Consent Management (CMP)
Complianz
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Complianz B.V. · complianz.io
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Complianz at a glance
- Vendor
- Complianz B.V.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates Complianz 3/5, the mean of 6 judges. Complianz — Complianz B.V. how scores are made
- As of
- Vendor pages captured 29 Oct 2026 to 1 Nov 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Complianz — Complianz B.V. of Groningen, part of iubenda — is a standalone WordPress consent plugin with a premium Shopify app; the bench's weighted totals run 6.2–6.7. It is strongest on banner and choice and on prior blocking, both 7–8: first-layer accept-and-reject rules mapped to named authorities, consent per category and per service in 47+ locales, and blocking published in detail — 27 script and 14 iframe patterns, placeholders, and a deep manual-tagging mode. Sovereignty sits at 7–8: the plugin runs on the customer's own webserver, does not call home, and the vendor states it receives no visitor data or IP addresses — its stated reason no data processing agreement is required. Weakest is consent records at 4–5, where judges split evenly over the gaps: no stated retention period, no documented export of the log, a documentation statement that a history of consent is not necessary, and a proof PDF the captured pages describe differently. Scanning and classification and standards and platforms hold a flat 6; pricing transparency gets 5–6, with different starting figures — $59 and €59 — on the captured pages.
Speaks for it
- Prior blocking is documented in detail — 27 script and 14 iframe patterns updated regularly, placeholders, and a manual-tagging mode with its limits spelled out
- First-layer accept-and-reject requirements are mapped country by country to named authorities for Germany, the UK, France, Greece, the Netherlands, Belgium and Denmark
- The WordPress plugin runs standalone on your own webserver, does not call home, and the vendor states it receives no visitor data or IP addresses
- Google CMP certification is stated, Google Consent Mode v2 and TCF 2.0+ ship in the premium plugin, and Google and Matomo Tag Manager are supported
- Three tiers publish prices by site count — Personal 1 website $59, Professional 5 websites $179, Agency 25 websites $399 — next to a free WordPress plugin and a 30-day money-back guarantee
Held against it
- Records of Consent sit behind the premium plugin, the documentation states a history of consent is not necessary, and we found no public information on a retention period or export of the log
- The proof-of-consent PDF is a general snapshot of current settings per region rather than tied to a specific visitor, and the captured pages describe it differently
- The scanner is in beta with possible false positives, and we found no public information on scheduled rescans, alerts on new or changed trackers, or local-storage and pixel scanning
- With Consent Mode enabled, the documentation states Google is no longer blocked before consent but only notified of consent state updates, and whitelisted domains always load even before consent
- The captured pages give different starting figures, $59 and €59, we found no public price for the Shopify app beyond its free trial, and VAT treatment is not stated
Best for
- You run WordPress and want the banner, consent records and snapshots kept on your own server rather than a vendor cloud
- You operate across several EU jurisdictions and need first-layer accept-and-reject mapped per country to national guidance
- Your ad stack relies on Google Ads, Analytics or Tag Manager and needs Google CMP certification with Consent Mode v2 and TCF 2.0+
- You manage a portfolio of client sites and want tiers by website count with a multisite plugin and bulk pricing above 25 websites
Avoid if
- You need audit-grade proof tied to individual visitors — the documentation keeps only the latest consent choices and the proof PDF is a snapshot per region
- You must guarantee Google scripts never load before consent — with Consent Mode on, Google is only notified of consent state updates, and whitelisted domains always load even before consent
- Your platform is neither WordPress nor Shopify — those are the documented platforms
- You need the full cost in advance for Shopify or for more than 25 websites — ask the vendor: the public pages we read do not show it
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 4 of 5 |
| Prior blocking & script control | 4 of 5 |
| Scanning & cookie classification | 3 of 5 |
| Consent records & proof | 2.5 of 5 |
| Frameworks, signals & platforms | 3 of 5 |
| European sovereignty | 4 of 5 |
