# CCM19 — Consent Management (CMP)

CCM19 by Papoo Software & Media GmbH holds a panel rating of 3.5/5 from 6 AI judges (category median 3/5), as of 2026-10-30. Provenance: EU-Made; sovereignty: not determined.

- Vendor: Papoo Software & Media GmbH (https://www.ccm19.de/)
- Category: [Consent Management (CMP)](https://whats-best.ai/software/consent-management.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/consent-management/ccm19
- Alternatives: https://whats-best.ai/software/consent-management/ccm19/alternatives ([markdown](https://whats-best.ai/software/consent-management/ccm19/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-10-30 · oldest source captured 2026-10-29

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Papoo Software & Media GmbH
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Default not stated; pages mention Germany [S5]
- Free plan: Yes, per the vendor’s own page [S5]
- Starting price: “Starter EUR 7,90 Pro Monat / inkl. 19% USt” (vendor’s words) [S5]

## The panel's verdict

CCM19 is a consent management platform from Papoo Software & Media GmbH, offered as a cloud service or a download version. Its strongest mark is sovereignty, with scores clustered at 8: a German contracting entity (HRB 22721), hosting at OVH GmbH in Frankfurt or Hetzner Online GmbH in Gunzenhausen, a published data processing agreement with German subprocessors and 30-day change notice, and a download version keeping banner and logs on the customer's own server. Scanning and classification and standards and platforms follow at 6-7, built on automatic blocking of 210,000+ known cookies and a maintained database of over 1,000 providers. Pricing transparency and consent records sit lowest at 5-6: Free at 0 €, Starter at 7,90 € and Business at 19,90 € per month are public, but we found no public price for Enterprise from 100 domains, the agency rate, the TCF module or impression overage, and no public information on consent records tied to the banner version shown. Persona-weighted totals range from 6.0 to 6.7, with the widest spread on prior blocking at 5-7 and no substantial split.

**Speaks for it:**
- Sovereignty scores cluster at 8, with the German contracting entity (HRB 22721), named German hosts, and a published data processing agreement with 30-day subprocessor change notice and objection rights
- An open-source download version keeps the banner and consent logs entirely on the customer's own server with no external transfer
- Scanning and classification scores sit at 6-7, with scheduled crawls from every 8 days on the free plan to daily on Business and a maintained database of over 1,000 providers
- Prior blocking scores run 5-7, covering 210,000+ known cookies blocked automatically before consent, iframes such as YouTube and Google Maps, and Google Consent Mode v2 in basic and advanced modes
- Tier prices are public — Free at 0 €, Starter at 7,90 € per month and Business at 19,90 € per month including VAT — with a 14-day trial without credit card or payment data

**Held against it:**
- Pricing transparency scores sit at 5-6: we found no public price for the Enterprise tier from 100 domains, the agency per-domain rate, the TCF module, NoLabel licences, the installation service or impression overage
- Consent records scores sit at 5-6: we found no public information on records tied to the banner version and texts shown, a stated retention period, or withdrawal recorded as its own event
- The captured pages give different statements on TCF, one describing the product as not based on it and another listing certified TCF v2.4 as an activatable module
- We found no public information on a documented browser or tag-manager test that nothing loads before consent, or on consent passed to forms and CAPTCHAs
- We found no public information on a registered IAB CMP ID, Microsoft UET consent mode, GPP or GPC signals, or iOS and Android SDKs

**Best for:**
- You need consent tooling with verifiably German hosting, or a self-hosted version that keeps all visitor data on your own server
- You run WordPress or Shopware sites and want automatic blocking plus a dynamic, self-updating cookie table for your privacy page
- You are an agency managing many client domains and want a multi-client version with white-label and a hosting API
- You want to start on published tier prices with a 14-day trial that closes automatically and requires no payment data

**Avoid if:**
- You must defend consent records in a supervisory-authority dispute with each entry tied to the banner version and texts the visitor actually saw
- You must compute your full annual cost in advance — we found no public price for the Enterprise tier from 100 domains, the agency per-domain rate, the TCF module or impression overage
- You depend on a consistent TCF position for programmatic advertising — the captured pages give different statements on TCF
- You rely on forms or CAPTCHAs that must load before consent — we found no public information on consent being passed to them

