# Didomi — Consent Management (CMP)

Didomi by Didomi SAS holds a panel rating of 3.5/5 from 6 AI judges (category median 3/5), as of 2026-10-30. Provenance: EU-Made; sovereignty: not determined.

- Vendor: Didomi SAS (https://www.didomi.io/)
- Category: [Consent Management (CMP)](https://whats-best.ai/software/consent-management.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/consent-management/didomi
- Alternatives: https://whats-best.ai/software/consent-management/didomi/alternatives ([markdown](https://whats-best.ai/software/consent-management/didomi/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-10-30 · oldest source captured 2026-10-29

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Didomi SAS
- Headquarters: Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan: Yes, per the vendor’s own page [S4]

## The panel's verdict

Didomi's consent management platform earns its best marks on scanning and classification and consent records: a scanner covering up to 20,000 pages, working behind logins and from a chosen country, and a versions-and-proofs module from which legal teams can pull the exact UI a user agreed to on any date. Banner and choice also lands at 7-8, with one-click deny routes beside accept and agree/disagree buttons that cannot be disabled. Outside pricing — every tier reads "Contact us" — the weakest area is sovereignty at 4: the pages establish a Paris-registered company with a French VAT number and the CNIL as complaint authority, yet name Amazon Web Services LLC at a Seattle address as host of the vendor's own website, and we found no public information on consent-log storage, subprocessors or a published data processing agreement. Prior blocking sits at 5-6, its low end reflecting the manual, per-vendor Google Tag Manager setup. Weighted verdicts run 6.3-7.0; no criterion shows more than a point of spread, the residual differences turning on missing public information about banner accessibility and classification sources.

**Speaks for it:**
- Scans cover up to 20,000 pages per XL scan, work behind logins and from a chosen country, and split trackers into cookies, pixels and local storage
- Every consent event is captured, versioned and retrievable, with proofs attachable through an API and batch export tied to the tiers
- First-layer choice is equal-weight: 'Disagree and close', the cross button and a 'Continue without agreeing' link sit beside 'Agree and close', and the Agree-to-all / Disagree-to-all buttons are enabled by default and cannot be disabled
- Trackers fired before consent are treated as violations, and banner simulation verifies accept-all, refuse-all and no-action behaviour
- Certified by Google for Consent Mode v2 across web, apps and connected TV, with IAB TCF, GPP, GPC, Microsoft UET and AWS among the named signals

**Held against it:**
- Blocking is documented as manual wiring: one Google Tag Manager trigger per non-IAB vendor, with warnings that combined triggers drop cookies without consent
- The only hosting fact on the pages names Amazon Web Services LLC at a Seattle address as host of the vendor's own website
- We found no public information on where consent logs are stored, on subprocessors, or on a published data processing agreement
- We found no public information on WordPress or other named CMS plugins, on agency accounts, or on a registered IAB Europe CMP ID
- All three tiers — Essential, Advanced and Premium — read 'Contact us'; the free Compliance Monitoring scan is the only public offer

**Best for:**
- You answer regulator inquiries or DSARs and must reproduce the exact notice a visitor saw on a given date
- You need recurring, deep compliance scanning across large or login-gated sites, from a chosen country of origin
- You advertise with Google in Europe and need a Google-certified CMP for Consent Mode v2 covering web, apps and connected TV
- You operate across many countries and want geo-targeted notices with automatic language detection

**Avoid if:**
- You want automatic script blocking out of the box — the documented path is one Google Tag Manager trigger per non-IAB vendor, set up per container and for each new tag
- Your site leans on embedded videos, maps or social embeds — the pages only recommend collecting consent before embedded videos, and we found no public information on placeholder blockers
- You must document where consent records live before signing — ask the vendor: the public pages we read do not show it
- You need a price before engaging sales — every tier reads 'Contact us'

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Data Protection Officer | The Agency Developer | The Publisher Marketing Lead | The In-House Lawyer | The WordPress Webmaster | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Banner & choice architecture | 4/5 | 4/5 | 3.5/5 | 4/5 | 3.5/5 | 3.5/5 |
| Prior blocking & script control | 2.5/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Scanning & cookie classification | 4/5 | 4/5 | 3.5/5 | 4/5 | 4/5 | 4/5 |
| Consent records & proof | 4/5 | 4/5 | 3.5/5 | 4/5 | 4/5 | 3.5/5 |
| Frameworks, signals & platforms | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| European sovereignty | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **3.5/5** | **3.5/5** | **3.5/5** | **3.5/5** | **3.5/5** | **3/5** |