| Pricing transparency | 3 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Blocking is documented in depth: automatic prior blocking of 27 script and 14 iframe patterns that the vendor updates regularly, the method published (script type changed to text/plain, iframe source removed), a manual tagging mode with its limits spelled out, and Google and Matomo Tag Manager support. Two caveats a buyer should weigh: with Consent Mode enabled the documentation states Google is no longer blocked before consent but only notified of consent state updates, and whitelisted domains always load even before consent. No automated pre-consent monitor is documented; verification is by inspecting which cookies your domain loads. 2 5 11 12 14
The Agency Developer
The auto-blocker ships with a maintained community list covering twenty-seven script patterns and fourteen iframe patterns — YouTube, Google Maps embeds, Vimeo, Facebook plugins — with placeholders, and the manual tagging system documents classes, purpose attributes, dependency handling, modules and inline scripts with their usage limits spelled out. Google and Matomo Tag Manager are supported, Consent Mode runs in a documented hybrid where Complianz events still fire, and consent reaches Shopify through its Customer Privacy API, plus there is a written browser check that only first-party cookies load before consent. I found no public information on server-side tagging or an automated pre-consent monitor, which is what would have earned the top step. 2 5 11 12
The Publisher Marketing Lead
A vendor-maintained blocklist covers 27 script and 14 iframe patterns (YouTube, Vimeo, Google Maps embeds, Facebook plugins), updated regularly with community submissions, plus placeholders, Google and Matomo Tag Manager support, and deep manual-tagging documentation for WordPress and Shopify with per-purpose attributes and dependency handling. Google Analytics and GTM work with TCF by default and Complianz events keep firing alongside Consent Mode; we found no public information on server-side tagging or an automated monitor for pre-consent leaks — verification is a manual cookie check after configuration. 11 12 5 2
The In-House Lawyer
Automatic blocking is documented in the help centre — iframe sources removed and scripts rewritten to text/plain until consent, with vendor-maintained lists of 27 script and 14 iframe patterns, community submissions and placeholders for embeds — alongside an unusually deep manual tagging mode with activation classes, per-purpose attributes, dependency handling and JavaScript module support, plus Google and Matomo tag manager integration and a consent signal passed to Shopify. We found no public information on server-side tagging or an automated monitor reporting scripts or cookies firing before consent on the live site; the documented self-check is limited to inspecting which cookies the site could load. 11 12 5 2
The WordPress Webmaster
The automatic block list covers exactly what our site runs — Google Analytics, reCAPTCHA, the Google Maps embed, YouTube iframes and gtag/GTM — with the iframe-source-removal and text/plain method published, a vendor-maintained list updated regularly, placeholders for embeds, and a full manual-tagging guide with per-category attributes and dependency handling; I found no public information on server-side tagging or an automated monitor that proves nothing fires before consent. 2 5 11 12
The Skeptic
The blocking mechanism is published in detail — iframe sources removed and script types switched to text/plain until consent, with 27 script patterns and 14 iframe patterns listed and said to be updated regularly — alongside a manual tagging mode whose limits are explained, including the document.write caveat, per-purpose attributes and dependency ordering. Placeholders, Google and Matomo Tag Manager support, a whitelist and a Shopify blocklist with per-purpose consent are all documented. We found no public information on server-side tagging or an automated monitor that reports scripts set before consent on the live site. 11 12 2 5 14
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
The scanner finds cookies and third-party services, records name, duration, purpose and service, syncs classification with Cookiedatabase, and feeds auto-generated cookie policies in each language, with automatic scanning by default on Shopify and repeat scans on demand — and the documentation is candid that the scanner is in beta and may detect cookies or services that are not actually on the site. I found no public information on scheduled rescans with a stated depth, email alerts on new or changed trackers, local storage and pixels beyond cookies, or exportable scan reports, and unknown trackers are not flagged for review. 2 11 14
The Agency Developer
