are injected only after consent — and iframes such as YouTube and Google Maps are blocked, with a Google Tag Manager template and Basic Consent Mode documented to block all Google transmission until consent. We found no public information on a documented way for the site owner to verify on the live site that nothing fires before the click, on consent hooks for forms, CAPTCHAs and plugins, or on server-side tagging. 1 5 2 4
The Agency Developer
Automatic blocking covers 210.000+ known cookies via the onboarding scan, iframe blocking is documented for YouTube and Google Maps, a Google Tag Manager template with instructions is provided, and the product can itself act as a tag manager that injects scripts only after consent, with Google Consent Mode documented in basic and advanced modes. A permanent scan of the live site on every second page view checks for cookies, local storage and script elements. We found no public information on passing consent to forms, CAPTCHAs or plugins through a JavaScript API, on server-side tagging, or on a documented browser test that nothing loads before consent. 1 2 4 5
The Publisher Marketing Lead
Blocking is automatic for a claimed 210.000+ known cookies before consent, iframes from YouTube and Google Maps are blocked, foreign first-party cookies are deleted, and the product can run as the tag manager that injects scripts only after consent, with a Google Tag Manager template and instructions supplied — that covers my shop's pixels and ad tags before the visitor decides. We found no public information on a manual blocking mode, consent signals passed to forms and CAPTCHAs, server-side tagging, or a documented browser test that nothing loads early. 1 2 5
The In-House Lawyer
Automatic blocking of more than 210,000 known cookies, automatic deletion of foreign first-party cookies, iframe blocking for YouTube and Google Maps, and a Google Tag Manager template with instructions are documented, and the tool can act as tag manager itself, injecting scripts only after consent. We found no public information on manual blocking modes with their limits, consent passed to forms or CAPTCHAs, server-side tagging, or a documented browser or tag-manager test showing that nothing loads before consent. 1 2 5
The WordPress Webmaster
Automatic blocking of 210.000+ known cookies through the onboarding mechanism, iframe blocking for YouTube and Google Maps, and a Google Tag Manager template plus the option to use the tool itself as a tag manager cover exactly my Analytics, YouTube and Maps situation, with Consent Mode v2 documented in basic and advanced mode and third-party first-party cookies deleted automatically. I found no public information on consent being passed to forms, CAPTCHAs or plugins through a JavaScript API or events, on a manual blocking mode with its limits, or on instructions to verify in the browser or tag-manager preview that nothing loads before consent, so my reCAPTCHA contact form remains an open question. 1 2 4 5
The Skeptic
210,000+ known cookies are blocked automatically before consent, iframes such as YouTube and Google Maps are blocked, a Google Tag Manager template is provided, a tag-manager mode injects scripts only after consent, and Consent Mode basic mode is documented as blocking data transmission to Google until consent. We found no public information on a documented way to verify nothing loads before consent, on separate automatic and manual blocking modes with their limits, on server-side tagging, or on consent passed to forms and CAPTCHAs. 1 2 4 5
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
A scanner runs during onboarding, a permanent crawler re-checks the site — described as a scan at every second page view for cookies, local storage and script elements — and scheduled crawls run every 8 days, every 4 days or daily depending on the tariff, backed by a maintained database of over 1,000 providers, templates for thousands of cookies, and a dynamic cookie table for the privacy page. We found no public information on unknown trackers being flagged for review rather than silently classified, on scan depth or scanning behind logins, or on scan reports exportable for an audit. 2 5 1
The Agency Developer
An onboarding scan finds cookies and scripts and enters them with descriptions from a maintained database of more than 1.000 providers with templates for thousands of cookies, automatic rescans run every 8 days on the free plan up to daily on Business, and a permanent crawler checks for new cookies or scripts alongside a scan on every second page view. Results feed a dynamic cookie table for the privacy page with auto-updating legal texts — this is the scanner that would catch what a client adds on a Friday. We found no public information on email alerts for new or changed trackers, on scan depth or page counts, or on scanning behind logins. 1 2 3 5