### The judges

- **The Data Protection Officer** (v1.0): External DPO for a dozen mid-sized companies, two of which received a letter from a state supervisory authority about their cookie banner last year. Wants reject on the first layer, nothing loaded before the click, a consent log that shows which banner version each visitor saw, a cookie list that matches the site, and a DPA and subprocessor list that keep visitor data in the EU.
- **The Agency Developer** (v1.0): Lead developer at a web agency that maintains forty client sites on WordPress, TYPO3 and Shopify. Wants one account for every client, blocking that works without rewriting each theme, content blockers for YouTube and Maps, a Tag Manager template, a scanner that flags the tracker a client added on Friday, and a JavaScript API documented well enough that forms and plugins can ask for consent.
- **The Publisher Marketing Lead** (v1.0): Runs marketing for an ad-funded news site and an online shop in the same group, where every point of consent rate shows up in ad revenue and in Google Ads conversions. Wants a registered IAB TCF CMP, Google Consent Mode v2 in advanced mode, banner tests within what the law allows, consent shared between the site and the app, and a dashboard that shows where visitors drop off.
- **The In-House Lawyer** (v1.0): In-house counsel at a retailer with shops in Germany, France and Austria, who has read the court decisions on missing reject buttons and the regulators' banner guidance. Wants § 25 TDDDG and the GDPR mapped to concrete settings, equal-weight choices as the default, consent that can be withdrawn as easily as it was given, and records that would hold up if a competitor or a consumer group sued.
- **The WordPress Webmaster** (v1.0): Looks after the WordPress site of a mid-sized engineering company on top of the actual job, with Google Analytics, a YouTube channel, a Maps embed and a contact form with reCAPTCHA. Wants a plugin that finds these by itself, blocks them until the visitor agrees, survives the next plugin update and caching, and costs a known amount per site per year without a call to sales.
- **The Skeptic** (v1.0): Has opened the browser's network tab on sites with a "certified" banner and watched the ad pixels fire before anything was clicked. Reads "consent rate optimisation" as a hint that reject will be grey and small, "auto-blocking" as a claim until the test steps are published, and "EU hosting" next to a US script CDN — and asks what leaving would cost: the consent logs, and every visitor asked again.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Data transfer safeguards: yes · yes · yes [S7]
- GDPR applicable: yes [S7]
- ISMS controls: Annual Policy Review · Annual Internal Audits · Regular Access Audits · Vendor Security Management [S8]
- ISMS policies: yes [S8]
- ISO 27001 certified: yes [S8]
- Minors: no [S7]
- No ad data use: privacy-center.org data not used in third-party contexts beyond consent management [S7]
- No data sale: no · no [S7]
- No sensitive info use: no [S7]
- US consumer rights: yes [S7]

**Data**
- Complaint authority: CNIL [S7]
- End users anonymized: aggregated anonymized data [S7]
- Export: yes [S4]
- Retention customers: duration of contract [S7]
- Retention prospects: duration indicated at collection or applicable legal requirement [S7]
- Rights: yes · yes · yes · yes · yes · yes [S7]

**Hosting**
- Multi datacenter replication: active-active at CDN and datacenter level · 2 [S8]
- Provider: P.O. Box 81226 Seattle, WA 98108-1226 · Amazon Web Services LLC [S6]

**Integrations**
- Admin API: Admin API [S5]
- API reference URL: https://api.didomi.io/docs/ [S16]
- Batch export: 1 destination · no · no [S5]
- Gtm: yes · yes [S2]
- Gtm scope: Triggers connect a Didomi event with the Didomi Vendors Enabled variable to gate tag firing [S11]
- Modules listed: Consent Management · CMP for Connected TV · CMP for Mobile Apps · Preference Management · Compliance Monitoring · Privacy Request · Server-side tagging [S3]
- Proofs file constraints: PDF · PNG · JPG · GIF · DOCX · DOC · MSG · 15 [S16]
- Proofs get endpoint: GET · /consents/proofs/{id} [S16]
- Proofs get response format: base64 data URI with id and size [S16]
- Proofs upload endpoint: POST · /consents/proofs · base64-encoded data URI [S16]
- Sdk APIs: yes · yes [S2]
- SSO: up to 100 seats · up to 10 seats · no [S5]