The scanner finds cookies and third-party services, records name, duration, purpose and service, syncs classification with Cookiedatabase, and auto-generates cookie policies in each language, with a repeat scan button available at any time. However, I found no public information on scheduled rescans with a stated depth, alerts when a new or changed tracker appears, or scanning of local storage and pixels — exactly the Friday-tracker check I run agencies on — and the scanner is stated to be beta, may produce false positives, and fails behind password protection. 2 11 14
The Publisher Marketing Lead
The scanner records name, duration, purpose and service, syncs with Cookiedatabase for the legal descriptions, auto-generates cookie policies in each language and can be rerun at any time, with a manual fallback and honest disclosure that it is in beta and can produce false positives. We found no public information on scheduled rescans, email alerts on new or changed trackers, or scanning of local storage and pixels. 14 2 11
The In-House Lawyer
The scanner runs automatically by default, records each cookie's name, duration, purpose and service, feeds an auto-generated cookie policy in every language and is synced with Cookiedatabase for descriptions, with a repeat scan available at any time and a manual configuration fallback. The vendor describes the scanner as still in beta with possible false positives, password-protected sites must temporarily lift protection to be scanned, and we found no public information on scheduled rescans, email alerts on new or changed trackers, or scanning of local storage and pixels. 14 2 11
The WordPress Webmaster
The scanner visits pages and records each cookie's name, duration, purpose and service, syncs descriptions from Cookiedatabase, pre-fills the wizard and auto-generates a multilingual cookie policy, with rescans available at any time and a manual fallback; scheduled scans with a stated depth, alerts on new or changed trackers and local-storage scanning are not documented, and the scanner is flagged as beta with possible false positives. 2 6 11 14
The Skeptic
The scanner visits the site, records cookie name, duration, purpose and service, and feeds auto-generated cookie policies in each language, classified through a sync with Cookiedatabase, with a wizard pre-filled from the scan, repeat scans and a manual fallback. The vendor states the Shopify scanner is in beta with possible false positives and cannot pass password protection; we found no public information on scheduled scan frequency or depth, local storage and pixels, or alerts on new or changed trackers. 14 2 11 6
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
Records of consent store per visitor a pseudonymous user ID, anonymized IP, region, chosen categories and a timestamp, viewable and deletable in the dashboard, and a Proof of Consent PDF includes the banner version and TCF settings — but the PDF is a general snapshot of current settings per region, not tied to the specific visitor, and the documentation states a history of consent is not necessary, keeping only the latest choices. For an authority's request I would want what the captured pages do not show: a stated retention period for the consent records, export of the log, the banner version on each individual record, consent expiry, and re-asking when the configuration changes. 2 3
The Agency Developer
Each record holds a user ID, anonymized IP, region, chosen categories and timestamp, is viewable and deletable per user, and a proof-of-consent PDF captures the banner version and TCF settings — though the captured pages describe that PDF differently, once as created for each consent and once as a general snapshot per region not tied to a specific user. The documentation states a history of consent is not stored, and I found no public information on a stated retention period for records, export of the consent log, or withdrawal recorded as its own event. 2 3 7
The Publisher Marketing Lead
Each consent is recorded with a pseudonymous user ID, anonymized IP, region, chosen categories and timestamp, viewable in the dashboard and deletable per user or in bulk, with a proof-of-consent PDF that includes the active cookie policy, banner version and TCF settings. The captured pages describe that PDF as a general snapshot not tied to a specific user and state a history of consent is not necessary; we found no public information on export of the log, a retention period for the records, consent expiry or withdrawal as a recorded event. 3 7 2
The In-House Lawyer
