Consent Management (CMP)
Commanders Act Consent Management
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Commanders Act SAS · www.commandersact.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Commanders Act Consent Management at a glance
- Vendor
- Commanders Act SAS
- Headquarters
- Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting
- Default not stated; pages mention the EU source, captured 3 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 3 Nov 2026
- Panel verdict
- The AI panel rates Commanders Act Consent Management 3/5, the mean of 6 judges. Commanders Act's consent management platform is strongest at scanning and classification, where scores cluster at 8-9: a scanner running continuously on real user traffic, capturing first- and third-party cookies plus local and session storage, auto-categorising each cookie with its responsible vendor, and alerting on undeclared cookies in real time. how scores are made
- As of
- Vendor pages captured 3 Nov 2026; evaluated by the panel 3 Nov 2026. all sources
Commanders Act Consent Management alternatives, European ones first →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Commanders Act's consent management platform is strongest at scanning and classification, where scores cluster at 8-9: a scanner running continuously on real user traffic, capturing first- and third-party cookies plus local and session storage, auto-categorising each cookie with its responsible vendor, and alerting on undeclared cookies in real time. Prior blocking scores 6-8 — the publisher marketing lead scored 8 on live detection of cookies set before consent, while the WordPress webmaster scored 6, finding no public information on placeholders for embedded videos and maps. Consent records, at 4-5, and sovereignty, at 4-6, are the soft spots: timestamped logs and archiving across all devices are described, but we found no public information on log retention, export or the banner version behind each record, and beyond a Paris contracting entity (FJORD TECHNOLOGIES SAS) with data centres in the European Union as stated on the vendor's pages, the data processing agreement, subprocessors and banner-script hosting are undocumented. No criterion spans more than two points and no meaningful disagreements were computed; pricing transparency, at 0-2, reflects pages with no published prices.
Speaks for it
- Scanning and classification scores cluster at 8-9 on a scanner that watches real user traffic continuously, covering first- and third-party cookies plus local and session storage
- Undeclared and pre-consent cookies trigger real-time alerts via Slack, email or webhook, with the exposure window narrowed to 'a few minutes'
- Automatic categorisation with description and responsible vendor feeds a continuous, exportable audit trail and updates the cookie notice dynamically
- IAB TCF 2.2 is supported under Vendor ID 416, with Google certification for Consent Mode v2 activated from the Settings tab
- Geo-targeted local banner templates cover GDPR, CPRA, VCDPA, CTDPA, CPA, Loi 25 and DMA, including an accessibility template conforming to RGAA and WCAG 2.0 AA
Held against it
- Consent records scores sit at 4-5, with no public information on log retention, export or the banner version behind each record
- Sovereignty scores span 4-6, with no public information on a data processing agreement, a subprocessor list or where the banner script is served from
- Pricing transparency scores 0-2, and the captured pages carry no price figures, tiers or free-tier limits
- The consent-rate programme is pitched at 'targeting cookie-abstentionists' and a 'Cookie Keeper' saving 'up to 20% of cookies', which the in-house lawyer would want reviewed before a German rollout
- We found no public information on placeholders for embedded videos and maps, on automatic versus manual blocking modes, or on CMS plugins and a configuration API
Best for
- You run many third-party tags across web and apps and want continuous real-traffic scanning that catches conditional tags and undeclared cookies on their first appearance
- You need IAB TCF 2.2 and Google-certified Consent Mode v2, with geo-targeted banner templates covering GDPR through CPRA, VCDPA, CTDPA, CPA, Loi 25 and DMA
- You want a European contracting base — the French entity FJORD TECHNOLOGIES SAS in Paris, data centres in the European Union as stated on the vendor's pages, and the CNIL named as supervisory authority
- Your blocking already runs through a tag manager, since control here is tag-chain based via piggybacking detection and Cookie Origin tracing
Avoid if
- You must answer a supervisory authority with documented retention, export or the banner version behind each consent record — the pages describe timestamped logs and cross-device archiving, and we found no public information on the rest
- You operate under a strict consent regime, such as a German rollout, and want nothing pitched at winning back refusers — the consent-rate programme is sold on 'targeting cookie-abstentionists' and a 'Cookie Keeper' saving 'up to 20% of cookies', which the in-house lawyer would want reviewed first
