# iubenda Privacy Controls and Cookie Solution — Consent Management (CMP)

iubenda Privacy Controls and Cookie Solution by iubenda s.r.l. holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-10-30. Provenance: EU-Made; sovereignty: not determined.

- Vendor: iubenda s.r.l. (https://www.iubenda.com/de/)
- Category: [Consent Management (CMP)](https://whats-best.ai/software/consent-management.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/consent-management/iubenda
- Alternatives: https://whats-best.ai/software/consent-management/iubenda/alternatives ([markdown](https://whats-best.ai/software/consent-management/iubenda/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-10-30 · oldest source captured 2026-10-29

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: iubenda s.r.l.
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan: Yes, per the vendor’s own page [S6]

## The panel's verdict

iubenda's Privacy Controls and Cookie Solution is a consent management platform that scored strongest on standards and platforms, at 7-8, and pricing transparency, also at 7-8. The captured pages document a registered IAB CMP (ID 123) validated for TCF 2.2, TCF 2.3 consent storage from February 1, 2026, Google Consent Mode v2 in basic and advanced modes, Microsoft UET consent mode, and three published tiers — 5,99 $, 24,99 $ and 99,99 $ per website per month billed annually, with page-view caps of 25K, 50K and 150K. The weakest area is sovereignty, at 3-4: the contracting entity is iubenda S.r.l. of Milan, part of team.blue since 2022, but we found no public information on where the banner script, consent logs or scan results are stored, on subprocessors, or on a published data processing agreement. The judges did not genuinely split — no criterion's scores span more than one point — and the gap they name most often is the first banner layer: the force-enabled buttons documented are Accept and Learn more and customize, with no reject option of equal weight stated.

**Speaks for it:**
- Standards and platforms scores of 7-8, built on a registered IAB CMP (ID 123) validated for TCF 2.2, Google Consent Mode v2 in basic and advanced modes, and Microsoft UET consent mode
- Auto-blocking on by default for new installations with the stricter basic mode, plus manual tagging, a plugin auto-block list and automatic iframe handling
- Consent records that link the person, their preferences, the notice seen and the exact time, are searchable, and export as CSV
- Three published tiers — 5,99 $, 24,99 $ and 99,99 $ per website per month billed annually — with overage at 0,05 € per 1,000 additional page views and a 14-day refund
- Deep banner control across 27 languages, per-country behaviour, customisable colours, fonts and position, with WCAG level AAA stated

**Held against it:**
- Sovereignty scores sit at 3-4, and we found no public information on where the banner script, consent logs or scan results are stored, on subprocessors, or on a published data processing agreement
- The force-enabled buttons documented for the first banner layer are Accept and Learn more and customize, and we found no public information on a reject option of equal weight
- Scanning scores sit at 5-6, with no public information on scan depth, alerts when trackers change, or exportable scan reports
- We found no public information on consent-record retention, storage location, withdrawal as its own event or consent expiry, and the preference log requires the Ultimate plan
- In advanced consent mode Google tags load before the banner and still send cookieless pings on decline, and a default-on option stops blocking TCF-adhering vendors

**Best for:**
- You run advertising to EEA and UK visitors and need a Google-certified CMP under Google's January 2024 requirement
- Your site runs on WordPress, Shopify, Magento, Joomla! or PrestaShop and you want plugin-based setup with auto-blocking on by default
- You need to compute a single website's annual cost from public prices before committing, with a free start requiring no credit card
- You need searchable, CSV-exportable consent records to show to authorities

**Avoid if:**
- You need a reject option of equal prominence to accept on the first banner layer
- You need the consent preference log, hourly rescans or the mobile SDK on a plan below Ultimate
- Your compliance position requires that no Google tag load before consent in any supported mode
- You want to edit banner texts freely once TCF is enabled

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Data Protection Officer | The Agency Developer | The Publisher Marketing Lead | The In-House Lawyer | The WordPress Webmaster | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Banner & choice architecture | 3/5 | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 |
| Prior blocking & script control | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 |
| Scanning & cookie classification | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 2.5/5 |
| Consent records & proof | 3.5/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Frameworks, signals & platforms | 3.5/5 | 3.5/5 | 4/5 | 4/5 | 4/5 | 3.5/5 |
| European sovereignty | 2/5 | 2/5 | 1.5/5 | 2/5 | 2/5 | 1.5/5 |
| Pricing transparency | 4/5 | 4/5 | 4/5 | 3.5/5 | 4/5 | 3.5/5 |
| **Weighted verdict** | **3/5** | **3.5/5** | **3.5/5** | **3/5** | **3.5/5** | **3/5** |

