Consent Management (CMP)
iubenda Privacy Controls and Cookie Solution
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by iubenda s.r.l. · www.iubenda.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
iubenda Privacy Controls and Cookie Solution at a glance
- Vendor
- iubenda s.r.l.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 29 Oct 2026
- Panel verdict
- The AI panel rates iubenda Privacy Controls and Cookie Solution 3/5, the mean of 6 judges. iubenda's Privacy Controls and Cookie Solution is a consent management platform that scored strongest on standards and platforms, at 7-8, and pricing transparency, also at 7-8. how scores are made
- As of
- Vendor pages captured 29 Oct 2026 to 1 Nov 2026; evaluated by the panel 30 Oct 2026. all sources
iubenda Privacy Controls and Cookie Solution alternatives, European ones first →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
iubenda's Privacy Controls and Cookie Solution is a consent management platform that scored strongest on standards and platforms, at 7-8, and pricing transparency, also at 7-8. The captured pages document a registered IAB CMP (ID 123) validated for TCF 2.2, TCF 2.3 consent storage from February 1, 2026, Google Consent Mode v2 in basic and advanced modes, Microsoft UET consent mode, and three published tiers — 5,99 $, 24,99 $ and 99,99 $ per website per month billed annually, with page-view caps of 25K, 50K and 150K. The weakest area is sovereignty, at 3-4: the contracting entity is iubenda S.r.l. of Milan, part of team.blue since 2022, but we found no public information on where the banner script, consent logs or scan results are stored, on subprocessors, or on a published data processing agreement. The judges did not genuinely split — no criterion's scores span more than one point — and the gap they name most often is the first banner layer: the force-enabled buttons documented are Accept and Learn more and customize, with no reject option of equal weight stated.
Speaks for it
- Standards and platforms scores of 7-8, built on a registered IAB CMP (ID 123) validated for TCF 2.2, Google Consent Mode v2 in basic and advanced modes, and Microsoft UET consent mode
- Auto-blocking on by default for new installations with the stricter basic mode, plus manual tagging, a plugin auto-block list and automatic iframe handling
- Consent records that link the person, their preferences, the notice seen and the exact time, are searchable, and export as CSV
- Three published tiers — 5,99 $, 24,99 $ and 99,99 $ per website per month billed annually — with overage at 0,05 € per 1,000 additional page views and a 14-day refund
- Deep banner control across 27 languages, per-country behaviour, customisable colours, fonts and position, with WCAG level AAA stated
Held against it
- Sovereignty scores sit at 3-4, and we found no public information on where the banner script, consent logs or scan results are stored, on subprocessors, or on a published data processing agreement
- The force-enabled buttons documented for the first banner layer are Accept and Learn more and customize, and we found no public information on a reject option of equal weight
- Scanning scores sit at 5-6, with no public information on scan depth, alerts when trackers change, or exportable scan reports
- We found no public information on consent-record retention, storage location, withdrawal as its own event or consent expiry, and the preference log requires the Ultimate plan
- In advanced consent mode Google tags load before the banner and still send cookieless pings on decline, and a default-on option stops blocking TCF-adhering vendors
Best for
- You run advertising to EEA and UK visitors and need a Google-certified CMP under Google's January 2024 requirement
- Your site runs on WordPress, Shopify, Magento, Joomla! or PrestaShop and you want plugin-based setup with auto-blocking on by default
- You need to compute a single website's annual cost from public prices before committing, with a free start requiring no credit card
- You need searchable, CSV-exportable consent records to show to authorities
Avoid if
- You need a reject option of equal prominence to accept on the first banner layer
- You need the consent preference log, hourly rescans or the mobile SDK on a plan below Ultimate
- Your compliance position requires that no Google tag load before consent in any supported mode
- You want to edit banner texts freely once TCF is enabled
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 3.5 of 5 |
| Prior blocking & script control | 3.5 of 5 |
| Scanning & cookie classification | 3 of 5 |
| Consent records & proof | 3 of 5 |
| Frameworks, signals & platforms | 4 of 5 |