Records of Consent, a premium feature, log a pseudonymous user ID, anonymized IP, region, chosen categories and timestamp, record 'no choice' and 'no warning' exceptions, allow per-user deletion, and generate a Proof of Consent PDF containing the cookie policy, banner version and TCF settings, stored on the site owner's own server. For a dispute the gaps count: no retention period for the log is stated, export of the log is not documented, the documentation states a history of consent is not necessary, and the captured pages give different descriptions of whether the proof PDF is generated per consent or as a general snapshot per region. 3 7 2
The WordPress Webmaster
Each consent is stored as a record with a pseudonymous ID, anonymized IP, region, chosen categories and timestamp, viewable in the dashboard and deletable per user, and a proof-of-consent PDF captures the banner version and TCF settings; however a retention period for records, export of the log itself and a fresh ask when the configuration changes are not documented, and the documentation states a history of consent is not necessary — only the latest choices are kept. 3 7
The Skeptic
Each record holds a pseudonymous ID, anonymized IP, region, chosen categories and a timestamp, viewable in the dashboard and deletable per user, and a downloadable PDF proof includes the banner version and the active cookie policy. But the documentation itself states "A history of consent is not necessary" and describes that proof as a general snapshot of current settings per region rather than one tied to a specific visitor. We found no public information on a retention period for the records, exporting the log itself, or asking visitors again when texts change. 3 7 8
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
The core signals are covered in depth: TCF 2.0+ via a premium module tied to the vendor's IAB registration, Google CMP certification, Consent Mode with its mechanics documented, a consent signal passed to Shopify, DNT/GPC respected and US purposes handled on Shopify, Google and Matomo Tag Manager, 250+ service integrations, and agency and multisite management. I found no public information on a published IAB CMP ID, Microsoft UET, GPP, iOS or Android SDKs, or a REST API, and the product runs on WordPress and Shopify only. 2 4 5 12 17
The Agency Developer
TCF v2, Google Consent Mode v2 with Google CMP certification, respect for DNT/GPC, and native plugins for WordPress and Shopify with Google and Matomo Tag Manager support cover most of a client portfolio, and the multisite plugin plus a twenty-five-site Agency plan answer my account-structure need. I found no public information on a registered IAB Europe CMP ID, Microsoft UET consent mode, GPP, iOS or Android SDKs, or a REST API — and the documented platforms are WordPress and Shopify, with no public information on TYPO3. 2 4 5 6 12 17
The Publisher Marketing Lead
Google CMP certification is stated on multiple pages and Consent Mode is implemented the way my ad stack needs it — Google scripts stay unblocked and are notified of consent state updates, hybrid with Complianz events — with TCF 2.0+ in a premium module wired to Ad Inserter and Advanced Ads, GPC respected, multisite plus agency plans, and a Shopify app passing a consent signal to Shopify. The captured pages do not state a registered CMP ID number, and we found no public information on Microsoft UET consent mode, GPP, iOS or Android SDKs, or a REST API. 2 4 5 17 12 6
The In-House Lawyer
The vendor is named as a Google CMP-certified provider with Google Consent Mode v2 (premium) and IAB TCF v2.0+ via a built-in premium module, Google Tag Manager and Google Analytics working with TCF by default, respect for Do Not Track and Global Privacy Control, US-specific purposes in the Shopify app, and native WordPress and Shopify products with tag manager support. We found no public information on a registered IAB CMP ID number, Microsoft UET or GPP signals, iOS or Android SDKs, connected TV, or a REST configuration API; the documentation references protecting its IAB registration without stating an ID. 2 5 17 4 12
The WordPress Webmaster
Google CMP certification is stated, Consent Mode v2 is documented in real depth (GA4/GTM handling, hybrid mode, per-tag consent settings), TCF v2.0+ ships in the premium plugin with an IAB registration the vendor protects by limiting banner customization, GPC and Do Not Track are respected, and Google and Matomo Tag Manager are supported; the pages document WordPress and Shopify, and I found no public information on a CMP ID number, Microsoft UET, GPP, app SDKs or a REST API. 2 4 5 17
The Skeptic
IAB TCF ("Version 2.0+", a registration with IAB the vendor says its customization rules protect), Google CMP certification with Consent Mode documented for Google Ads, Floodlight, Analytics and Tag Manager, GPC and Do-Not-Track respected, and US-state purposes handled in the Shopify app, on top of native WordPress and Shopify products with multisite support and an agencies program. No registered CMP ID number appears on the captured pages, and we found no public information on Microsoft UET consent mode, GPP, iOS or Android SDKs, or a REST configuration API. 2 4 5 8 12 17