### The judges

- **The Data Protection Officer** (v1.0): External DPO for a dozen mid-sized companies, two of which received a letter from a state supervisory authority about their cookie banner last year. Wants reject on the first layer, nothing loaded before the click, a consent log that shows which banner version each visitor saw, a cookie list that matches the site, and a DPA and subprocessor list that keep visitor data in the EU.
- **The Agency Developer** (v1.0): Lead developer at a web agency that maintains forty client sites on WordPress, TYPO3 and Shopify. Wants one account for every client, blocking that works without rewriting each theme, content blockers for YouTube and Maps, a Tag Manager template, a scanner that flags the tracker a client added on Friday, and a JavaScript API documented well enough that forms and plugins can ask for consent.
- **The Publisher Marketing Lead** (v1.0): Runs marketing for an ad-funded news site and an online shop in the same group, where every point of consent rate shows up in ad revenue and in Google Ads conversions. Wants a registered IAB TCF CMP, Google Consent Mode v2 in advanced mode, banner tests within what the law allows, consent shared between the site and the app, and a dashboard that shows where visitors drop off.
- **The In-House Lawyer** (v1.0): In-house counsel at a retailer with shops in Germany, France and Austria, who has read the court decisions on missing reject buttons and the regulators' banner guidance. Wants § 25 TDDDG and the GDPR mapped to concrete settings, equal-weight choices as the default, consent that can be withdrawn as easily as it was given, and records that would hold up if a competitor or a consumer group sued.
- **The WordPress Webmaster** (v1.0): Looks after the WordPress site of a mid-sized engineering company on top of the actual job, with Google Analytics, a YouTube channel, a Maps embed and a contact form with reCAPTCHA. Wants a plugin that finds these by itself, blocks them until the visitor agrees, survives the next plugin update and caching, and costs a known amount per site per year without a call to sales.
- **The Skeptic** (v1.0): Has opened the browser's network tab on sites with a "certified" banner and watched the ad pixels fire before anything was clicked. Reads "consent rate optimisation" as a hint that reject will be grey and small, "auto-blocking" as a claim until the test steps are published, and "EU hosting" next to a US script CDN — and asks what leaving would cost: the consent logs, and every visitor asked again.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Audit proof records: audit-proof consent records for authorities [S2]
- CCPA optout: CCPA requires opt-out link for data sharing with third parties [S18]
- GDPR record keeping: GDPR record-keeping regulations require the Cookie and Consent Preference Log [S12]
- Google certified cmp: yes · yes [S1]
- Google certified cmp: iubenda is a Google-certified CMP partner [S14]
- Google eea UK requirement: Google requires a certified CMP for ads served to EEA and UK traffic from January 2024 [S18]
- Iab tcf: 2.4 · yes [S1]
- Iab tcf: 2.2 · yes [S14]
- Security posture: yes · yes · yes [S1]
- Tcf integration: Google ads system integrated with IAB Europe TCF [S18]

**Integrations**
- API: yes [S6]
- Cms: integrations for all major CMS [S1]
- Google consent mode v2: yes [S6]
- Google tag manager: yes [S6]
- Gtm template: Google Tag Manager · yes [S4]
- Gtm template managed tags: Google Analytics · Google Ads · Floodlight · Conversion Linker · yes [S4]
- Iab tcf: yes [S6]
- Plugins: yes · WordPress · Joomla! · PrestaShop · Magento [S9]
- Setup options: WordPress plugin · Zapier · JavaScript library · REST API [S5]
- Shopify: yes [S6]
- Two way webhooks: two-way webhooks · HubSpot · Mailchimp · Zapier · Make · n8n [S5]
- Wordpress: yes [S6]

**Legal**
- Company info: iubenda S.r.l. · IT07347120961 · GB370904694 · Via Aosta, 4 – 20155 Mailand (Italien) · 12.795,78 EUR fully paid [S17]
- Copy paste not allowed: no [S8]
- Disclaimer: Service does not constitute legal advice and generated documents are not guaranteed legally compliant [S13]
- Entity: IT07347120961 · iubenda S.r.l. · Italy · Milan Chamber of Commerce · 12603.5 [S13]
- Founded in EU: yes · 25 · 150 · EU [S7]
- Founding year: 2011 [S7]
- Leadership ceo: Manuel Heilmann · CEO [S7]
- Leadership coo: Antonio Sica · Chief Operations Officer [S7]
- Leadership cpo cto: Filippo Barra · Chief Product and Technology Officer [S7]
- Privacy policy reference: Users are referred to iubenda's full privacy policy for data processing details [S8]
- Team blue merger: 2022 · team.blue [S7]
- Warranty disclaimer: no [S8]