- You need a published price, tier limits or a free tier before shortlisting — the captured pages carry no price figures
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 3 of 5 |
| Prior blocking & script control | 3.5 of 5 |
| Scanning & cookie classification | 4.5 of 5 |
| Consent records & proof | 2.5 of 5 |
| Frameworks, signals & platforms | 3 of 5 |
| European sovereignty | 2.5 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Continuous monitoring of real user traffic identifies cookies set before consent and sends alerts through Slack, email or webhook on the first appearance of an undeclared cookie — the live-site proof I demand after two supervisory letters — while piggybacking control blocks entire tag chains and deployment via GTM tags and server-side tracking is documented. We found no public information on automatic versus manual blocking modes, placeholders for embedded videos or maps, or consent passed to forms and CAPTCHAs. 3 4 5 6
The Agency Developer
As an enterprise tag manager with a consent module it blocks by controlling whole tag chains — piggybacking detection blocks dependent tags — and Cookie Origin traces any cookie back to the responsible script so it can be blocked, with server-side tagging extending to mobile apps. The real-time monitor reports cookies set before consent and alerts on undeclared trackers via Slack, email or webhook, which is exactly the client-added-a-tracker-on-Friday check I want. We found no public information on separate auto-blocking and manual blocking modes, content blockers with placeholders for YouTube or Maps embeds, or a JavaScript API passing consent to forms and plugins. 3 4 5 7
The Publisher Marketing Lead
Blocking is documented at tag level: entire piggybacking tag chains can be controlled and blocked, a detected cookie can be traced to its responsible script and blocked, and monitoring algorithms notify on deviations or rule violations. The real-time monitor identifies cookies set before consent is given and alerts on the very first appearance via Slack, email or webhook — exactly the live pre-consent check I want — and server-side tagging covers all devices including mobile apps. We found no public information on automatic versus manual blocking modes, placeholders for embedded videos and maps, or consent passed to forms and CAPTCHAs. 3 4 5
The In-House Lawyer
Blocking is handled through the tag manager, with piggybacking control that can block entire tag chains, monitoring algorithms that alert on rule violations, and a real-time monitor that identifies cookies set before consent on live traffic and alerts via Slack, email or webhook. Server-side tagging is documented across web and apps. The captured pages do not show content blockers or placeholders for embedded videos and maps, nor an auto-blocking mode described against a manual one. 3 4 5 6
The WordPress Webmaster
Monitoring blocks tag chains when piggybacking is detected, a traced cookie can be blocked at its source, and the scanner script deploys through the consent platform, a container or a Google Tag Manager tag. The scanner continuously identifies cookies set before consent and alerts on the very first appearance, which is the kind of check I want that nothing fires early. We found no public information on placeholders for videos or Maps embeds, or on consent being passed to forms and CAPTCHAs like reCAPTCHA. 3 4 5 7
The Skeptic
The verification half is strong: a monitor on real traffic that identifies cookies set before consent, narrows the exposure window to "a few minutes" and alerts via Slack, email or webhook. I found no description of the blocking mechanism itself — automatic versus manual modes and their limits, or placeholders for embedded videos and maps — beyond tag-chain control and monitoring algorithms. 3 4 5
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
Detection runs continuously on real traffic rather than crawls, captures first- and third-party cookies plus local and session storage, auto-categorises each cookie against a database enriched by two market repositories, traces every cookie to its responsible script, updates the cookie notice dynamically and produces continuous, exportable documentation with real-time alerts on undeclared trackers. The classification sources are named only as 'two market repositories', and we found no public information on scanning behind logins or from different regions. 5 6
The Agency Developer
The scanner runs continuously on real user traffic instead of crawl robots, so it catches conditional tags fired only on specific segments or after user actions, and it covers first- and third-party cookies plus local and session storage. Every detection is auto-categorised with description, category and responsible vendor from a database enriched by two market repositories, undeclared cookies trigger real-time alerts, pre-consent cookies are flagged and filtered by frequency, and the resulting documentation is a continuous, exportable audit trail that feeds the cookie notice dynamically. For forty client sites that is close to set-and-forget; the captured pages are silent only on scanning behind logins or from different regions. 5 6