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Data Protection Officer | The Agency Developer | The Publisher Marketing Lead | The In-House Lawyer | The WordPress Webmaster | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Banner & choice architecture | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 | 3/5 |
| Prior blocking & script control | 3/5 | 3.5/5 | 3/5 | 3/5 | 3/5 | 2.5/5 |
| Scanning & cookie classification | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 |
| Consent records & proof | 2.5/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Frameworks, signals & platforms | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 |
| European sovereignty | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Pricing transparency | 2.5/5 | 2.5/5 | 3/5 | 3/5 | 3/5 | 2.5/5 |
| **Weighted verdict** | **3/5** | **3.5/5** | **3.5/5** | **3.5/5** | **3.5/5** | **3/5** |

### The judges

- **The Data Protection Officer** (v1.0): External DPO for a dozen mid-sized companies, two of which received a letter from a state supervisory authority about their cookie banner last year. Wants reject on the first layer, nothing loaded before the click, a consent log that shows which banner version each visitor saw, a cookie list that matches the site, and a DPA and subprocessor list that keep visitor data in the EU.
- **The Agency Developer** (v1.0): Lead developer at a web agency that maintains forty client sites on WordPress, TYPO3 and Shopify. Wants one account for every client, blocking that works without rewriting each theme, content blockers for YouTube and Maps, a Tag Manager template, a scanner that flags the tracker a client added on Friday, and a JavaScript API documented well enough that forms and plugins can ask for consent.
- **The Publisher Marketing Lead** (v1.0): Runs marketing for an ad-funded news site and an online shop in the same group, where every point of consent rate shows up in ad revenue and in Google Ads conversions. Wants a registered IAB TCF CMP, Google Consent Mode v2 in advanced mode, banner tests within what the law allows, consent shared between the site and the app, and a dashboard that shows where visitors drop off.
- **The In-House Lawyer** (v1.0): In-house counsel at a retailer with shops in Germany, France and Austria, who has read the court decisions on missing reject buttons and the regulators' banner guidance. Wants § 25 TDDDG and the GDPR mapped to concrete settings, equal-weight choices as the default, consent that can be withdrawn as easily as it was given, and records that would hold up if a competitor or a consumer group sued.
- **The WordPress Webmaster** (v1.0): Looks after the WordPress site of a mid-sized engineering company on top of the actual job, with Google Analytics, a YouTube channel, a Maps embed and a contact form with reCAPTCHA. Wants a plugin that finds these by itself, blocks them until the visitor agrees, survives the next plugin update and caching, and costs a known amount per site per year without a call to sales.
- **The Skeptic** (v1.0): Has opened the browser's network tab on sites with a "certified" banner and watched the ad pixels fire before anything was clicked. Reads "consent rate optimisation" as a hint that reject will be grey and small, "auto-blocking" as a claim until the test steps are published, and "EU hosting" next to a US script CDN — and asks what leaving would cost: the consent logs, and every visitor asked again.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Audit rights: yes · yes · aktuelles Testat · Berichte unabhängiger Instanzen · Zertifizierung z.B. ISO 27001 [S8]
- AVV available: yes · yes [S1]
- AVV download process: PDF · yes · yes [S8]
- AVV submission email: info@ccm19.de · AVV_Firmenname_Datum [S8]
- Bfsg: BFSG (accessibility law) addressed [S4]
- Breach notification: unverzügliche Information des Auftraggebers bei Datenschutzverletzung [S8]
- Data processing location: yes · yes [S8]
- Data return deletion: yes · yes [S8]
- DPA: AVV (Auftragsverarbeitungsvertrag) verlinkt [S6]
- DPA available: yes [S5]
- DPA date: 2022-05-02 · Bonn [S8]
- DPA duration: yes [S8]
- Encrypted payments: Visa/MasterCard · Lastschriftverfahren · yes [S7]
- Google certified cmp: yes [S1]
- Google certified cmp: yes [S4]
- Google certified cmp: yes [S6]
- Matomo ip anonymization: yes [S7]
- Membership: Gesellschaft für Datenschutz und Datensicherheit e.V. [S6]
- Regulations: TDDDG · DSGVO · CCPA · BDSG · LGPD · POPIA [S1]
- Ssl tls encryption: yes [S7]
- Subprocessor approval: yes [S8]
- Subprocessor change notice: yes · 30 [S8]