| European sovereignty | 2 of 5 |
| Pricing transparency | 4 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Auto-blocking is the default, new installations start on the stricter basic Consent Mode implementation, manual tagging and a PHP class cover scripts the automatic list misses, iframes are handled automatically with customisable overlay texts, and a Google Tag Manager template manages consent for named Google tags. The vendor documents the limits plainly — the advanced mode loads Google tags before the banner and still sends cookieless pings on decline, and a default-on option stops blocking TCF-adhering vendors — though I found no public information on server-side tagging or a documented browser test that nothing loads before consent, beyond a UET Tag Helper and a site scan checking Consent Mode use. 4 11 12 17 18
The Agency Developer
Auto-blocking is the default for new installations with the stricter Basic consent-mode behaviour, manual tagging is documented as the fallback alongside an auto-block list, shortcodes and a PHP class, and blocked scripts and iframes can show a custom message with an Update button — my YouTube and Maps embeds are covered, with iframes handled automatically. The Google Tag Manager template is listed in the Featured Community CMP Templates and manages consent for Analytics, Ads, Floodlight and Conversion Linker, and forms read consent through the JavaScript library or REST API. We found no public information on server-side tagging, and the documented verification covers only Microsoft UET tags and whether the site uses Google Consent Mode rather than a general test that nothing loads before consent. 4 5 11 12 17 18
The Publisher Marketing Lead
Auto-blocking is on by default and activates Consent Mode v2 automatically, with a manual tagging path, custom messages and texts for pre-blocked scripts and iframes, a Google Tag Manager template in the Featured Community CMP list, and a PHP class for server-side scripts; consent decisions sync platform-wide through the API. We found no public information on server-side tagging support or a general browser test that nothing loads before consent — verification evidence we can see is limited to the UET Tag Helper for Microsoft tags and a site scan that checks Consent Mode. 2 4 11 12 17 18
The In-House Lawyer
Auto-blocking is the documented default and activates Google Consent Mode v2 with the stricter basic mode for new installations; manual tagging, a plugin auto-block list for popular scripts, automatic iframe handling with customisable placeholder texts, and a Google Tag Manager template are documented in the help centre, including how basic and advanced consent mode differ. The verification methods described are tag-specific — a Microsoft UET helper for Edge and Chrome, and a site scan that checks consent mode usage — and we found no public information on server-side tagging or a general live-site check that nothing loads before consent. 4 11 12 17 18
The WordPress Webmaster
Auto-blocking is on by default and the plugin itself detects and blocks the most popular server-side scripts, with manual wrapping, shortcodes, per-purpose tagging and automatic iframe handling that shows a custom message in place of blocked embeds — that covers my YouTube and Maps situations. A Google Tag Manager template featured in Google's community gallery and both basic and advanced Consent Mode behaviour are documented in depth, but I found no public information on server-side tagging or a general browser test that nothing fires before consent, only the UET Tag Helper and a site scan that checks Consent Mode. 4 11 12 18
The Skeptic
Automatic blocking before consent is default for new installations (Basic Consent Mode, the stricter variant), with manual tagging, an auto-block list in the plugins, automatic iframe handling with custom placeholder messages and per-purpose class activation documented, plus UET Tag Helper verification for Microsoft tags. We found no public information on server-side tagging or a general way to verify nothing loads before consent, and documented defaults let TCF-adhering vendors run unblocked and Google tags load before the banner sending cookieless pings — limits a buyer should weigh against the word "auto-blocking". 4 11 12 17 18
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
The scanner identifies cookies, pixels and trackers with name, duration and full details, produces a compliance report, rescans run monthly on the lower plans and hourly on the top plan, and identified cookies flow automatically into the privacy and cookie policy. I found no public information on scan depth or page counts, scanning behind logins or from different regions, or email alerts when a new or changed tracker appears. 1 2 6 13