The Publisher Marketing Lead
The scanner runs continuously on every real session rather than simulating visits, captures first- and third-party cookies, local storage and session storage, auto-classifies each detected cookie with description, category and responsible vendor from a database enriched by two market repositories, and alerts in real time on undeclared cookies while the cookie notice updates dynamically from the scan data; the audit documentation is continuous and exportable. We found no public information on scan change history, the named repository sources, or pixel coverage beyond cookies and storage. 5 6
The In-House Lawyer
The scanner monitors real user traffic continuously instead of crawling, captures first- and third-party cookies plus local and session storage, and automatically categorises each cookie with description and responsible vendor from a database enriched by two market repositories. Undeclared cookies trigger real-time alerts, the audit documentation is stated as continuous and exportable, and the cookie notice updates itself from the scan. What the pages do not show is a change history, the names of the repositories behind the classification, or a multi-language declaration. 5 6
The WordPress Webmaster
The scanner watches real visitor traffic continuously rather than crawling, covers first- and third-party cookies plus local and session storage, and automatically categorises each cookie with description, category and responsible vendor from a database enriched by two market repositories. Undeclared cookies trigger real-time alerts via Slack, email or webhook, and the cookie notice updates itself from the scan with exportable documentation — this is the finds-it-itself behaviour I want for Analytics, Maps and YouTube. We found no public information on the cookie declaration being maintained in several languages. 5 6 2
The Skeptic
Real-traffic detection instead of a crawl, first- and third-party cookies plus local and session storage, automatic categorisation with alerts on undeclared cookies, dynamic cookie-notice updates and an exportable continuous audit trail. The "two market repositories" behind the classification are not named and no change history is documented, which is what keeps it short of fully audit-proof. 5 6
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
Consent logs are documented as available and timestamped, and consent choices are archived across all devices and environments, which covers cross-device consistency. We found no public information tying a record to the banner version and texts the visitor saw, on retention and storage of the log, on export, a visitor-facing consent ID, expiry or re-consent after a configuration change — the first things a supervisory authority asks for. 6 8
The Agency Developer
Consent logs are stated to be available and timestamped, choices are archived across all devices and environments, and offline consent is either synced to the platform or deleted on reconnection — workable bones for proof. We found no public information on retention for consent records, export of the log, whether each record ties to a pseudonymous ID or the banner version shown, re-consent when services or texts change, or consent expiry. 6 8
The Publisher Marketing Lead
Timestamped consent logs are documented and described as strong, enforceable evidence from real traffic, and consent choices with their subsequent activation are archived across all devices and environments — the shared site-and-app consent I depend on for retargeting continuity. We found no public information on the banner version recorded per consent, retention periods, consent expiry, withdrawal recorded as its own event, a visitor consent ID lookup, or API export of the log. 6 8
The In-House Lawyer
Consent logs are documented as available and timestamped, choices are archived across all devices and environments, and offline consent is sent to the platform or deleted on reconnection. That evidences the fact of consent, but for a dispute I would also need the pages to describe a retention period, an export of the log, the banner version behind each record, and proof that withdrawal took effect — none of that is described. 6 8
The WordPress Webmaster
Consent logs are described as available and timestamped, and the CMP archives consent choices and subsequent activation across all devices and environments. We found no public information on retention of the consent log, export of records, banner versions kept per consent, or a consent ID a visitor could look up. 6 8
The Skeptic