The Publisher Marketing Lead
Onboarding scans the site and enters the found cookies and scripts, a permanent crawler re-checks on every second page view for cookies, local storage and script elements, and automatic crawls run every eight days on the free plan up to daily on the business plans, against a maintained database of weit über 1.000 providers that feeds a dynamic cookie table on the privacy page in multiple languages. The free cookie test even mails a PDF report listing non-essential cookies and third-country transfers. We found no public information on scanning behind logins, email alerts on new trackers, or a change history for audit. 1 2 3 5
The In-House Lawyer
An onboarding scan lists and classifies found cookies and scripts, a permanent crawler rechecks the page — including local storage — with scheduled crawls from every eight days down to daily by tariff, backed by a maintained database of over 1,000 providers and a dynamic, self-updating cookie table translated into more and more languages. Email alerts on new or changed trackers, a stated scan depth, scanning behind logins, and unknown trackers flagged for review rather than classified are not described in the captured pages. 1 2 3 5
The WordPress Webmaster
The scanner runs during onboarding, a permanent crawler re-checks on every second page view including local storage, and automatic crawls run every eight days on Free up to daily on Business, all classified from a maintained database of more than 1.000 providers that feeds a dynamic cookie table for my privacy page with auto-updating legal texts. That level of self-maintenance is what I want so the declaration survives plugin updates. I found no stated scan depth or page count, no scanning behind logins or in different regions, and no email alert on newly found or changed trackers. 1 2 5
The Skeptic
An onboarding scan detects cookies and scripts, scheduled crawls run from every 8 days on the free plan up to daily on Business, a runtime check on every second page view also covers local storage, a maintained database of over 1,000 providers classifies services, and a dynamic cookie table feeds the privacy page with auto-updating legal texts. We found no public information on scan depth or page counts, email alerts on new or changed trackers, or how unknown trackers are flagged for review. 1 2 3 5
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
The consent of every user is logged and documented in a secured database, IDs are pseudonymised with a sha-256 hash, the consent lifetime is configurable, all consent data can be exported, and consent is shared across domains and subdirectories. The item that decides a supervisory-authority dispute — each record tied to the banner version and texts the visitor actually saw — is not something we found public information on, and we likewise found none on a stated retention period for consent records, a consent ID the visitor can look up, or withdrawal being recorded as its own event. 1 2 5 8
The Agency Developer
Each user's consent is logged in a searchable protocol with sha-256-pseudonymised IDs, all consent data is exportable, the consent lifetime is configurable, and the log sits in a secured database with German hosting or entirely on the customer's own server in the download version. We found no public information on records tied to the banner version and texts shown, a consent ID the visitor could look up, retention for the consent log itself, or withdrawal recorded as its own event. 1 2 5 8
The Publisher Marketing Lead
Each consent can be logged and documented in a searchable protocol held in a secured database, user IDs are pseudonymised with a SHA-256 hash, the consent lifetime is configurable, all consent data is exportable via a data-query API, and consent is shared across domains and subdirectories — which serves my news site and shop under one status. We found no public information on a stated retention period for the records, the banner version being stored with each entry, or withdrawal being recorded as its own event. 1 2 5 8
The In-House Lawyer
Every consent is logged and searchable, exportable, stored encrypted and anonymised with SHA-256-pseudonymised IDs, a configurable consent lifetime, and sharing across subdomains and domains; the DPA documents EU processing and return or deletion of data at the end. We found no public information on records tied to the banner version and texts shown, a stated retention period for the consent log, or withdrawal recorded as its own event — the points I would need if a consumer group sued. 1 2 5 8
