Consent Management (CMP)
Didomi
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Didomi SAS · www.didomi.io
Compare with consentmanager → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Didomi at a glance
- Vendor
- Didomi SAS
- Headquarters
- Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 29 Oct 2026
- Panel verdict
- The AI panel rates Didomi 3.5/5, the mean of 6 judges. Didomi's consent management platform earns its best marks on scanning and classification and consent records: a scanner covering up to 20,000 pages, working behind logins and from a chosen country, and a versions-and-proofs module from which legal teams can pull the exact UI a user agreed to on any date. how scores are made
- As of
- Vendor pages captured 29 Oct 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Didomi's consent management platform earns its best marks on scanning and classification and consent records: a scanner covering up to 20,000 pages, working behind logins and from a chosen country, and a versions-and-proofs module from which legal teams can pull the exact UI a user agreed to on any date. Banner and choice also lands at 7-8, with one-click deny routes beside accept and agree/disagree buttons that cannot be disabled. Outside pricing — every tier reads "Contact us" — the weakest area is sovereignty at 4: the pages establish a Paris-registered company with a French VAT number and the CNIL as complaint authority, yet name Amazon Web Services LLC at a Seattle address as host of the vendor's own website, and we found no public information on consent-log storage, subprocessors or a published data processing agreement. Prior blocking sits at 5-6, its low end reflecting the manual, per-vendor Google Tag Manager setup. Weighted verdicts run 6.3-7.0; no criterion shows more than a point of spread, the residual differences turning on missing public information about banner accessibility and classification sources.
Speaks for it
- Scans cover up to 20,000 pages per XL scan, work behind logins and from a chosen country, and split trackers into cookies, pixels and local storage
- Every consent event is captured, versioned and retrievable, with proofs attachable through an API and batch export tied to the tiers
- First-layer choice is equal-weight: 'Disagree and close', the cross button and a 'Continue without agreeing' link sit beside 'Agree and close', and the Agree-to-all / Disagree-to-all buttons are enabled by default and cannot be disabled
- Trackers fired before consent are treated as violations, and banner simulation verifies accept-all, refuse-all and no-action behaviour
- Certified by Google for Consent Mode v2 across web, apps and connected TV, with IAB TCF, GPP, GPC, Microsoft UET and AWS among the named signals
Held against it
- Blocking is documented as manual wiring: one Google Tag Manager trigger per non-IAB vendor, with warnings that combined triggers drop cookies without consent
- The only hosting fact on the pages names Amazon Web Services LLC at a Seattle address as host of the vendor's own website
- We found no public information on where consent logs are stored, on subprocessors, or on a published data processing agreement
- We found no public information on WordPress or other named CMS plugins, on agency accounts, or on a registered IAB Europe CMP ID
- All three tiers — Essential, Advanced and Premium — read 'Contact us'; the free Compliance Monitoring scan is the only public offer
Best for
- You answer regulator inquiries or DSARs and must reproduce the exact notice a visitor saw on a given date
- You need recurring, deep compliance scanning across large or login-gated sites, from a chosen country of origin
- You advertise with Google in Europe and need a Google-certified CMP for Consent Mode v2 covering web, apps and connected TV
- You operate across many countries and want geo-targeted notices with automatic language detection
Avoid if
- You want automatic script blocking out of the box — the documented path is one Google Tag Manager trigger per non-IAB vendor, set up per container and for each new tag
- Your site leans on embedded videos, maps or social embeds — the pages only recommend collecting consent before embedded videos, and we found no public information on placeholder blockers
- You must document where consent records live before signing — ask the vendor: the public pages we read do not show it
- You need a price before engaging sales — every tier reads 'Contact us'
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 4 of 5 |
| Prior blocking & script control | 3 of 5 |
| Scanning & cookie classification | 4 of 5 |
| Consent records & proof | 4 of 5 |
| Frameworks, signals & platforms | 3.5 of 5 |