**Pricing**
- Advanced pageviews: Advanced · 50000 [S6]
- Advanced price: Advanced · per website per month, billed annually · USD · 24.99 [S6]
- Agency plans: yes [S6]
- Annual discount: 16 [S6]
- Consent proof price: 5 [S6]
- Cookie scanner free: 0 · yes [S13]
- Enterprise custom: custom enterprise plan · yes [S6]
- Essentials pageviews: Essentials · 25000 [S6]
- Essentials price: Essentials · per website per month, billed annually · USD · 5.99 [S6]
- Extra pageviews overage: yes · 0.05 [S6]
- Free plan: yes · no [S1]
- Free plan: yes [S6]
- Free trial: 14 · yes [S6]
- Model: Pricing depends on number of consent records stored; rates on pricing page [S5]
- Newsletter booster price: 5 [S6]
- Payment methods: credit card · PayPal [S6]
- Refund policy: 14 · yes [S6]
- Signup: yes · no [S14]
- Ultimate pageviews: Ultimate · 150000 [S6]
- Ultimate price: Ultimate · per website per month, billed annually · USD · 99.99 [S6]
- Ultimate required: Ultimate [S12]
- US law advanced plan required: apply both GDPR (EU) and US Law · Advanced [S4]
- VAT not included: no [S6]

