Consent Management (CMP)
Piwik PRO Consent Manager
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Piwik PRO S.A. · piwik.pro
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Piwik PRO Consent Manager at a glance
- Vendor
- Piwik PRO S.A.
- Headquarters
- Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 3 Nov 2026
- Panel verdict
- The AI panel rates Piwik PRO Consent Manager 2/5, the mean of 6 judges. Piwik PRO Consent Manager's strongest scores come in standards and platforms, at 6 throughout — Google Consent Mode v2 with stated full Google partnership certification, built-in Microsoft UET consent signals, integrations from WordPress to React Native — and sovereignty, at 6 to 7. how scores are made
- As of
- Vendor pages captured 3 Nov 2026; evaluated by the panel 3 Nov 2026. all sources
Piwik PRO Consent Manager alternatives, European ones first →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Piwik PRO Consent Manager's strongest scores come in standards and platforms, at 6 throughout — Google Consent Mode v2 with stated full Google partnership certification, built-in Microsoft UET consent signals, integrations from WordPress to React Native — and sovereignty, at 6 to 7. The sovereignty scores credit EU hosting — Azure in Germany and the Netherlands plus Elastx in Sweden — a signable data processing agreement, ISO 27001 and SOC 2, and an on-premises option said to fully remove Piwik PRO as a data processor; no subprocessor list or contracting-entity jurisdiction is public. Consent records, at 2 to 3, is the weakest compliance area: the only documented log tracks teammate settings changes, and no public information covers per-visitor consent records or consent-log export. Banner and choice sits at 3: the documented opt-out form opts visitors in by default, and the vendor says it doesn't comply with the GDPR. Prior blocking runs 4 to 5, judges differing over whether the scanner's pre-consent check offsets undocumented blocking outside the tag manager. Pages show no prices beyond a free 30-day trial.
Speaks for it
- Tracking tags are documented to fire only if visitors agree, with a consent type set per tag and client- and server-side Google Tag Manager integrations supported
- A free scanner with no installation or sign-up loads a page like a first-time visitor, records which cookies, requests and trackers fire before consent, and emails results in about a minute
- Google Consent Mode v2 is supported with stated full Google partnership certification, the four Google consent types mapped to banner categories, and Microsoft UET consent signals built in
- Hosting options include Azure in Germany and the Netherlands and EU-operated Elastx in Sweden, alongside a signable data processing agreement and ISO 27001 and SOC 2 certifications
- An on-premises deployment is documented to fully remove Piwik PRO as a data processor, with each client's data in a dedicated database
Held against it
- Only a teammate audit log is documented, covering settings changes in the administration menu alone, with no public information on per-visitor consent records or consent-log export
- The documented opt-out form opts visitors in by default and the vendor itself says it doesn't comply with the GDPR, and we found no public information on the banner's first-layer reject, withdrawal or customisation
- Consent gating is documented inside Piwik PRO's own Tag Manager, with no public information on automatic blocking of scripts added outside it
- We found no public information on IAB TCF or a registered CMP ID, nor on GPP or Global Privacy Control
- The free scanner checks one page at a time, with rescans left to a manual recommendation of after every script-adding change and at least quarterly
Best for
- You run Google Ads or Microsoft Advertising and need consent signals documented to the four mapped Google consent types
- You want a verifiable pre-consent check before each campaign launch — the free scanner reports what fires before any consent, in about a minute
- You need named EU hosting choices, a signable data processing agreement, and an on-premises option that can fully remove the vendor as a data processor
- You build on WordPress or Shopify and want consent gating applied per tag inside the vendor's own tag manager
Avoid if
- You must produce visitor-level consent records with banner versions and retention to answer a supervisory authority — only a teammate audit log is documented
- Your banner's reject option and withdrawal flow must be verifiable in public documentation before purchase — the fully documented mechanism is an opt-out form the vendor itself says doesn't comply with the GDPR
- You need scheduled site-wide scanning or a cookie declaration generated from the scan — the documented scanner checks one page at a time and rescans are left to you
- You cannot install the Google tag (gtag.js) on your site — the documented Consent Mode v2 integration works only with it installed
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 1.5 of 5 |
| Prior blocking & script control | 2 of 5 |
| Scanning & cookie classification | 2 of 5 |
| Consent records & proof | 1 of 5 |
| Frameworks, signals & platforms | 3 of 5 |
| European sovereignty | 3 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Tags are documented to fire only with consent, there is a help-centre page on blocking embedded videos, maps and iframes for visitors who did not consent, and both client-side and server-side Google Tag Manager integrations exist. The free scanner that records what fires before any consent is the verification step I insist on, though it checks one page at a time. 2 7 9 12 13
The Agency Developer