| European sovereignty | 2 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Tag gating is documented as a Google Tag Manager integration the site owner wires per vendor, with its limits explained — the warning that combining triggers drops cookies without consent, and the single-page-app limitation with a workaround — while the compliance monitor treats trackers fired before consent as violations and sends weekly alerts on misfiring tags, which is a real way to check nothing loads too early. We found no public information on an automatic blocking mode or maintained content blockers with placeholders; the captured video page only recommends collecting consent before launching embedded videos. 11 12 13 4
The Agency Developer
The documented blocking is tag-manager-manual: one GTM trigger per non-IAB vendor wired to the Didomi events and variables, with unusually honest warnings about OR-logic double triggers dropping cookies without consent, per-container setup and single-page-app limits. What lifts it for me is the monitoring side — the scan bot treats trackers fired before consent as violations and alerts on new tracker activity, so the plugin a client added on Friday gets caught. We found no public information on an automatic blocking mode or placeholder content blockers for embedded videos and maps, only a recommendation to collect consent before launching embedded videos. 4 11 12 13
The Publisher Marketing Lead
The documented blocking path is manual: in Google Tag Manager I create one trigger per non-IAB vendor, gated on the "Didomi Vendors Enabled" variable, and the documentation is unusually frank about the traps — combining triggers causes OR logic that drops cookies without consent, trigger groups fire once per page on dynamic sites, and every new tag needs the setup again. Consent state is exposed through events and variables, server-side tagging is available on request, and the compliance monitor treats trackers fired before consent as violations with alerts on new tracker activity, which is real verification. I found no public information on an automatic blocking mode or on content blockers with placeholders for videos, maps and social embeds — the video page only recommends collecting consent before embedded videos launch. 11 12 2 4 13
The In-House Lawyer
Blocking is documented through Google Tag Manager in real depth: one trigger per non-IAB vendor gated on the Didomi consent variable, consent events for single-page sites, and an explicit warning that mixing triggers drops cookies before consent — the kind of honest pitfall documentation I look for. Server-side tagging is offered on request, embedded videos are addressed, and the monitoring product treats trackers fired before consent as violations, so the owner can verify nothing loads early. We found no public information on an automatic script-blocking mode or maintained content blockers with placeholders for named embeds. 4 5 11 12 13
The WordPress Webmaster
The documented blocking route is manual and GTM-centred: you create a trigger for each non-IAB vendor against Didomi's consent variables and events, and the documentation is frank about the traps — an OR-condition that drops cookies before consent, and trigger groups that fire only once on single-page sites. Verification is well covered: banner simulation for accept-all, refuse-all and no-action scenarios, a compliance bot that treats trackers fired before consent as violations, and a server-side tagging module. I found no public information on an automatic script-blocking mode or on content-blocker placeholders for YouTube and Maps embeds, which is precisely what a WordPress site with embeds needs. 3 4 11 12 13
The Skeptic
Blocking as documented runs through Google Tag Manager triggers you build yourself, one per non-IAB vendor, and the help centre is unusually honest about the trap: adding both triggers yields OR logic and cookies dropped without consent. Embedded video consent appears as a recommendation rather than a documented placeholder feature, and I found no public information on an automatic blocking mode, placeholders for maps or social embeds, or consent passed to forms and CAPTCHAs. What redeems it is the verification: scans treat trackers fired before consent as violations, and banner simulation checks accept-all, refuse-all and no-action behaviour. 4 11 12 13
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
The compliance monitor is documented in depth: a bot that scrapes the site, scans up to 20,000 pages, can scan behind logins and from a chosen country, categorises cookies, pixels and local storage into first- and third-party groups, runs on monthly or weekly schedules by tier, and alerts on new tracker activity, with audit-ready JSON exports and a time-stamped audit trail. We found no public information on a maintained classification database with purposes, providers and lifetimes, or a cookie declaration that updates itself in several languages. 4 13 14 5
The Agency Developer
This is the strongest part of the product: a bot that scrapes configured domains for trackers and vendors, splits them into cookies, pixels and local storage and first- versus third-party, scans up to 20,000 pages, can log in behind credentials, can originate from a chosen country, runs monthly or weekly depending on tier, alerts when something changes, and produces a time-stamped audit trail with JSON export and vendor risk assessments. To reach the top it would need the classification sources and update process published and a self-updating on-site cookie declaration; on the latter we found no public information beyond the JSON export meant to keep policies accurate. 4 5 13 14