**Data**
- Cloud anonymized: yes [S1]
- Consent withdrawable: yes · yes [S7]
- Matomo self hosted: Matomo · yes [S7]
- Newsletter retention: until unsubscribe; deleted after cancellation [S7]
- Portability right: yes [S7]
- Registration data deletion: stored while registered, deleted afterwards [S7]
- Retention default: until purpose ceases, subject to statutory retention periods [S7]
- Server log data: Browsertyp und Browserversion · verwendetes Betriebssystem · Referrer URL · Hostname des zugreifenden Rechners · Uhrzeit der Serveranfrage · IP-Adresse [S7]

**Hosting**
- Data location: no · yes [S5]
- EU only servers: yes [S2]
- Germany: yes [S1]
- Germany: Deutschland [S6]
- Germany no US providers: yes · yes · yes [S2]
- Providers: OVH GmbH · Frankfurt, Deutschland · Hetzner Online GmbH · Gunzenhausen, Deutschland [S8]
- Server location: yes · Germany [S5]

**Integrations**
- Cms support: Plugins und Oberflächen fast aller CMS / Shop Systeme [S5]
- Data API: yes [S1]
- Google support: Tag Manager · Analytics · Ads · Adsense [S5]
- Gtm template: yes [S1]
- Js snippet: js_code_snippet [S1]
- Shopware partner: yes [S6]
- Wordpress plugin: yes [S5]

**Legal**
- Address: Bonn · Auguststr. 4 · Deutschland · 53229 [S6]
- Content responsible: Dr. Carsten Euwens [S6]
- Controller: Papoo Software & Media GmbH · Dr. Carsten Euwens · Auguststr. 4, 53229 Bonn [S7]
- Disclaimer no legal advice: keine Rechtsberatung [S6]
- Dispute resolution: no [S6]
- Duns: 314176287 [S6]
- Entity name: Papoo Software & Media GmbH [S6]
- Membership: Gesellschaft für Datenschutz und Datensicherheit e.V. [S2]
- No legal advice: no [S3]
- Register: Bonn · HRB 22721 [S6]
- Trademark: 018645295 [S6]
- VAT id: DE310616179 [S6]
- Vendor entity: Papoo Software & Media GmbH · Auguststr. 4, 53229 Bonn [S8]

**Pricing**
- Agency billing: per_domain_per_month · yes [S1]
- Business domains: 5 · 20000 · 100000 [S5]
- Business price: yes · monthly · 19.9 [S5]
- Contract terms: 1_month_or_year · yes [S1]
- Download all tariffs: yes [S1]
- Enterprise domains: 100 · ab 100 [S5]
- Enterprise plan exists: größere Unternehmen, Konzerne & Behörden · yes [S5]
- Free domains: 1 · 1000 · 5000 [S5]
- Free tier: Free · yes · 0 [S5]
- Freetarif: yes [S4]
- Starter domains: 2 · 4000 · 20000 [S5]
- Starter price: yes · monthly · 7.9 [S5]
- Trial: 14 · no [S5]
- Trial auto close: no · 14 [S5]