**Legal**
- Address: PARIS · 137 Boulevard de Sébastopol · 75002 [S7]
- Editor: Romain Gauthier [S6]
- Entity: France · Paris · Didomi SAS · 42.853 · simplified joint stock company · 831 722 756 [S6]
- Entity: Paris · simplified joint-stock company · Didomi SAS · B 831 722 756 [S7]
- Legal basis newsletter: Newsletter processing on legitimate business development interests [S3]
- Registered office: 137 Boulevard de Sébastopol, 75002 Paris (France) [S6]
- VAT: FR32831722756 [S6]

**Pricing**
- Acm xl scan premium: yes [S13]
- Advanced tier: Advanced · Audit & Monitor your compliance · yes [S5]
- Essential tier: Essential · Comply with multi-regulation requirements [S5]
- Free scan: Free Compliance Monitoring scan [S4]
- Free tier: yes [S4]
- No public prices: contact_sales · no [S5]
- Page presence: yes [S2]
- Premium tier: Premium · Privacy strategy & unified consent [S5]

**Product**
- Ab testing: yes [S2]
- Acm 2FA unsupported: no [S13]
- Acm behavior locked after save: no [S13]
- Acm behavior opt in: opt-in [S13]
- Acm behavior opt out: opt-out [S13]
- Acm bot scenario customizable: yes [S13]
- Acm bot scraping: Didomi bot scrapes configured domains, collecting trackers dropped and vendors triggered [S14]
- Acm custom user agent: yes [S13]
- Acm description: ACM augments tracker and vendor discovery; organization gets a customized ACM report and dedicated analytics [S14]
- Acm discovery recording and page list: yes · yes [S13]
- Acm domain ownership confirmation: yes [S13]
- Acm launched from country: bot scan origin country selectable [S13]
- Acm logged in scanning: yes [S13]
- Acm methodology: ACM has more robust features and higher default page scan limit than tracker and vendor discovery [S14]
- Acm nav modules: Whitelist ACM report · ACM notifications · ACM report domains · ACM report results · ACM analytics [S14]
- Acm page discovery modes: auto_page_discovery · manual_input [S13]
- Acm premium: yes [S14]
- Acm rating factors configurable: yes [S13]
- Acm report steps: Data aggregation · Mapping of trackers to initiators · Calculation of number of requests to/from each vendor · Computation of recommendations · Calculation of Didomi rating [S14]
- Acm scan quota reporting: yes [S13]
- Acm trackers categorization: cookies · pixels · local storage · yes [S14]
- Acm xl scan page limit: 20000 [S13]
- Analytics: yes [S2]
- Analytics exports: 2 destinations · 1 destination · no [S5]
- Auditing scans: 25 · 10 · 10 [S5]
- Backup point in time encrypted: point-in-time · yes [S8]
- Banner customization: Banner customization to align with brand [S3]
- Banner simulation: accept-all · refuse-all · no-action · yes [S4]
- Breach scenarios: multi-scenario · multi-scenario · single-scenario [S5]
- Certified web apps ctv: web · apps · CTV · 2025-07 [S3]
- Client count: 2000 [S1]
- Cmp synchronization: yes [S4]
- Compliance monitoring: Advanced compliance monitoring of trackers and vendors [S3]
- Connected tv consent: Essential · Advanced · Premium · upon_request [S5]
- Consent analytics: Advanced consent analytics across regions and regulations [S3]
- Consent management: Consent Management · CMP for Connected TV · CMP for Mobile Apps · Preference Management · Compliance Monitoring · Privacy Request · Server-side tagging [S6]
- Consent management domains: MUV · Essential · Advanced · Premium · unlimited [S5]
- Consent management platform: Consent Management Platform with pseudonymized data sharing to third parties for advertising if consented [S7]
- Consent mode conversion recovery: 65 [S3]
- Consent mode how it works: Consent Mode adjusts Google tag data collection based on user consent while providing conversion insights [S3]
- Consent mode v2 requirement: Since March 2024, Google Ads audiences and measurement in Europe require data via Google Consent Mode v2 with a certified CMP [S3]
- Consent notice wizard: Consent notice wizard deploys a Google-ready web banner in minutes [S3]
- Consent proof: Consent proof capture, versioning, retrieval for audits and DSARs [S2]
- Consent proof definition: A consent proof is a file (e.g. signature, form) attached to a consent event [S16]
- Cookie list extract: Cookie List Extract [S5]
- Cross device: yes [S2]
- Cross device consent: upon_request [S5]
- Cross domain consent: Cross-Domain Consent · yes [S5]
- Data export json: json · vendor and tracker data [S4]