The Agency Developer
The scanner detects cookies, pixels and trackers with names and durations, feeds the results automatically into the generated cookie policy, and rescans monthly on the lower plans and hourly on Ultimate, with TCF vendor lists auto-updating from the policy. We found no public information on scan depth or page counts, scanning behind logins or per region, local storage, or email alerts when a new or changed tracker appears — the only alert documented is raised when the TCF configuration finds no vendors. 2 3 6 13
The Publisher Marketing Lead
The scanner finds cookies, pixels and trackers with names, durations and full details, auto-inserts the results into the generated cookie policy, and rescans on a schedule from monthly up to hourly on the top plan. We found no public information on scan depth, alerts when trackers are new or changed, or exportable scan reports, so this sits in the middle band. 2 3 6 13
The In-House Lawyer
The scanner captures cookies, pixels and trackers with name, duration and full details, runs monthly on the paid plans and hourly on the top tier, and writes the results automatically into the cookie policy, which syncs across languages. We found no public information on alerts for new or changed trackers, scanning behind logins or in other regions, or scan reports exportable for an audit, so my own review would still have to confirm the list stays true between scans. 2 6 10 13
The WordPress Webmaster
The scanner crawls for cookies, pixels and trackers, records name, duration and full details, and writes the findings straight into the cookie policy, which then syncs automatically across every language; rescans run monthly and hourly on the top plan. I found no public information on alerts when a new or changed tracker appears, on scan depth, or on local storage, so the list stays current only through the schedule. 2 6 10 13
The Skeptic
A free scanner identifies cookies with name, duration and full details, also captures pixels and trackers, runs rescans monthly (hourly on Ultimate), auto-inserts identified cookies into the privacy and cookie policy, and produces a report on additional legal requirements. We found no public information on scan depth, alerts when trackers change, local storage scanning, or a change history with exportable audit reports. 13 2 6 1
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
Each record links the person, their preferences, the notice they saw and the exact time of the choice, the vendor describes the records as audit-proof for authorities, the log is searchable, and consent status exports as CSV. I found no public information on retention periods or storage location for the records, on withdrawal being recorded as its own event, on configurable consent expiry, or on a consent ID the visitor could look up themselves. 2 5 12
The Agency Developer
Every Consent Database record links the person, their preferences, the notice they saw and the exact time, is searchable and exportable as CSV, and the cookie solution keeps its own preference log that the vendor describes as audit-proof for authorities. We found no public information on retention periods, storage location, configurable consent expiry, withdrawal recorded as its own event, or a consent ID the visitor can look up. 2 3 5 12
The Publisher Marketing Lead
Each record links the person, their preferences, the notice they saw and the exact time of the choice; records are searchable and exportable as CSV, the vendor describes the log as audit-proof for authorities, and there is an option to request fresh consent when a preference is not found. We found no public information on retention periods, storage location, configurable consent expiry, or withdrawal recorded as its own event, and the preference log itself is tied to the top plan. 2 3 5 12
The In-House Lawyer
Every decision is logged in a full consent log the vendor presents as audit-proof for authorities, and records link the person, their preferences, the notice they saw and the exact time, are searchable and exportable as CSV — a credible basis for Article 7 GDPR's burden of proof, and I note the vendor's candour that storing proof does not make the collection itself valid. Retention and storage location of the log, reconstruction of the exact banner version per record, withdrawal recorded as its own event and configurable consent expiry are not described, and the cookie preference log requires the top plan — gaps I would feel before defending these records to a consumer group. 2 5 6 12
The WordPress Webmaster