**Product**
- Ab tests: yes [S5]
- Accessibility: yes [S1]
- Accessibility: WCAG · EN 301 549 · BITV [S5]
- Accessibility contrast check: Theme builder warns about button contrast for accessibility [S2]
- Affected persons: Webseitenbesucher oder App-Nutzer · Kunden / Registrierte User [S8]
- Agency headless API: yes [S1]
- Agency multi client: yes [S1]
- Agency nolabel: yes [S1]
- Analytics reporting: Business · yes [S5]
- Apache nginx: Apache · NGINX · yes [S5]
- API: yes [S5]
- Automatic detection: Automatic cookie and script detection during onboarding [S2]
- Automatic updates: yes [S5]
- AVV available: yes · no [S2]
- Banner languages: 2 · 2 · 60+ · 60+ [S5]
- Cms independent: yes [S1]
- Compliance standards: TDDDG, DSGVO, CCPA, CH DSG, BDSG, LGPD, POPIA konform [S5]
- Consent banner buttons: .Ablehnen · Informationen · Akzeptieren · yes [S2]
- Consent documentation: Consent documentation via searchable log fulfilling GDPR accountability [S2]
- Consent encrypted anonymous: yes · yes [S2]
- Consent export: yes [S1]
- Consent lifetime: yes [S5]
- Consent logging: yes [S1]
- Consent management: CCM19 stores the cookie consent status in local storage (ccm_consent, 1 Jahr) [S7]
- Consent mode activation: Consent Mode is activated per Google application entry (e.g. Google Analytics or Google Tag Manager) under 'Einbindungen & Cookies' [S4]
- Consent mode advanced: Advanced Mode: pings sent to Google without consent; personal data only stored after consent [S4]
- Consent mode basic: Basic Mode: tracking cookies and data transmission to Google completely blocked until user consents [S4]
- Consent mode deadline: March 2024 [S4]
- Consent mode v2: ad_user_data · ad_personalization · yes [S4]
- Consent mode v2 docs: Documentation for Google Consent Mode v2 available [S2]
- Consent per subdirectory: Consent queryable per language or subdirectory [S2]
- Consent protocol: yes · yes [S5]
- Consent sharing: yes [S1]
- Consent storage: Cookie · Local Storage · Session Storage · nur Local Storage [S5]
- Container image: yes · 2021-09 [S2]
- Cookie crawler: alle 8 Tage · alle 4 Tage · täglich wenn gewünscht · täglich wenn gewünscht [S5]
- Cookie deletion: yes [S1]
- Cookie groups: yes [S1]
- Cookie policy database: >1000 [S2]
- Cookie table: yes [S1]
- Cookie templates: Vorlagen für tausende der wichtigsten Cookies von Google Ads, Analytics, Facebook, Matomo uvm. [S5]
- Cookies blocked automatically: yes · 210000 [S1]
- Cross domain consent: yes · yes · yes · yes [S2]
- Cross domain consent: yes [S5]
- Custom css: in vielen Tarifen · yes [S1]
- Custom css: yes [S2]
- Cybersecurity check: 3.9 · yes [S5]
- Cybersecurity check free: yes · yes [S5]
- Data categories: Consent Daten · Device Daten · anonymisierte IP Daten · Browserdaten bei erweiterter Statistik · Einstellungen · Login Daten [S8]
- Data export: yes [S5]
- Data retention logfiles: yes · 24 [S8]
- Deployment models: OnPremise · Agency · Cloud [S1]
- Do not track: yes [S1]
- Download version data control: no [S1]
- Empco manager: yes [S1]
- Empco manager: New EmpCo Manager product offered, free trial [S4]
- Empco manager: EmpCo Manager, EmpCoManager.com [S6]
- Empco manager: New EmpCo Manager for EmpCo directive compliance [S2]
- Free trial: yes · no [S1]
- GDPR ttddg compliance: Enables GDPR and TDDDG compliance [S2]
- Geo localization: Business · yes [S5]
- Geo targeting: yes [S1]
- Geo targeting: Real-time geo targeting, e.g. hide banner for non-EU visitors [S2]
- Google certified cmp: yes [S3]
- Google certified cmp: yes [S2]
- Google consent mode: yes [S5]
- Hosting API: hosting · customers · domains · themes · embeddings [S5]
- Iab tcf: yes · yes [S5]
- Iframe blocking: yes [S5]
- Installation service: yes [S1]
- Installations count: 268910 [S2]
- Languages supported: 50 [S1]
- Multilingual: Multilingual by default, incl. cookie database; custom languages in agency/ICMP versions [S2]
- Multilingual admin: yes · yes [S1]
- No database: no [S1]
- Nolabel: yes [S5]
- Nolabel license: yes [S2]
- Online demo: yes · 30 [S1]
- Onpremise available: yes [S1]
- Onpremise available: yes · yes [S2]
- Open source: yes [S1]
- Open source github: yes [S4]
- Open source onpremise: yes · yes [S5]
- Permanent cookie scan: every 2nd page view [S2]
- Permanent crawler: Permanent crawler checks for new cookies/scripts [S2]
- Pseudonymization: consentID · processorID · sha-256 hash [S8]
- Quick integration: 5 [S2]
- Related checkers: Google Fonts Checker · Google Analytics Checker [S3]
- Report contents: Report lists non-essential cookies and embeds/external resources possibly transferring data to unsafe third countries [S3]
- Report delivery: PDF-Report per Mail [S3]
- Scan purpose: Scanner checks whether the website sets cookies and produces a report to decide if a cookie banner is required [S3]
- Scan statistics: 6989592 · 597199 · 137447 [S3]
- Scanner: yes [S1]
- Scanner free: yes [S3]
- Shopware partner: yes [S2]
- Sites using: 268925 · 23869 [S1]
- Statistics ab testing: yes · yes · yes [S2]
- Subpages unlimited: yes [S5]
- System requirements: 8.2 · no · yes [S1]
- Tag manager functionality: Can be used as tag manager; scripts injected only after consent [S2]
- Tcf consent mode: v2.4 · v2 [S1]
- Tcf module business: Business · yes [S5]
- Tdgd compliance bgh: yes [S1]
- Tenant separation: yes · logisch über Benutzer- und Berechtigungskonzepte · yes [S8]
- Text autoupdate: yes · yes [S5]
- Theme layouts: yes [S1]
- Trusted by claims: Alternativen zu Cookiebot, Usercentrics, ConsentManager, OneTrust [S6]
- Works in any cms: yes · yes · yes [S2]