- Ddos mitigation: yes [S8]
- Developer docs: Developers Documentation and Help Center offered as product resources [S6]
- Encryption transit and rest: yes · yes [S8]
- Enterprise cmp: Enterprise CMP for consent collection and management across states, regions, domains, apps, connected devices [S2]
- Framework support: IAB TCF v2.2 · GPP · Google Consent Mode v2 · Microsoft UET Consent Mode · AWS Consent Mode [S2]
- Geo targeting: yes [S2]
- Gold tier partner: yes [S3]
- Google certified cmp: Didomi is a Google Certified CMP Partner [S3]
- Google consent mode support: Didomi Web SDK offers a Google Consent Mode V2 integration; it is only supported under GDPR regulation. [S17]
- Gpc support: yes [S2]
- Gtm container and new tag requirements: yes · yes [S11]
- Gtm datalayer name config: yes · dataLayer [S11]
- Gtm didomiconfig snippet: tagManager: {provider: 'gtm'} can be set in didomiConfig when notice not created via Console [S11]
- Gtm events: didomi-consent · didomi-ready · didomi-consent-changed · didomi-consent [S11]
- Gtm integration activation: GTM integration is activated in Consent notices > step 2 Customization > Integrations tab > Tag Managers section [S11]
- Gtm integration purpose: Didomi integrates with Google Tag Manager to configure tag loading on the website only when there is user consent [S11]
- Gtm most used variable: didomiVendorsEnabled holds the list of all vendors with user consent [S11]
- Gtm or condition warning: Adding both triggers causes OR logic and non-compliant cookies dropped without consent [S11]
- Gtm spa limitation: Trigger groups fire once per page; for SPA/dynamic sites use Didomi functions and events [S11]
- Gtm trigger condition: didomiVendorsEnabled contains vendor ID [S11]
- Gtm trigger groups and usage: yes [S11]
- Gtm trigger per vendor: one trigger per non-IAB vendor to be blocked [S11]
- Gtm variables: vendors consent subsets · purposes consent subsets · vendors and purposes consent subsets · IAB TCF consent string / GDPR [S11]
- Gtm vendor id location: Vendor ID found in Console step 1 Regulations > Regulations tab > Edit Vendors and Purposes > API ID [S11]
- Historical reporting: yes [S4]
- Iab standard text provided: Using the IAB TCF integration requires displaying a standard text on the banner; Didomi provides a standard text already validated by the IAB [S18]
- Iab tcf compliance purpose: IAB TCF ensures compliance with the GDPR and the ePrivacy guidelines for consent collection, especially for ad tech providers [S18]
- Iab tcf definition: The IAB TCF is a solution built by IAB members to establish standards in the advertising industry, helping parties comply with GDPR and ePrivacy when processing personal data or storing device information [S18]
- Iab tcf integration: yes [S3]
- Iab tcf integration: Didomi offers an IAB TCF integration that automatically shares user consent status to selected IAB vendors via the console, with an option to disable it [S18]
- Iab vendor list formats: IAB Europe vendor list available as a standard list and as JSON lists for vendors and purposes at vendor-list.consensu.org v3 endpoints [S18]
- Ids ips: yes [S8]
- Language detection: yes [S2]
- Languages: 45+ [S2]
- Languages supported: 50 [S3]
- Migration: 4-step migration framework with dedicated solutions architect [S2]
- Modules: Consent Management · CMP for Connected TV · CMP for Mobile Apps · Preference Management · Compliance Monitoring · Privacy Request · Server-side tagging [S2]
- Modules: Consent Management · CMP for Connected TV · CMP for Mobile Apps · Preference Management · Compliance Monitoring · Privacy Request · Server-side tagging [S7]
- Modules listed: Notice versions · Consent proofs reports · Privacy records (Beta) [S15]
- Multi banner domains: yes [S2]
- Multi regulation consent: yes [S3]

**Support**
- Acm access type: Compliance Report - Editor [S13]
- Channels: Email and Live Chat Support · Dedicated Customer Success Manager · Technical Support [S5]
- Demo cta: yes [S3]
- Docs: Help Center · Developer Documentation · Onboarding and Training [S5]
- Documentation: yes [S3]
- Help center: Developers Documentation · Help Center [S2]
- SLA: Premium · Basic · Basic [S5]

38 more facts on the canonical page: https://whats-best.ai/software/consent-management/didomi

## Questions

### Is Didomi European?

Yes. whats-best.ai classifies Didomi as EU-Made.