The Publisher Marketing Lead
The bot scrapes configured domains on a schedule (monthly or weekly depending on plan, with XL scans up to 20,000 pages), can scan behind logins and from a chosen country, and groups trackers as cookies, pixels and local storage with a first-party versus third-party split — depth, region and login coverage are all documented. Every scan produces a time-stamped audit trail, JSON export of full vendor and tracker data, and per-vendor risk assessments, with alerts the moment something changes. I found no public information on a maintained classification database with purposes, providers and lifetimes, or on a cookie declaration that updates itself in several languages. 13 14 4 5
The In-House Lawyer
A bot scrapes configured domains and can log in, scan from a chosen country, cover up to 20,000 pages and be watched back as a recording, sorting findings into cookies, pixels and local storage and splitting first-party from third-party. Rescans run monthly or weekly by plan, alerts go out the moment something changes or misfires, and outputs are audit-ready with a time-stamped historical trail and JSON export. We found no public information on a maintained classification database with purposes, providers and lifetimes, or on a cookie declaration that updates itself from the scan in several languages. 4 5 13 14
The WordPress Webmaster
Scanning is described in real depth: a bot that crawls up to 20,000 pages, can scan behind logins and from a chosen country, splits trackers into cookies, pixels and local storage and into first- versus third-party, with monthly or weekly rescans depending on the plan and alerts the moment something changes. Audit-ready outputs are stated — a time-stamped historical audit trail, full vendor and tracker data exportable in JSON, risk assessments on every vendor — plus a free first scan. I found no public information on per-cookie lifetimes in a maintained database or on a self-updating cookie declaration in several languages. 4 5 13 14
The Skeptic
The scanner is described in working detail: scraping sessions with a viewable recording, up to 20,000 pages per XL scan, selectable scan-origin country, logged-in scanning, custom user agents, and trackers split into cookies, pixels and local storage as well as first versus third party. Alerts the moment something changes, a time-stamped audit trail and JSON export are all stated. I found no public information on a maintained vendor database with purposes, providers and cookie lifetimes, or on how the classification itself is produced and reviewed. 4 13 14
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
The versions and proofs module keeps every published notice version and lets legal teams pull "the exact UI a user agreed to, on any date" for audits, regulator inquiries and DSARs — precisely the banner-version trail I need when an authority asks which notice a visitor saw — with proof files attachable to consent events and retrievable through an API, and cross-device and cross-domain consent recorded. We found no public information on a stated retention for the consent log itself, a consent ID the visitor can look up, or tamper-evidence of the log. 2 15 16 5 4
The Agency Developer
The versions and proofs module keeps published notice versions and end-user consent records so legal can "pull the exact UI a user agreed to, on any date" for audits, regulator inquiries and DSARs, with proofs uploadable and retrievable through the developer API and batch export tied to the tiers. Cross-device and cross-domain consent are covered, and historical reporting gives a time-stamped audit trail. We found no public information on a visitor-facing consent-ID lookup, configurable consent expiry, or a tamper-evident log, and retention is stated only generally (duration of the contract). 2 5 15 16
The Publisher Marketing Lead
The versions and proofs module captures, versions and retrieves every consent event so legal teams can pull "the exact UI a user agreed to, on any date" — a record tied to the notice version and texts shown, which is what a regulator letter actually asks for. Proofs attach to consent events and are retrievable through an API within 24 hours, cross-device and cross-domain consent unify the record, and an Admin API with batch export exists. I found no public information on a consent ID the visitor can look up, configurable consent expiry, how long consent logs are kept or where, or withdrawal being recorded as its own event. 2 15 16 5
The In-House Lawyer