**Product**
- Ab testing: consentmanager · yes [S18]
- Ad personalization parameter: personalized advertising such as remarketing · ad_personalization [S4]
- Add language entry point: Add language button in Manage languages box on document edit page [S10]
- Additional consent mode: yes [S3]
- Additional consent mode distinction: Additional Consent Mode covers Google ATP list partners not in TCF [S4]
- Adsense via ad manager: only valid for Google Adsense · Google Ad Manager [S11]
- Advanced implementation behavior: yes · yes [S4]
- Advanced mode checkbox: activates Advanced implementation · Do not block Google’s services that adhere to Consent Mode [S4]
- AI powered cmp: consentmanager · yes [S18]
- Analytics storage uspr: analytics_storage · not opted out of purpose s or USPR not relevant [S4]
- API consent sync: API syncs consent decisions across platform [S2]
- Auto blocking: yes · yes [S18]
- Autoblocking default: yes · yes [S4]
- Automation: compliance dashboard with intelligent automation for local and regional regulations [S7]
- Banner buttons force enabled: Accept · Learn more and customize [S3]
- Banner customization: colors · fonts · display style · banner position · language [S18]
- Banner html requirements: %{banner_content} shortcode · iubenda-cs-accept-btn class · iubenda-cs-customize-btn class [S3]
- Banner position: Banner position changeable, optional lightbox effect via background overlay [S9]
- Banner styling: Banner and button colors, dark/light theme, brand colors and logo configurable [S9]
- Banner text editing: chat · email · no · yes [S3]
- Basic implementation behavior: yes [S4]
- Basic vs advanced modes: Basic · Advanced [S4]
- Behavioral modeling ga4: no · Behavioral Modeling in GA4 · yes [S4]
- Branding removal: partial · full · partial [S6]
- Central consent db: yes [S6]
- Certified cmp: ePrivacy · GDPR · US State Laws · CPRA · VCDPA · yes [S3]
- Client count: 90000 · 100+ [S18]
- Cmp google certified: yes [S6]
- Company tenure: 15 · yes [S1]
- Compliance auto settings: Automatic compliance configurations meet strictest major international law requirements; each setting manually editable [S9]
- Compliance scanner: yes [S1]
- Compliance suggestions: System gives explanations and suggestions when choices may cause compliance problems [S9]
- Configurator wizard: Guided configurator with multiple steps for setting up the cookie solution [S9]
- Consent banner: yes [S6]
- Consent blocking: yes · yes · yes [S1]
- Consent database purpose: Records who agreed to what, when, and which notice they saw, syncing status across forms, CRM, and email tools [S5]
- Consent log: yes [S6]
- Consent log: Cookie and Consent Preference Log for GDPR proofs of consent preferences [S12]
- Consent mode: yes [S14]
- Consent mode all plans: no · yes [S4]
- Consent mode all plans: yes [S6]
- Consent mode v2: Google Consent Mode integration stated [S2]
- Consent mode v2 mandatory 2024: EEA new users, audience personalization and measurement · March 2024 [S4]
- Consent mode v2 parameters: consent to send user data to Google for advertising purposes · ad_user_data [S4]
- Consent records: full consent log maintained [S2]
- Consent recovery: Ultimate [S6]
- Consent recovery feature: Displays a custom message instead of pre-blocked scripts and iframes [S12]
- Consent toggle: Consent recovery toggle in Privacy Controls and Cookie Solution configuration [S12]
- Consent update button: Update button pre-selects the required purpose and displays blocked content [S12]
- Consent validity: no [S5]
- Conversion modeling recovery: recovered ~65% of lost conversion data from ad clicks when users reject consent [S4]
- Cookie banner capabilities: yes · yes · yes [S3]
- Cookie banner distinction: Cookie banner records cookie consent; Consent Database records form/sign-up/newsletter/offline consent [S5]
- Cookie consent paywall: yes [S6]
- Cookie paywall: yes [S18]
- Cookie policy linking: Cookie policy can be created with iubenda or user's own and linked to the solution [S9]
- Cookie preference log: Cookie consent proof stored in Cookie and Consent Preference Log of the Privacy Controls and Cookie Solution [S5]
- Cookie scanner: identifies name, duration and full details of active cookies on a site; generates compliance report [S13]
- Covered laws: GDPR, ePrivacy, CCPA/CPRA, LGPD, Swiss FADP, Google rules [S2]
- Custom clauses translation: no [S10]
- Custom service categorization: yes [S11]
- Custom text: Font size and custom text template for banner text editable [S9]
- Customer count: 150000 [S1]
- Customer count: 150000 [S7]
- Customer count: 150000 [S6]
- Demo booking: yes [S5]
- Device referred themes: Device-referred themes [S18]
- Document languages: Czech · Danish · Dutch · US English · UK English · French · German · Greek · Italian · Polish · Portuguese · Brazilian Portuguese · Russian · Spanish · Swedish [S10]
- Documents generated automatically: yes · yes [S8]
- Dsr management: yes [S6]
- Embed snippet: Code snippet embedded before end of HEAD tag [S9]
- Embed snippet: HTML code snippet copy-paste [S18]
- Essentials privacy policy: Essentials [S6]
- Exempted cookies: technical cookies · first-party statistical cookies · anonymized third-party statistical cookies [S11]
- Free start: Free start offered [S5]
- Full consent history: Each record links person, preferences, notice seen, and exact time of choice [S5]
- GDPR article 7: GDPR Article 7(1) requires being able to show that each person agreed [S5]
- GDPR consent params: __tcfapi addEventListener snippet · yes [S3]
- GDPR setting: GDPR compliance setting can be toggled; deactivating flags a compliance problem for EU-based sites/users · yes [S9]
- Geo adaptation: banner adapts to user location globally [S2]
- Geo targeting: Advanced · Ultimate [S6]
- Google ads compatibility: Google Ads, Google Analytics, Floodlight, TCF integration [S18]
- Google certified cmp: Google-certified CMP (per customer testimonial) [S2]
- Google certified cmp: yes · yes · yes [S18]
- Google cmp partner: yes · yes [S3]
- Google consent mode: Google Analytics · Google Ads · Google Ads Conversion Tracking · Remarketing · yes [S11]
- Google consent mode option: yes · ad_storage · ad_user_data · ad_personalization [S3]
- Googleconsentmode option: googleConsentMode · yes [S18]
- Gtm template: Google Tag Manager template listed in Featured Community CMP Templates [S18]
- Gvl auto update: yes [S3]
- Hosting and updates: yes · yes · yes [S8]
- Html class markers: _iub_cs_prompt · data-iub-purposes [S12]

**Support**
- Channels: live_chat · email [S1]
- Channels: live chat · email [S2]
- Included: no · yes [S1]
- Individual: yes [S6]
- Multilingual: yes [S2]
- Paid plans: support included in all paid plans, no add-ons or hidden costs [S2]
- Paid plans included: yes [S6]
- Resources: guides and resources available [S2]

104 more facts on the canonical page: https://whats-best.ai/software/consent-management/iubenda

## Questions

### Is iubenda Privacy Controls and Cookie Solution European?

Yes. whats-best.ai classifies iubenda Privacy Controls and Cookie Solution as EU-Made.