The WordPress Webmaster
Every consent is logged per user in a searchable protocol held in a secured database, all IDs are pseudonymised with SHA-256 hashing, the entire consent data can be exported, and the consent lifetime is configurable. I found no public information on a stated retention period for consent records, on records being tied to the banner version and texts shown, on withdrawal being recorded as its own event, or on a consent ID a visitor could look up. 1 2 5 8
The Skeptic
Every consent is logged per user with sha-256-pseudonymised IDs, stored encrypted and anonymised in a searchable protocol with a secured database, and export of all consent data, a data query API, configurable consent lifetime and cross-domain consent sharing are documented. We found no public information on records tied to the banner version shown, a stated retention period for the log, withdrawal captured as its own event, or tamper-evidence that would hold up in a dispute. 1 2 5 8
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
Google Consent Mode v2 is documented in basic and advanced mode with the vendor named a Google-certified CMP, IAB TCF v2.4 is certified and activatable as a module, and there is a WordPress plugin, a Shopware technology partnership, CMS-independent JS integration, a data-query API and a multi-client agency version with its own hosting API. We found no public information on a registered IAB CMP ID number, on Microsoft UET consent mode, GPP or GPC signals, or on iOS and Android SDKs. 4 5 6 1
The Agency Developer
Google certifies them as a CMP with Consent Mode v2 documented in basic and advanced modes including the Tag Manager steps, and there is a WordPress plugin, a Shopware technology partnership, snippet integration for any system, consent sharing across domains and per subdirectory, plus a multi-client agency version with white-label and hosting/headless APIs for customers, domains and themes. The captured pages give different statements on TCF: one describes the product as not based on TCF while others list certified TCF v2.4 as an activatable module. We found no public information on iOS or Android SDKs, Microsoft UET consent mode, GPP or GPC. 1 2 4 5 6
The Publisher Marketing Lead
Google Consent Mode v2 is supported with both the fully blocked basic mode and the advanced mode with pre-consent pings documented, the vendor presents itself as a Google-certified CMP, and the business plan can activate a certified TCF v2.4 module — the captured pages give different accounts of TCF, one stating the product does not base itself on it and another listing certified TCF v2.4 as a module. WordPress and Shopware sit alongside support for fast alle CMS and Shop Systeme, the agency version is multi-client with headless and hosting APIs, and the open download version runs on my own server. We found no public information on a registered IAB CMP ID, Microsoft UET consent mode, GPP or GPC signals, or iOS and Android SDKs — and tariffs sold per 'Domain / App' cannot replace documented SDKs. 1 2 4 5 6
The In-House Lawyer
The pages state an IAB TCF v2.4 certification and Google CMP certification, Google Consent Mode v2 in basic and advanced mode with the required signals named and a documented guide, WordPress and Shopware support among nearly all CMS and shop systems, a data query and hosting API, and multi-client agency use with white-label. Microsoft UET, GPP and GPC for US states, and iOS or Android SDKs are not described, and only the certification claim is shown, not an IAB registration number. 1 3 4 5
The WordPress Webmaster
The vendor is presented as a Google-certified CMP with Google Consent Mode v2 in both basic and advanced modes and the two required signals named, IAB TCF v2.4 is certified and available as an activatable module, and there is a WordPress plugin plus a multi-client agency version with a hosting API and consent sharing across domains. I found no public information on iOS or Android SDKs, GPP or Global Privacy Control, Microsoft ad signals, or a registered IAB Europe CMP ID number. 1 3 4 5
The Skeptic
Google Consent Mode v2 is documented in basic and advanced mode with the required signals, the vendor is named a Google-certified CMP, and WordPress and Shopware plugins, multi-client agency accounts, no-label licensing and a hosting API for domains, themes and embeds are public. One captured page states the product is not built on TCF while the pricing page lists certified TCF v2.4 as an activatable module; we found no public information on a registered CMP ID, Microsoft UET, GPP or GPC for US laws, or iOS and Android SDKs. 2 4 5 6
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