The versions and proofs module keeps every published notice and end-user consent record for audits and complaints, and the vendor states legal teams can pull "the exact UI a user agreed to, on any date" — precisely the evidence I would need facing a regulator or a consumer group. Proofs can be attached to consent events and retrieved through an API, consent is unified across devices and domains, and proof of consent is available within twenty-four hours. We found no public information on a tamper-evident log, configurable consent expiry, or a consent ID the visitor can look up themselves. 2 5 15 16
The WordPress Webmaster
Every consent event is captured, versioned and retrievable — the vendor says privacy and legal teams can pull the exact UI a user agreed to, on any date, for audits, regulator inquiries and DSARs — and a versions-and-proofs module keeps published notice versions alongside end-user consent records, with proof files attachable through an API and available within 24 hours. Cross-device consent unification and batch export appear on the plan matrix. I found no public information on retention of consent logs, configurable consent expiry, or withdrawal being recorded as its own event. 2 5 15 16
The Skeptic
Every consent event is claimed captured, versioned and retrievable — legal teams can pull the exact UI a user agreed to on any date — with a proofs API, batch export, cross-device unification and cross-domain consent all documented. Proof of consent only becomes available 24 hours after the event, and I found no public information on consent-log retention, configurable expiry, or a consent ID the visitor can look up themselves. The records look built to answer a regulator, rather less to answer the data subject. 2 5 15 16
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
The captured pages show IAB TCF v2.2, Google Consent Mode v2 with Google certified-partner status covering web, apps and connected TV, Microsoft UET consent mode, AWS consent mode, GPP and GPC, a documented REST API, and several domains manageable from one account. We found no public information on a registered IAB Europe CMP ID, basic versus advanced Consent Mode behaviour, CMS plugins for systems like WordPress or Shopify, or agency accounts managing client sites. 2 3 17 18 16
The Agency Developer
The signal coverage is deep for an enterprise buyer: IAB TCF (the captured pages give different version figures, v2.2 and 2.4), GPP and GPC, Google Consent Mode v2 with Google-certified partner status, Microsoft UET and AWS consent mode, certification across web, apps and connected TV, unlimited domains based on MUV, and a documented developer API. For an agency like mine the gap is sharp: we found no public information on WordPress, Shopify or TYPO3 plugins, a named agency or partner account model, or a registered IAB Europe CMP ID, and several capabilities such as server-side tagging and cross-device consent are marked upon request. 2 3 5 6 18
The Publisher Marketing Lead
Didomi is a Google Certified CMP Partner at gold tier, certified for web, apps and connected TV, and names IAB TCF, GPP, GPC, Microsoft UET and AWS and Amazon consent signals, with a REST API and unlimited domains on a monthly-unique-visitor basis — cross-device consent means a user chooses once across my site and my app, my headline requirement. The captured pages give different figures for the TCF version (v2.2 on one page, 2.4 on another), and I found no public information on a registered IAB Europe CMP ID, on Consent Mode v2 being offered in advanced as well as basic mode (the developer page only says the integration is supported under GDPR), or on agency accounts managing many client sites. 2 3 17 18 5 6
The In-House Lawyer
The signal list is broad and current — IAB TCF v2.2, GPP, Google Consent Mode v2 with Google certified-partner status covering web, apps and connected TV, Microsoft UET consent mode, AWS consent mode and automatic Global Privacy Control handling — and there is a REST API with an admin API and batch export. The TCF integration shares consent status to selected IAB vendors with a standard banner text already validated by the IAB. We found no public information on a registered CMP ID, basic versus advanced Consent Mode modes, named CMS plugins, or agency accounts managing many client sites. 2 3 5 16 18
The WordPress Webmaster
The signal list is broad and named: IAB TCF with an IAB-validated standard text, GPP, GPC, Google Consent Mode v2 with Google CMP certification for web, apps and connected TV, plus Microsoft UET and AWS consent modes, with the developer docs noting Consent Mode applies only under the GDPR regulation. Multi-domain banners, cross-domain consent, an Admin API and consents endpoints, and modules for mobile apps, connected TV and server-side tagging are documented. As the person who keeps a WordPress site running, I note I found no public information on a WordPress plugin or other named CMS plugins, on a registered IAB CMP ID, on Consent Mode advanced mode, or on agency accounts. 2 3 5 17 18
The Skeptic