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
For WordPress the chain is as short as it gets: a standalone plugin on the customer's own webserver that does not call home, with all stored data remaining on the customer's server and an explicit statement that Complianz receives no visitor data or IP addresses, which is why a data processing agreement is stated as not required. The contracting entity is Complianz B.V. in Groningen, part of iubenda, the vendor's own site is hosted at Convesio in Italy, and payments run through Stripe in the EU and PayPal, with the processor list available on request and including Vero with place of processing in the United States. The captured pages leave open the hosting and data flows of the Shopify app and the scanner and Cookiedatabase infrastructure, and no security certifications are published. 2 7 8 17
The Agency Developer
The contracting entity is Complianz B.V. in Groningen with a Chamber of Commerce number, and the WordPress product runs as a standalone plugin on the customer's own server that shares no visitor data with the vendor and receives no IP addresses — the documented reason no processing agreement is required, with the banner and the records staying on the client's own hosting. Ownership is stated only as 'part of iubenda', and I found no public information on security certifications or on where the Shopify app and the scanner infrastructure run, which keeps it below the top step. 2 7 8
The Publisher Marketing Lead
The contracting entity is a Dutch company with a Chamber of Commerce number and a Groningen address, stated as part of iubenda, and the WordPress plugin runs standalone on my own webserver without calling home — the vendor states it receives no visitor data or IP addresses, which is why it says a data processing agreement is not required, keeping my banner and consent logs on my own infrastructure. We found no public information on security certifications, or on where the scanner, the Cookiedatabase sync and the Shopify app infrastructure run. 8 2 7 17
The In-House Lawyer
The contracting entity is Complianz B.V. of Groningen, Netherlands, with a Chamber of Commerce number shown across the captures, and the WordPress plugin is deliberately self-hosted: it runs on the site owner's webserver, does not call home, keeps records, snapshots and statistics on the customer's own server, and the vendor documents that it receives no visitor data and therefore states a data processing agreement is not required. We found no public information on security certifications, on where the Shopify app and scanner infrastructure run, or a published processor list — that list is available only on request, with a US-place processor named for the vendor's own marketing alongside EU-named payment and hosting providers. 8 2 7 3
The WordPress Webmaster
For me this is the headline: the WordPress plugin is standalone, does not call home, and keeps the banner and all consent data on our own server, with Complianz B.V. in Groningen as the contracting entity, part of iubenda; what the pages do not show is where the scanner and the Cookiedatabase sync run, any security certification, and the vendor's own site uses a US marketing-automation provider with the updated processor list available only on request. 2 7 8 17
The Skeptic
The contracting entity is Complianz B.V. of Groningen with a published Chamber of Commerce number, part of iubenda, and the product is self-hosted: it runs on the customer's webserver, "does not 'call home'", keeps consent records and snapshots on that server, and the vendor states it receives no visitor data or IP addresses — its stated reason a data processing agreement is not required. The remaining chain is unproven: we found no public information on where Cookiedatabase sync or scanner infrastructure run, on licence and update services, or on security certifications. 7 8 2 4 14
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
Three tiers are public with prices per website count — Personal 1 website $59, Professional 5 websites $179, Agency 25 websites $399 — with 1 year support and updates, yearly renewals and a 30-day money back guarantee; the captured pages give different figures for the starting price, the features page saying "Starting at only €59". Beyond 25 websites pricing is on request, the free tier is the free WordPress plugin without stated limits, the Shopify app shows only a free trial with no price, and VAT treatment and minimum terms are not stated. 1 2 6
The Agency Developer