### Where does Didomi store data?

Not stated on the vendor’s pages as of 29 Oct 2026.

### Does Didomi have a free plan?

Yes. Didomi has a free plan, per [the vendor’s page captured 29 Oct 2026](https://whats-best.ai/evidence/12465).

### What are the best alternatives to Didomi?

As of 3 Nov 2026, the panel rates [Usercentrics CMP (3.5/5)](https://whats-best.ai/software/consent-management/usercentrics), [CCM19 (3.5/5)](https://whats-best.ai/software/consent-management/ccm19) and [Cookie Information (3.5/5)](https://whats-best.ai/software/consent-management/cookie-information) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Usercentrics CMP](https://whats-best.ai/software/consent-management/usercentrics) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Didomi alternatives](https://whats-best.ai/software/consent-management/didomi/alternatives).

## Head-to-head

- [Didomi vs consentmanager](https://whats-best.ai/compare/consentmanager-vs-didomi.md)

## What this page leaves out

- 21 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.didomi.io/ (checked 2026-10-29)
- [S2] Features page (consent management platform): https://www.didomi.io/consent-management-platform (checked 2026-10-29)
- [S3] Features page (Google Consent Mode v2): https://www.didomi.io/regulations/google-consent-mode-v2 (checked 2026-10-29)
- [S4] Features page (scanning and compliance monitoring): https://www.didomi.io/advanced-compliance-monitoring (checked 2026-10-29)
- [S5] Pricing page (plans without prices): https://www.didomi.io/offers (checked 2026-10-29)
- [S6] Legal notice: https://www.didomi.io/legal-notice (checked 2026-10-29)
- [S7] Privacy policy: https://www.didomi.io/privacy-policy (checked 2026-10-29)
- [S8] Security / trust page: https://www.didomi.io/security (checked 2026-10-29)
- [S9] Banner & choice architecture — found from sitemap: https://support.didomi.io/consent-withdrawal-in-the-tcf-framework (checked 2026-10-29)
- [S10] Banner & choice architecture — found from sitemap: https://docs.didomi.io/consent-management-platform-cmp/frameworks-regulations/iab-tcf/withdrawing-consent-in-iab-tcf (checked 2026-10-29)
- [S11] Prior blocking & script control — found from sitemap: https://docs.didomi.io/integrations/google/block-tags-with-google-tag-manager-integration (checked 2026-10-29)
- [S12] Prior blocking & script control — found from sitemap: https://docs.didomi.io/consent-management-platform-cmp/introduction/collect-end-user-consent-before-embedded-video (checked 2026-10-29)
- [S13] Scanning & cookie classification — found from sitemap: https://docs.didomi.io/advanced-compliance-monitoring-acm/acm-report-domains/configure-acm-report-xl-scan (checked 2026-10-29)
- [S14] Scanning & cookie classification — found from sitemap: https://docs.didomi.io/advanced-compliance-monitoring-acm/introduction (checked 2026-10-29)
- [S15] Consent records & proof — found from sitemap: https://docs.didomi.io/versions-and-proofs/introduction (checked 2026-10-29)
- [S16] Consent records & proof — found from sitemap: https://developers.didomi.io/api-and-platform/consents/proofs (checked 2026-10-29)
- [S17] Frameworks, signals & platforms — found from sitemap: https://developers.didomi.io/cmp/web-sdk/third-parties/direct-integrations/google-consent-mode (checked 2026-10-29)
- [S18] Frameworks, signals & platforms — found from sitemap: https://support.didomi.io/iab-integration (checked 2026-10-29)

---

Cite as: whats-best.ai, "Didomi — Consent Management (CMP)", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/consent-management/didomi

Corrections: https://whats-best.ai/correct/1156?target=page