### Where does iubenda Privacy Controls and Cookie Solution store data?

Not stated on the vendor’s pages as of 1 Nov 2026.

### Does iubenda Privacy Controls and Cookie Solution have a free plan?

Yes. iubenda Privacy Controls and Cookie Solution has a free plan, per [the vendor’s page captured 29 Oct 2026](https://whats-best.ai/evidence/13189).

### What are the best alternatives to iubenda Privacy Controls and Cookie Solution?

As of 3 Nov 2026, the panel rates [Usercentrics CMP (3.5/5)](https://whats-best.ai/software/consent-management/usercentrics), [Didomi (3.5/5)](https://whats-best.ai/software/consent-management/didomi) and [CCM19 (3.5/5)](https://whats-best.ai/software/consent-management/ccm19) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Usercentrics CMP](https://whats-best.ai/software/consent-management/usercentrics) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [iubenda Privacy Controls and Cookie Solution alternatives](https://whats-best.ai/software/consent-management/iubenda/alternatives).

## What this page leaves out

- 15 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.iubenda.com/de/ (checked 2026-10-29)
- [S2] Features page (cookie solution): https://www.iubenda.com/de/cookie-solution/ (checked 2026-10-29)
- [S3] Documentation (IAB TCF): https://www.iubenda.com/en/help/7440-the-complete-guide-to-iubenda-cmp-and-iab-tcf/ (checked 2026-10-29)
- [S4] Documentation (Google Consent Mode): https://www.iubenda.com/en/help/27137-google-consent-mode-2/ (checked 2026-10-29)
- [S5] Features page (consent database): https://www.iubenda.com/en/consent-database/ (checked 2026-10-29)
- [S6] Pricing page: https://www.iubenda.com/de/preise/ (checked 2026-10-29)
- [S7] About page (names the legal entity): https://www.iubenda.com/de/uber-iubenda/ (checked 2026-10-29)
- [S8] Terms of service: https://www.iubenda.com/app/de/user/tos (checked 2026-10-29)
- [S9] Banner & choice architecture — found from sitemap: https://www.iubenda.com/de/help/4680-cookie-banner-anpassen/ (checked 2026-10-29)
- [S10] Banner & choice architecture — found from sitemap: https://www.iubenda.com/en/help/137-add-language/ (checked 2026-10-29)
- [S11] Prior blocking & script control — found from sitemap: https://www.iubenda.com/en/help/3081-prior-blocking-of-cookie-scripts/ (checked 2026-10-29)
- [S12] Prior blocking & script control — found from sitemap: https://www.iubenda.com/en/help/104812-how-to-display-a-notice-in-place-of-pre-blocked-scripts/ (checked 2026-10-29)
- [S13] Scanning & cookie classification — found from sitemap: https://www.iubenda.com/en/help/135100-cookie-scanner-2/ (checked 2026-10-29)
- [S14] Scanning & cookie classification — found from sitemap: https://www.iubenda.com/de/help/27806-site-scanner-verwenden/ (checked 2026-10-29)
- [S15] Consent records & proof — found from sitemap: https://www.iubenda.com/en/help/21982-how-to-save-proof-of-consent-to-cookies/ (checked 2026-10-29)
- [S16] Consent records & proof — found from sitemap: https://www.iubenda.com/en/help/46731-how-to-retrieve-proof-of-a-cookie-preferences-for-specific-users/ (checked 2026-10-29)
- [S17] Frameworks, signals & platforms — found from sitemap: https://www.iubenda.com/de/help/229343-consent-mode-uet-von-microsoft/ (checked 2026-10-29)
- [S18] Frameworks, signals & platforms — found from sitemap: https://www.iubenda.com/en/help/141582-google-consent-mode-cmp-iubenda/ (checked 2026-10-29)
- [S19] Privacy policy — found from the homepage: https://www.iubenda.com/de/cookie-und-eprivacy-compliance/ (checked 2026-11-01)

---

Cite as: whats-best.ai, "iubenda Privacy Controls and Cookie Solution — Consent Management (CMP)", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/consent-management/iubenda

Corrections: https://whats-best.ai/correct/1158?target=page