The signal list is explicit — IAB TCF v2.2, GPP, Global Privacy Control, Google Consent Mode v2 with Google certification for web, apps and connected TV, Microsoft UET and an AWS consent signal — alongside an API and consent shared across domains and devices. The captured pages do state Consent Mode is supported only under the GDPR regulation, which is the kind of limit I want named. I found no public information on a registered IAB Europe CMP ID, agency or partner accounts, or whether Consent Mode basic and advanced modes are both supported. 2 3 17 18
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
The contracting entity is proven European — Didomi SAS, 137 Boulevard de Sébastopol in Paris, registered with the Paris RCS under number B 831 722 756 — and the security page states ISO 27001 certification, encrypted point-in-time backups and replication across at least two physically separated data centres, with SCC and adequacy safeguards named in the privacy policy. But the captured pages state nothing about where the banner script and consent logs are served or stored, list no subprocessors and show no published data processing agreement; the legal notice names Amazon Web Services LLC at a Seattle address as host of the vendor's website. 7 6 8
The Agency Developer
Didomi SAS is a French simplified joint-stock company at 137 Boulevard de Sébastopol in Paris with a French VAT number, a DPO contact and CNIL named as complaint authority, and the company states ISO 27001 certification, encryption in transit and at rest, and replication across at least two physically separated data centers. But the only hosting fact captured names Amazon Web Services LLC at a Seattle address for the website, and we found no public information on where the banner script and consent logs are stored, on the subprocessor list, or on a published data processing agreement. 6 7 8
The Publisher Marketing Lead
The contracting entity is solidly European — Didomi SAS at 137 Boulevard de Sébastopol in Paris, registered with the Paris RCS with a French VAT number — and the company states ISO 27001 certification, encryption in transit and at rest, encrypted point-in-time backups and replication across at least two physically separated data centres. But the legal notice names Amazon Web Services LLC of Seattle as the host, the data-centre regions are not stated, and I found no public information on where the banner script and consent logs are stored, on the subprocessor chain, or on a published data processing agreement. 6 7 8
The In-House Lawyer
The contracting entity is European and evidenced — Didomi SAS at 137 Boulevard de Sébastopol in Paris, registered with the Paris RCS, with a French VAT number, a DPO address and SCCs plus adequacy safeguards named for transfers — and the company states ISO 27001 certification with replication across at least two physically separated data centers. But the captured pages give no location for the banner script, consent logs or scan results, no subprocessor list and no published processing agreement; the only hosting fact is that the vendor's own website is hosted by Amazon Web Services LLC at a Seattle address. 6 7 8
The WordPress Webmaster
The contracting entity is solidly French — Didomi SAS at 137 Boulevard de Sébastopol in Paris, registered with the Paris RCS, French VAT, a DPO address and the CNIL named as complaint authority — and the security page states ISO 27001 certification, encryption in transit and at rest, and replication across at least two physically separated data centres. However, the legal notice names Amazon Web Services with a Seattle address as host of the vendor's own website, and I found no public information on where the banner script and consent logs are served and stored, on subprocessors, or on a published data processing agreement. The European entity is proven; the chain the CMP actually runs on is not. 6 7 8
The Skeptic
The contracting entity is solidly European — a Paris-registered company with a French VAT number, a reachable data protection officer and the CNIL named as complaint authority — but the chain behind it thins out fast: the website's hosting is attributed to Amazon Web Services LLC at a Seattle address, and transfer safeguards are invoked without saying what data goes where. I found no public information on where consent logs and scan results are stored, on the subcontractors along the chain, or on a published data processing agreement. ISO 27001 is claimed, though the captured pages do not state its scope. 6 7 8
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
All three tiers on the offers page — Essential, Advanced and Premium — are positioned with their scope but every one says "Contact us"; a free compliance monitoring scan exists, and tier inclusions such as unlimited domains based on monthly unique visitors, scan frequency and seat counts are published without a single figure. We found no public information on any price, visitor band, minimum term, overage or setup fee, so a buyer cannot compute an annual cost from the captured pages. 5 4 2
The Agency Developer