**Support**
- Channels: german-speaking human support [S1]
- Channels: no · ticket · email · phone [S5]
- Consent mode docs: https://docs.ccm19.com/frontend/google-consent-mode-v2/ [S4]
- German language: German-speaking support [S2]
- Personal german: no · German · yes [S5]

## Questions

### Is CCM19 European?

Yes. whats-best.ai classifies CCM19 as EU-Made.

### Where does CCM19 store data?

The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention Germany as hosting location, per [the vendor’s page captured 29 Oct 2026](https://whats-best.ai/evidence/12282).

### Does CCM19 have a free plan?

Yes. CCM19 has a free plan, per [the vendor’s page captured 29 Oct 2026](https://whats-best.ai/evidence/12282).

### What are the best alternatives to CCM19?

As of 3 Nov 2026, the panel rates [Usercentrics CMP (3.5/5)](https://whats-best.ai/software/consent-management/usercentrics), [Didomi (3.5/5)](https://whats-best.ai/software/consent-management/didomi) and [Cookie Information (3.5/5)](https://whats-best.ai/software/consent-management/cookie-information) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Usercentrics CMP](https://whats-best.ai/software/consent-management/usercentrics) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [CCM19 alternatives](https://whats-best.ai/software/consent-management/ccm19/alternatives).

## What this page leaves out

- 32 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 5 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.ccm19.de/ (checked 2026-10-29)
- [S2] Features page: https://www.ccm19.de/alle-features/ (checked 2026-10-29)
- [S3] Features page (cookie scanner): https://www.ccm19.de/cookie-scanner/ (checked 2026-10-29)
- [S4] Features page (Google Consent Mode v2): https://www.ccm19.de/google-consent-mode-v2-mit-ccm19-einrichten.html (checked 2026-10-29)
- [S5] Pricing page: https://www.ccm19.de/ccm19-preise.html (checked 2026-10-29)
- [S6] Legal notice: https://www.ccm19.de/impressum.html (checked 2026-10-29)
- [S7] Privacy policy: https://www.ccm19.de/datenschutzerklaerung.html (checked 2026-10-29)
- [S8] Data processing agreement (dpa): https://www.ccm19.de/auftragsverarbeitungsvertrag-ccm19.html (checked 2026-10-29)
- [S9] Security / trust page — found from the homepage: https://www.ccm19.de/website-security-check.html (checked 2026-11-01)
- [S10] Self-hosting / on-premises installation docs — found from the homepage: https://www.ccm19.de/tarif.html (checked 2026-11-01)
- [S11] Code repository (open-source licence) — found from the homepage: https://github.com/CCM19 (checked 2026-11-01)

---

Cite as: whats-best.ai, "CCM19 — Consent Management (CMP)", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/consent-management/ccm19

Corrections: https://whats-best.ai/correct/1154?target=page