Timestamped consent logs and archiving of choices "across all devices and environments" are stated, with cross-device consent as a named feature. I found no public information on retention for the log, export, a consent ID the visitor can look up, or the banner version behind each record — and nothing on a full log export when the customer leaves. 4 6 8
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
IAB TCF 2.2 with a registered IAB Europe vendor ID, Google Consent Mode v2 with the vendor named a Google-certified CMP, and a law scope spanning GDPR, several US state laws and Loi 25 are documented, alongside consent on mobile apps and server-side tagging for all devices. We found no public information on Microsoft UET consent mode, GPP or GPC signals, CMS plugins, a configuration API or agency and partner accounts. 2 4 7 8
The Agency Developer
The signal story is strong: a registered IAB Europe vendor ID, full TCF 2.2 compatibility, Google-certified Consent Mode v2 whose tags adjust behaviour on refusal, and consent extended to mobile apps and offline scenarios on top of the enterprise tag manager. For agency use the gaps matter: we found no public information on plugins for WordPress, Shopify or TYPO3, a documented JavaScript or REST API, multi-domain or partner accounts, or Microsoft UET, GPP and GPC signals. 2 3 4 7 8
The Publisher Marketing Lead
This is what I check first: registration in IAB Europe TCF under vendor ID 416 with full TCF 2.2 compatibility, Google certification for Consent Mode v2 — activated in a few clicks from the Settings tab, with conversion modelling for users who refused cookies — plus multi-law coverage from GDPR to CPRA and Loi 25, and consent on mobile apps archived across devices. We found no public information on Consent Mode advanced mode named as such, Microsoft UET or other ad-platform signals, GPP or GPC for US states, documented iOS and Android SDKs, agency accounts, or a REST API. 2 4 7 8
The In-House Lawyer
IAB TCF 2.2 is supported under a registered vendor ID, the CMP is Google-certified, and Consent Mode v2 activation is described step by step, with banner rules covering GDPR alongside named US state laws and Quebec's Law 25. Consent on mobile apps and server-side collection across all devices is addressed. The captured pages give no information on the Global Privacy Control or Global Privacy Platform signals, Microsoft ad-platform signals, documented SDKs, CMS plugins or a configuration API. 2 3 4 7 8
The WordPress Webmaster
IAB TCF 2.2 is supported under Vendor ID 416, the CMP is Google-certified with Consent Mode v2 activated from the settings tab, and consent on mobile apps plus server-side collection across devices is documented. We found no public information on a WordPress plugin, on Microsoft or US privacy signals such as GPP, on documented iOS and Android SDKs, or on a REST API for configuration. 2 4 5 7 8
The Skeptic
IAB TCF 2.2 under a registered vendor ID (416), Google Consent Mode v2 with a Google certification, and app consent handled down to offline queues that send or delete data on reconnection. I found no public information on CMS plugins, a configuration API, Microsoft UET consent mode, or GPP and GPC on the captured pages. 2 3 4 7 8
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
The contracting entity is FJORD TECHNOLOGIES SAS of Paris, the privacy policy states that collected personal data is stored within the European Union, and EU data centres are advertised. We found no public information on a data processing agreement, a subprocessor list with locations, where the banner script and consent logs are served from, or security certifications, so the chain beyond entity and storage remains undocumented. 2 3 8
The Agency Developer
The contracting entity is French (FJORD TECHNOLOGIES SAS, Paris), personal data is stated to be stored within the European Union with EU data centres, and the CNIL is named as the supervisory authority — a coherent European footprint on the facts shown. The rest of the chain is undocumented: we found no public information on where the banner script is served from, a subprocessor list with locations, a data processing agreement, or ISO 27001/SOC 2 certifications. 2 3 7
The Publisher Marketing Lead
The contracting entity is FJORD TECHNOLOGIES SAS in Paris with data centers in the European Union and personal data stated as stored within the EU, and the CNIL is named as the supervisory authority. We found no public information on where the banner script is served from, a subprocessor list with their locations, a published data processing agreement, or security certifications; the only named third-party provider is Cloudflare as a security provider. 2 7 8
The In-House Lawyer
The contracting entity is FJORD TECHNOLOGIES SAS in Paris, the product pages state data centres in the European Union, and CNIL is named as the supervisory authority — a solid basis for our shops in Germany, France and Austria. The chain is not closed in the captured pages: I found no public information on a data processing agreement, a subprocessor list with locations (Cloudflare appears only incidentally as the security provider), security certifications, or where the banner script and consent logs are stored. 2 3 7 8