The contracting entity is Papoo Software & Media GmbH in Bonn (Registergericht Bonn, HRB 22721), the published AVV states processing within the EU and names German hosting at OVH GmbH in Frankfurt or Hetzner Online GmbH in Gunzenhausen, the subprocessors named in the AVV are shown as German companies with 30-day change notice and objection rights, and the pages state no US providers are used. Decisive for me is the download/on-premise version, which keeps all visitor data on the customer's own server with no external transfer, plus documented return or deletion with proof on request. We found no public information on the parent company or ownership, and the AVV lists ISO 27001 only as an example of acceptable evidence rather than as the vendor's own certification with its scope. 8 6 5 2 1
The Agency Developer
The contracting entity is Papoo Software & Media GmbH in Bonn (HRB 22721), hosting is named as OVH GmbH in Frankfurt or Hetzner Online GmbH in Gunzenhausen with no US providers, and the published AVV lists German subprocessors, EU-only processing, a named data protection officer, audit rights and deletion with proof on request. An open-source download version keeps the banner and all data on the customer's own server. We found no public information on security certifications such as ISO 27001 or SOC 2 held for the product itself. 1 2 5 6 8
The Publisher Marketing Lead
The chain is German and named: Papoo Software & Media GmbH is registered at the Bonn court under HRB 22721, cloud data sits on servers at the OVH GmbH in Frankfurt or the Hetzner Online GmbH in Gunzenhausen, and the downloadable data processing agreement states processing within the EU, names a data protection officer, requires 30 days' notice and an objection right for subprocessor changes, and promises return or deletion of all data at contract end. The download version keeps the banner and the logs entirely on my own server with no external transfer. We found no public information on ISO 27001 or SOC 2 certification or on the ownership chain above the GmbH. 1 2 5 6 8
The In-House Lawyer
The contracting entity is Papoo Software & Media GmbH in Bonn (HRB 22721), processing is stated to stay within the EU on named German hosts (OVH in Frankfurt, Hetzner in Gunzenhausen) with no US providers, a downloadable DPA with a named data protection officer, subprocessor changes only with notice and an objection right, and return or deletion with proof on request. A self-hosted open-source download version keeps the banner and all data on the customer's own server with no external transfer; however, ISO 27001 appears in the DPA only as an example of accepted audit evidence, and we found no statement that the vendor holds a certification or publishes its scope. 1 2 5 6 8
The WordPress Webmaster
The contracting entity is Papoo Software & Media GmbH in Bonn with a published data processing agreement, servers are named at OVH GmbH in Frankfurt and Hetzner Online GmbH in Gunzenhausen with all data in Germany and no US providers, and the subprocessors named in the agreement are German companies with a 30-day change notice and objection right. The open-source download version keeps all data on my own server with no transfer to external services, which is as sovereign as it gets for a plugin buyer. I found no public information on a vendor's own ISO 27001 or SOC 2 certification; the agreement only names such certifications as accepted audit evidence. 1 2 5 6 8
The Skeptic
The contracting entity is Papoo Software & Media GmbH registered in Bonn (HRB 22721), servers are named at OVH in Frankfurt and Hetzner in Gunzenhausen with all data stated to remain in Germany and the EU without US providers, the published AVV names German subprocessors with 30-day change notice and approval rights, and an open-source download version keeps banner and logs entirely on the customer's own server. We found no public information on vendor security certifications, the ownership structure, or the CDN serving the banner script. 1 2 5 6 8
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
Free (1 domain, 5,000 impressions), Starter ("EUR 7,90 Pro Monat / inkl. 19% USt", 2 domains, 20.000 Impressions inkl.) and Business ("€ 19,90 Pro Monat / inkl. 19% USt", 5 domains, 100.000 Impressions inkl.) are public with their limits, alongside a 14-day trial without payment data, automatic closure after 14 days, and a one-month or one-year term cancellable at its end. We found no public information on the price of the enterprise tier from 100 domains, the agency version's actual figures, overage behaviour beyond the included impressions, or add-ons such as the TCF module, NoLabel licences or the installation service. 5 1
The Agency Developer