Every tier — Essential, Advanced, Premium — says "Contact us" for the price, though the inclusions matrix is public (unlimited domains based on MUV, monthly or weekly scan frequency, SSO seat counts, export destinations, support SLA) and a free compliance monitoring scan exists as the only public offer. Connected TV, server-side tagging and cross-device consent are all "Upon Request" and the XL scan is a premium feature to raise with the Didomi representative, so I cannot compute an annual cost for a client from these pages alone. 4 5 13 2
The Publisher Marketing Lead
Every plan — Essential, Advanced and Premium — says "Contact us"; no price appears anywhere, though the comparison page is generous with what each tier gates (scan frequency, auditing scan counts, SSO seats, analytics export destinations) and states consent management covers unlimited domains on a monthly-unique-visitor basis. A free compliance-monitoring scan exists, but I found no public information on tier prices, page-view or visitor bands with their cost, or what the connected-TV, cross-device and server-side add-ons cost beyond "Upon Request". I cannot compute an annual cost from the public pages alone. 5 4 2
The In-House Lawyer
Every tier — Essential, Advanced, Premium — is priced "Contact us", with a free Compliance Monitoring scan as the only no-cost entry point, so a buyer cannot compute an annual cost from the public pages. The plan matrix does publish inclusions such as unlimited domains based on MUV, scan frequency and auditing-scan counts, which shows the scaling logic even though no figures are attached. Connected TV consent, cross-device consent, server-side tagging, preference management and the XL scan are all marked upon request or premium without prices. 2 4 5 13
The WordPress Webmaster
The offers page names Essential, Advanced and Premium tiers and details inclusions — audit-scan counts, scan frequency, SSO seats, analytics export destinations, unlimited domains based on MUV — but every plan button reads "Contact us", and the XL scan is likewise "Please contact your Didomi representative for more information". A free Compliance Monitoring scan exists and a link labelled Self Service Pricing appears on the product pages, yet the captured pages show no price figure, so I cannot compute an annual cost per site. For a one-site WordPress budget that wants a number before committing, this is the dealbreaker. 2 4 5 13
The Skeptic
A pricing page exists and names three tiers with their inclusions — scan frequency, seat counts, domains unlimited but metered on MUV — yet every plan ends in contact-us, so no annual cost can be computed from public pages alone. The only free thing is a compliance-monitoring scan snapshot, and premium items like the XL scan are routed to a sales representative. What leaving would cost, in data-return or cancellation terms, is not addressed anywhere I read. 4 5 13
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Didomi
Is Didomi European?
Yes. whats-best.ai classifies Didomi as EU-Made.
Where does Didomi store data?
Not stated on the vendor’s pages as of 29 Oct 2026.
Does Didomi have a free plan?
Yes. Didomi has a free plan, per the vendor’s page captured 29 Oct 2026.
What are the best alternatives to Didomi?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), CCM19 (3.5/5) and Cookie Information (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Didomi alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 21 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (18)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.didomi.io Checked 29 Oct 2026 Details →
- 2 Features page (consent management platform) www.didomi.io Checked 29 Oct 2026 Details →
- 3 Features page (Google Consent Mode v2) www.didomi.io Checked 29 Oct 2026 Details →
- 4 Features page (scanning and compliance monitoring) www.didomi.io Checked 29 Oct 2026 Details →
- 5 Pricing page (plans without prices) www.didomi.io Checked 29 Oct 2026 Details →
- 6 Legal notice www.didomi.io Checked 29 Oct 2026 Details →
- 7 Privacy policy www.didomi.io Checked 29 Oct 2026 Details →
- 8 Security / trust page www.didomi.io Checked 29 Oct 2026 Details →
- 9 Banner & choice architecture — found from sitemap support.didomi.io Checked 29 Oct 2026 Details →
- 10 Banner & choice architecture — found from sitemap docs.didomi.io Checked 29 Oct 2026 Details →
- 11 Prior blocking & script control — found from sitemap docs.didomi.io Checked 29 Oct 2026 Details →
- 12 Prior blocking & script control — found from sitemap docs.didomi.io Checked 29 Oct 2026 Details →
- 13 Scanning & cookie classification — found from sitemap docs.didomi.io Checked 29 Oct 2026 Details →
- 14 Scanning & cookie classification — found from sitemap docs.didomi.io Checked 29 Oct 2026 Details →
- 15 Consent records & proof — found from sitemap docs.didomi.io Checked 29 Oct 2026 Details →
- 16 Consent records & proof — found from sitemap developers.didomi.io Checked 29 Oct 2026 Details →
- 17 Frameworks, signals & platforms — found from sitemap developers.didomi.io Checked 29 Oct 2026 Details →
- 18 Frameworks, signals & platforms — found from sitemap support.didomi.io Checked 29 Oct 2026 Details →