The Cookie and Consent Preference Log and the Consent Database record who agreed to what, when, and which notice they saw, are searchable and exportable as CSV, and the vendor describes them as audit-proof records for authorities, which is exactly the proof I would need to hand over. Retention periods, storage location, configurable consent expiry and whether withdrawal is recorded as its own event are not shown on any captured page. 2 5 12
The Skeptic
Each logged record links the person, their preferences, the notice they saw and the exact time of choice; records are searchable and exportable as CSV, and the vendor claims audit-proof records for authorities. Retention, storage location, withdrawal as its own event, consent expiry and a consent ID the visitor can look up are not documented on the pages I read, and re-asking is described only when an IAB framework preference is missing. 2 5 3 12
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
A registered IAB CMP ID (number 123) and IAB-validated TCF 2.2 with TCF 2.3 preparation stated, Google-certified CMP status with Consent Mode v2 in both basic and advanced modes, Microsoft UET consent mode, Additional Consent Mode, plugins for WordPress, Joomla!, PrestaShop and Magento plus Shopify, a REST API and JavaScript library, and a mobile SDK on the top plan are all documented. The Global Privacy Platform appears in the vendor's account of helping draft industry standards rather than as a stated supported signal, and I found no public information on Global Privacy Control, connected TV, or separate iOS and Android SDKs. 3 4 5 6 9 17 7
The Agency Developer
For my stack this is the strong suit: registered IAB CMP ID 123 with TCF 2.2 validated and a dated 2.3 timeline, Google-certified CMP status with both Basic and Advanced consent mode documented, Microsoft UET support, a featured Google Tag Manager template, plugins for WordPress, Shopify, Joomla!, PrestaShop and Magento, mobile SDKs with native consent screens, agency plans with client-management extras, and a JavaScript library plus REST API. We found no public information on Global Privacy Platform or Global Privacy Control signals for US states, and the captured pages do not split the SDKs by iOS and Android. 2 3 4 5 6 9 14 17
The Publisher Marketing Lead
For an ad-funded publisher this is the strongest area: registered IAB CMP ID 123 with validated TCF 2.2 and TCF 2.3 storage from February 2026, Google-certified CMP with Consent Mode v2 in basic and advanced mode including cookieless pings, Microsoft UET consent mode via autoblocking or the sync snippet, Additional Consent Mode, plugins for WordPress, Shopify, Magento and more, mobile SDKs, agency plans and a REST API. We found no public information on Global Privacy Control support or connected TV, and GPP appears only as a standard the vendor says it helped shape. 2 3 4 6 14 17
The In-House Lawyer
Signals are documented in depth: a registered IAB CMP (id 123) validated for TCF 2.2 with TCF 2.3 consent storage already active ahead of the February 2026 deadline, Google Consent Mode v2 in both basic and advanced mode with Google-certified partner status and a featured tag-manager template, Microsoft UET consent mode with a default denied state and update signal, US state opt-out handling, plugins for WordPress, Joomla!, PrestaShop, Magento and Shopify, a mobile SDK and a REST API. Global Privacy Control as a product signal and connected TV are not described, so it stops short of one consent across every channel. 3 4 5 6 14 17
The WordPress Webmaster
This is the strongest area for someone like me: a WordPress plugin built on a PHP class also published on Packagist, a Google-certified CMP with registered IAB number 123 and TCF 2.2 with the 2.3 dates already announced, Google Consent Mode v2 in basic and advanced implementations, Additional Consent Mode, Microsoft UET consent mode via autoblocking or a sync snippet, plus a REST API and two-way webhooks into HubSpot and Mailchimp. I found no public information on connected TV or Global Privacy Control, and the mobile SDK is tied to the Ultimate plan, which is why I do not go higher. 3 4 6 9 17
The Skeptic
Deep and current on the major signals: registered CMP ID 123, IAB-validated TCF 2.2 with a dated move to storing TCF 2.3 strings, Google Consent Mode v2 in Basic and Advanced as a Google-certified partner, Microsoft UET consent mode via autoblocking and a sync snippet with the denied default, Additional Consent Mode, mobile SDKs with native screens, plugins for WordPress, Joomla!, PrestaShop, Magento and Shopify, a REST API and agency plans. GPP appears only as a standard the vendor says it helped draft, and we found no public information on GPC as a product signal or connected TV. 3 14 4 17 6 9 2 7