Three tiers are public with their site counts and prices — Personal 1 website $59, Professional 5 websites $179, Agency 25 websites $399 — plus annual renewal, one year of support and updates, a 30-day money-back guarantee, and a free WordPress tier that makes the free-versus-premium split clear. But above twenty-five sites the price is only 'find out more about our dedicated bulk pricing', VAT treatment is not stated, and the captured pages give the starting price as €59 on the features page and $59 on the pricing page. 2 6
The Publisher Marketing Lead
Three tiers are public per website count — "Personal 1 website $59", "Professional 5 websites $179", "Agency 25 websites $399", with the features page quoting "Starting at only €59" — including plan inclusions, one year of support and updates, yearly renewals, a 30-day money-back guarantee and a free WordPress plugin. The Shopify app is shown only with a free trial and no price, pricing above 25 websites is offered as dedicated bulk pricing on request, and we found no public information on VAT treatment or agency fees. 6 2 1
The In-House Lawyer
The pricing page publishes three tiers — Personal 1 website $59, Professional 5 websites $179, Agency 25 websites $399 — with one year of support and updates, yearly renewals rather than lifetime licences, a 30-day money-back guarantee, an included multisite plugin and per-tier feature lists, next to a free WordPress plugin. A buyer still cannot compute the full cost: we found no public price for the premium Shopify app beyond its free trial, pricing above 25 websites is on request, VAT treatment is not stated, and the captured pages give different starting figures — €59 on the features page for the Professional Privacy Suite against $59 for the single-site Personal plan on the pricing page. 6 2 1
The WordPress Webmaster
Three public tiers price by website count — Personal 1 website $59, Professional 5 websites $179, Agency 25 websites $399 — with a free WordPress plugin alongside, a 30-day money-back guarantee, one year of support and updates and yearly renewals with no lifetime licenses; the pricing page gives the starting price in dollars while the features page gives €59, and VAT treatment, the renewal price and anything above 25 sites (dedicated bulk pricing, on request) are not published. 1 2 6
The Skeptic
Three tiers scale cleanly by site count — Personal 1 website $59, Professional 5 websites $179, Agency 25 websites $399 — with a free WordPress plugin, one year of support and updates, a 30-day money-back guarantee and yearly renewals rather than lifetime licences. Beyond 25 sites the buyer is pointed to dedicated bulk pricing, and we found no public information on the Shopify app's price or VAT treatment; the captured pages also give different currencies for the entry point, "$59" on the pricing page and "Starting at only €59" on the features page. 6 2 1 14
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Complianz
Is Complianz European?
Yes. whats-best.ai classifies Complianz as EU-Made.
Where does Complianz store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Complianz have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to Complianz?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Complianz alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 9 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (18)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage complianz.io Checked 29 Oct 2026 Details →
- 2 Features page complianz.io Checked 29 Oct 2026 Details →
- 3 Documentation (records of consent) complianz.io Checked 29 Oct 2026 Details →
- 4 Documentation (IAB TCF) complianz.io Checked 29 Oct 2026 Details →
- 5 Documentation (Google Consent Mode) complianz.io Checked 29 Oct 2026 Details →
- 6 Pricing page complianz.io Checked 29 Oct 2026 Details →
- 7 Privacy policy complianz.io Checked 29 Oct 2026 Details →
- 8 Data processing agreement (dpa) complianz.io Checked 29 Oct 2026 Details →
- 9 Banner & choice architecture — found from sitemap complianz.io Checked 29 Oct 2026 Details →
- 10 Banner & choice architecture — found from sitemap complianz.io Checked 29 Oct 2026 Details →
- 11 Prior blocking & script control — found from sitemap complianz.io Checked 29 Oct 2026 Details →
- 12 Prior blocking & script control — found from sitemap complianz.io Checked 29 Oct 2026 Details →
- 13 Scanning & cookie classification — found from sitemap complianz.io Checked 29 Oct 2026 Details →
- 14 Scanning & cookie classification — found from sitemap complianz.io Checked 29 Oct 2026 Details →
- 15 Consent records & proof — found from sitemap complianz.io Checked 29 Oct 2026 Details →
- 16 Frameworks, signals & platforms — found from sitemap complianz.io Checked 29 Oct 2026 Details →
- 17 Frameworks, signals & platforms — found from sitemap complianz.io Checked 29 Oct 2026 Details →
- 18 Imprint — found from the homepage complianz.io Checked 1 Nov 2026 Details →