Tiers are public: Free at 0,- for one domain and 5.000 impressions, Starter at EUR 7,90 a month for two domains and 20.000 impressions, Business at € 19,90 for five domains and 100.000 impressions, VAT included, with one-month or one-year terms, a 14-day trial that closes without auto-renewal, and plan limits spelled out for languages, crawl frequency and storage. The Enterprise tier from 100 domains, the per-domain figures of the agency version, extra domains, impression overages and the installation service carry no public prices, so I cannot compute the annual cost for forty client sites from these pages alone. 1 5
The Publisher Marketing Lead
Free, Starter and Business are publicly priced — 'Free 0,-', 'Starter EUR 7,90 Pro Monat / inkl. 19% USt' with 2 domains and 20.000 Impressions inkl., 'Business € 19,90 Pro Monat / inkl. 19% USt' with 5 domains and 100.000 Impressions inkl. — with a 14-day card-free trial and terms of one month or a year cancellable to the end. I still cannot compute my annual cost: we found no public price for the enterprise tier ab 100 domains, the agency version billed pro Domain / pro Monat, impressions above the included allowance, white-label licences, the TCF module or the installation service. 1 5
The In-House Lawyer
Free, Starter at EUR 7,90 and Business at € 19,90 per month including 19% VAT are published with per-tier domain and impression limits (for example 5 domains and 100.000 impressions in Business), a 14-day trial without credit card that closes automatically, and terms of one month or a year cancellable at term end. What happens above the impression limits, and the prices of the TCF module, no-label licences, the installation service, the agency tariff billed per domain per month, and the enterprise tier from 100 domains, are not published on the captured pages. 1 2 5
The WordPress Webmaster
Free with one domain and 5.000 impressions, Starter 'EUR 7,90 Pro Monat / inkl. 19% USt' for two domains and 20.000 impressions, and Business '€ 19,90 Pro Monat / inkl. 19% USt' for five domains and 100.000 impressions are public, with monthly or yearly terms cancellable at the end and a 14-day trial that closes automatically without renewal or credit card. I found no public information on prices for the Enterprise tier from 100 domains, the TCF module, the NoLabel licence, the installation service, agency volume tiers or traffic overage, so my exact annual cost depends on which of those I end up needing. 1 2 5
The Skeptic
Free at 0 €, Starter at 7,90 € per month and Business at 19,90 € per month are public with domain counts and included impressions, VAT included, a 14-day trial without payment details, and terms of one month or a year cancellable to period end. Enterprise pricing from 100 domains, the agency version's per-domain rate, the TCF module, no-label licences and impression overage are not priced publicly, so a buyer cannot compute the full annual cost from the public pages. 1 5
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined ⚠ unverified | — | uncited Report an error |
Questions about CCM19
Is CCM19 European?
Yes. whats-best.ai classifies CCM19 as EU-Made.
Where does CCM19 store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention Germany as hosting location, per the vendor’s page captured 29 Oct 2026.
Does CCM19 have a free plan?
Yes. CCM19 has a free plan, per the vendor’s page captured 29 Oct 2026.
What are the best alternatives to CCM19?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and Cookie Information (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: CCM19 alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Transfer impact assessment, Hosting location, Hosting options, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 32 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 5 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (11)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.ccm19.de Checked 29 Oct 2026 Details →
- 2 Features page www.ccm19.de Checked 29 Oct 2026 Details →
- 3 Features page (cookie scanner) www.ccm19.de Checked 29 Oct 2026 Details →
- 4 Features page (Google Consent Mode v2) www.ccm19.de Checked 29 Oct 2026 Details →
- 5 Pricing page www.ccm19.de Checked 29 Oct 2026 Details →
- 6 Legal notice www.ccm19.de Checked 29 Oct 2026 Details →
- 7 Privacy policy www.ccm19.de Checked 29 Oct 2026 Details →
- 8 Data processing agreement (dpa) www.ccm19.de Checked 29 Oct 2026 Details →
- 9 Security / trust page — found from the homepage www.ccm19.de Checked 1 Nov 2026 Details →
- 10 Self-hosting / on-premises installation docs — found from the homepage www.ccm19.de Checked 1 Nov 2026 Details →
- 11 Code repository (open-source licence) — found from the homepage github.com Checked 1 Nov 2026 Details →