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
The contracting entity is iubenda S.r.l. of Milan with an Italian VAT number and a UK VAT number, the company presents itself as EU-founded, it has belonged to the Belgian team.blue group since 2022, and security is described as oriented to ISO 27001. I found no public information on where the banner script is served from or where consent logs and scan results are stored, no subprocessor list and no published data processing agreement; the only US-linked service I could find is PayPal, named as a checkout payment option in the pricing FAQ. 1 6 7 8 13 17
The Agency Developer
The contracting entity is iubenda S.r.l. in Milan, registered with the Milan Chamber of Commerce, and the parent is team.blue in Ghent, so both ends are European. We found no public information on where the banner script, consent logs or scan results are hosted, on subprocessors, or on a published data processing agreement; PayPal appears only as a checkout payment option, and ISO 27001 is described as a standard the service aligns to rather than a certification with scope. 1 6 7 13 17
The Publisher Marketing Lead
iubenda S.r.l. in Milan with an Italian VAT number is the named contracting entity, the company was founded in the EU and joined the Belgian team.blue group in 2022, and hosting is described as secure and oriented to ISO 27001 without a location. We found no public information on where the banner script, consent logs or scan results are stored, and no subprocessor list or published data processing agreement on the captured pages. 1 7 8 13
The In-House Lawyer
The contracting entity is proven European — iubenda S.r.l., Via Aosta 4, Milan, with an Italian VAT number — and since 2022 part of the team.blue group of Ghent, with a remote team of 150 across 25 countries. Beyond that we found no public information on where the banner script is served or consent logs are stored, no subprocessor list on the pages we read (PayPal appears only as a checkout payment method), no published data processing agreement, and the ISO 27001 statements read as alignment rather than certification with scope — not enough for a tool that sits on every page of shops in Germany, France and Austria. 1 6 7 13 17
The WordPress Webmaster
The contracting entity is iubenda S.r.l. in Milan with an Italian VAT number and registered share capital, founded in the EU, part of team.blue since 2022, and ISO 27001:2017 alignment is stated on the pricing page — as far as it goes, a European house. But I found no public information on where the banner script is served from or the consent logs and scan results are stored, on any subprocessor, or on a published data processing agreement, and a CMP that runs on every page of my site leaves that whole chain unproven. 6 7 13 17
The Skeptic
The contracting entity is proven as iubenda S.r.l., Via Aosta 4, Milan, with team.blue as parent since 2022, and security is stated as alignment with ISO 27001 rather than a certification with named scope. We found no public information on where the banner script is served from, where consent logs and scan results are stored, who the subprocessors are, or a data processing agreement — the only third party named is PayPal, and only as a checkout payment option. 17 7 1 6
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
All three tiers are public with their price per website per month under annual billing — Essentials 5,99 $, Advanced 24,99 $, Ultimate 99,99 $ — each with a stated page-view ceiling, overage at 0,05 € per 1,000 additional page views on every paid plan, add-ons priced at 5 € per month per 1,000 consents, VAT stated as excluded and charged at checkout, a 14-day refund and a free start without a credit card. Agency plans and the enterprise plan are individually tailored on request, and I found no public information on a minimum term or setup fees. 5 6 14
The Agency Developer
All three tiers are published per website per month with their page-view bands, overage is priced at 0,05 € per 1,000 additional page views, the consent-proof and newsletter add-ons carry prices per 1,000 consents, and VAT treatment, the 14-day refund and the free trial are stated — I can compute most of a client's annual cost from the pricing page alone. Agency plans are described as tailored and available on request, so the multi-client book I run is the one figure the public pages do not give me. 4 5 6 14
The Publisher Marketing Lead