The WordPress Webmaster
The entity named on the privacy policy is FJORD TECHNOLOGIES SAS in Paris, personal data is stated as stored within the European Union, EU data centres are advertised, the CNIL is named as the supervisory authority and Cloudflare appears as the named security provider. We found no public information on a published data processing agreement, a subprocessor list with locations, security certifications, or where the banner script itself is served from. 2 3 7 8
The Skeptic
A Paris contracting entity (FJORD TECHNOLOGIES SAS) and "Data Centers in European Union" repeated across product pages — the vendor's own statement, with the infrastructure not named. I found no public information on where the banner script is served from, the subprocessor list, or a data processing agreement; the only chain member visible anywhere is Cloudflare, on the vendor's own site. 2 3 7 8
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer not rated — no public information
We found no public information on pricing transparency: none of the captured pages carries a tier price, a free tier's limits, per-domain rates, add-on fees, contract terms or setup costs, and the only cost-related statement is a marketing claim of a fixed, known budget for the scanner. All pages cited below were reviewed for prices. 1 2 3 4 5 6 7 8
The Agency Developer not rated — no public information
We found no public information on prices, tiers, per-domain or page-view limits, free-tier limits, agency or reseller terms, minimum terms or setup fees on any captured page; the only cost statement is a fixed, known budget for the cookie scanner with no additional servers. 1 2 3 4 5 6 7 8
The Publisher Marketing Lead
The only pricing-related statement on the captured pages is a 'fixed, known budget' claim for the cookie scanner with no additional servers required. No prices, tier limits, add-on costs, minimum terms or agency conditions appear on any page we read, so a real annual cost cannot be computed from these public pages alone. 5
The In-House Lawyer not rated — no public information
We found no public information on pricing in the pages captured: no tiers, no per-domain or traffic-based figures, no free tier and its limits. The only cost statement is a qualitative claim of a 'fixed, known budget' for the scanner, without any numbers. 1 5
The WordPress Webmaster not rated — no public information
We found no public information on pricing: none of the captured pages quotes a price per site or domain, tier limits, term length, setup or agency terms. As someone who needs a known yearly figure per site, I cannot compute an annual cost from these pages. 1 2 3 4 5 6 7 8
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Commanders Act Consent Management
Is Commanders Act Consent Management European?
Not determined: the vendor’s pages as captured do not say where Commanders Act Consent Management is based.
Where does Commanders Act Consent Management store data?
The default storage location for customer data is not stated on the vendor’s pages as of 3 Nov 2026. The vendor’s pages mention the EU as hosting location, per the vendor’s page captured 3 Nov 2026.
Does Commanders Act Consent Management have a free plan?
Not stated on the vendor’s pages as of 3 Nov 2026.
What are the best alternatives to Commanders Act Consent Management?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Commanders Act Consent Management alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 3 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (commandersact.com, commandersact.com/privacy, commandersact.com/enterprise-tag-manager/consent-management-platform-trust-commander, commandersact.com/de/enterprise-tag-manager/cmp-trust-commander, commandersact.com/the-quantum-lounge/enterprise-tag-manager/consent-management/cookie-scanner-real-time-monitoring, commandersact.com/the-quantum-lounge/enterprise-tag-manager/consent-management/gdpr-cookie-audit-dpo-guide and 2 more). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 14 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (8)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page www.commandersact.com Checked 3 Nov 2026 Details →
- 2 Privacy policy — found from the homepage www.commandersact.com Checked 3 Nov 2026 Details →
- 3 Prior blocking & script control — found from sitemap www.commandersact.com Checked 3 Nov 2026 Details →
- 4 Prior blocking & script control — found from sitemap www.commandersact.com Checked 3 Nov 2026 Details →
- 5 Scanning & cookie classification — found from sitemap www.commandersact.com Checked 3 Nov 2026 Details →
- 6 Consent records & proof — found from sitemap www.commandersact.com Checked 3 Nov 2026 Details →
- 7 Frameworks, signals & platforms — found from sitemap www.commandersact.com Checked 3 Nov 2026 Details →
- 8 Frameworks, signals & platforms — found from sitemap www.commandersact.com Checked 3 Nov 2026 Details →