Three tiers are public per website per month with page-view caps of 25K, 50K and 150K, overage at 0.05 € per 1,000 additional page views, priced add-ons for consent proof and the newsletter opt-in booster, VAT treatment stated, a 14-day refund, and plan-gated features named including geo-targeting, multilingual support, the preference log and the mobile SDK. Agency and enterprise plans are tailored on request rather than priced, and we found no public price for A/B testing, so the annual cost is computable for domains and traffic but not for every buyer type. 4 5 6 12
The In-House Lawyer
Three tiers are published with exact per-website prices at annual billing (5,99 $, 24,99 $, 99,99 $) and page-view caps of 25K, 50K and 150K, overage at 0,05 € per 1,000 additional page views, add-ons priced at 5 € per month per 1,000 consents, VAT stated as excluded and charged at checkout, a 14-day refund, and plan inclusions from languages to scan frequency broken down in detail. Agency plans are tailored on request, the free offer's limits are not itemised, and we found no public information on a minimum term or setup fee, so the annual cost for our domains is computable but agency terms are not. 4 6 12
The WordPress Webmaster
I can compute my annual cost for one site from the pricing page alone: 5,99 $, 24,99 $ or 99,99 $ per website per month billed annually with 25K, 50K or 150K pageviews, overage at 0,05 € per 1.000 additional pageviews on all paid plans, VAT explicitly excluded and charged at checkout, add-ons priced such as consent proof at 5 €/month per 1.000 consents, a 14-day refund, and even feature gating like US-law support needing at least Advanced is public. Agency and enterprise plans are tailored on request rather than priced, which is the only thing keeping me from full price computability. 4 6
The Skeptic
Three public tiers — 5,99 $, 24,99 $ and 99,99 $ per website per month at annual billing — with page-view bands of 25K, 50K and 150K, overage at 0,05 € per 1.000 additional page views on all plans, add-ons priced at 5 €/Monat pro 1.000 Einwilligungen, VAT treatment stated and a 14-day refund. Agency plans are tailored on request, enterprise pricing is a request form, and the monthly-billing rates and any minimum term are not published, so a defined setup's annual cost is computable but agency use is not. 6 5
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about iubenda Privacy Controls and Cookie Solution
Is iubenda Privacy Controls and Cookie Solution European?
Yes. whats-best.ai classifies iubenda Privacy Controls and Cookie Solution as EU-Made.
Where does iubenda Privacy Controls and Cookie Solution store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does iubenda Privacy Controls and Cookie Solution have a free plan?
Yes. iubenda Privacy Controls and Cookie Solution has a free plan, per the vendor’s page captured 29 Oct 2026.
What are the best alternatives to iubenda Privacy Controls and Cookie Solution?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: iubenda Privacy Controls and Cookie Solution alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 15 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (19)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.iubenda.com Checked 29 Oct 2026 Details →
- 2 Features page (cookie solution) www.iubenda.com Checked 29 Oct 2026 Details →
- 3 Documentation (IAB TCF) www.iubenda.com Checked 29 Oct 2026 Details →
- 4 Documentation (Google Consent Mode) www.iubenda.com Checked 29 Oct 2026 Details →
- 5 Features page (consent database) www.iubenda.com Checked 29 Oct 2026 Details →
- 6 Pricing page www.iubenda.com Checked 29 Oct 2026 Details →
- 7 About page (names the legal entity) www.iubenda.com Checked 29 Oct 2026 Details →
- 8 Terms of service www.iubenda.com Checked 29 Oct 2026 Details →
- 9 Banner & choice architecture — found from sitemap www.iubenda.com Checked 29 Oct 2026 Details →
- 10 Banner & choice architecture — found from sitemap www.iubenda.com Checked 29 Oct 2026 Details →
- 11 Prior blocking & script control — found from sitemap www.iubenda.com Checked 29 Oct 2026 Details →
- 12 Prior blocking & script control — found from sitemap www.iubenda.com Checked 29 Oct 2026 Details →
- 13 Scanning & cookie classification — found from sitemap www.iubenda.com Checked 29 Oct 2026 Details →
- 14 Scanning & cookie classification — found from sitemap www.iubenda.com Checked 29 Oct 2026 Details →
- 15 Consent records & proof — found from sitemap www.iubenda.com Checked 29 Oct 2026 Details →
- 16 Consent records & proof — found from sitemap www.iubenda.com Checked 29 Oct 2026 Details →
- 17 Frameworks, signals & platforms — found from sitemap www.iubenda.com Checked 29 Oct 2026 Details →
- 18 Frameworks, signals & platforms — found from sitemap www.iubenda.com Checked 29 Oct 2026 Details →
- 19 Privacy policy — found from the homepage www.iubenda.com Checked 1 Nov 2026 Details →