Consent-gated tag firing is properly documented — each tag has a consent type, there is a consent-decision event to trigger on, and tracking tags fire only if visitors agree — plus server-side tagging, client- and server-side Google Tag Manager integrations and their own Tag Manager with templates for Facebook Ads, Google Ads and YouTube. The help centre carries a page on blocking embedded videos, maps and iframes for visitors without consent, but only its title was captured, and I found no public information on automatic blocking of scripts a client hard-coded outside the tag manager. 2 7 12 13
The Publisher Marketing Lead
Tags fire only with consent through per-tag consent types in Piwik PRO's own Tag Manager, a help-centre article covers blocking embedded videos, maps and iframes for visitors who haven't consented, and both client- and server-side Google Tag Manager integrations are listed. The free scanner loads a page like a first-time visitor and reports exactly which cookies, requests and trackers fire before consent — a practical check before a campaign launch — though we found no public information on automatic blocking of scripts outside the tag manager or consent passed to forms and CAPTCHAs. 2 7 9 12 13
The In-House Lawyer
Consent gating inside the product's own tag manager is documented — tags fire only if visitors agree, a consent type is set per tag, and client- and server-side Google Tag Manager integrations exist — and the free scanner records which cookies, requests and trackers fire before any consent, giving the site owner a documented check that nothing loads too early. We found no public information on automatic blocking of third-party scripts outside the tag manager or on placeholders for embedded videos and maps, and the documented pre-consent treatment for Google is that data will be treated as anonymous or null rather than blocked. 2 8 9 12 13
The WordPress Webmaster
Tracking tags fire only when visitors agree, with a consent type set per tag in Piwik PRO Tag Manager on a consent-decision event, and server-side Google Tag Manager is supported; a help article on blocking embedded videos and maps for non-consenting visitors also exists. The captured pages describe no automatic blocking of scripts added outside their tag manager, but the free scanner loads a page like a first-time visitor and records which cookies, requests and trackers fire before consent — exactly the after-update check I want. 2 7 9 12 13
The Skeptic
What is documented is consent-gated firing inside the tag manager — "your tracking tags will fire only if visitors agree to their use" — with client-side and server-side Google Tag Manager integrations and a help page on blocking embedded videos, maps and iframes until consent. Credit where due: pre-consent behaviour is testable, since the scanner records what fires "before any consent is given"; but we found no public information on automatic blocking of third-party scripts, and the documented check runs one page at a time. 2 13 7 9
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
A free scanner checks one page at a time and records pre-consent cookies, network requests and trackers grouped into categories, with first-, third-party and unclassified cookies named and a candid note that the score does not confirm legal compliance. I found no public information on scheduled rescans, a maintained classification database with purposes and lifetimes, or a cookie declaration generated from the scan. 9 1
The Agency Developer
The free scanner loads a page like a first-time visitor and records exactly what fires before consent — first-party, third-party and unclassified cookies, trackers grouped by category, every network request — plus checks for the CMP, a reject-all button and Google Consent Mode, delivered by email with an A–D score in about a minute. That is my Friday-tracker check, but it runs one page at a time with no scheduled rescans, and the captured pages give no information on a maintained cookie database with lifetimes or a cookie declaration generated from the scan. 9
The Publisher Marketing Lead
The free GDPR cookie scanner classifies first-party, third-party and unclassified cookies, groups trackers into analytics, advertising, session recording and tag management, splits network requests by party, and emails a graded privacy score in about a minute. It scans one page at a time with rescans left to a manual recommendation of after every script-adding change and at least quarterly, and we found no public information on scheduled crawls, a maintained vendor database or a cookie declaration generated from the scan. 9
The In-House Lawyer
The free scanner loads a page like a first-time visitor and reports first-party, third-party and unclassified cookies, trackers grouped into analytics, advertising, session recording and tag management, and all network requests, with results in about a minute and a report delivered by email. But it checks one page at a time, the stated cadence is a recommendation to rescan quarterly rather than a scheduled scan, and we found no public information on a maintained vendor database of services with purposes and lifetimes, alerts on new trackers, or a cookie declaration generated from the scan. 1 9
The WordPress Webmaster
A free, no-signup scanner checks one page at a time and reports first-party, third-party and unclassified cookies, trackers grouped into categories such as analytics, advertising and tag management, plus third-party network requests, with results in about a minute and a report by email. Scheduled rescans, a maintained classification database and a self-updating cookie declaration are not described; the pages only recommend rescanning manually after each script-adding change and at least quarterly. 1 9
The Skeptic
The free scanner is concrete and honest about its limits: it "loads your page and records which cookies, requests and trackers fire before any consent is given", splits cookies into first-party, third-party and unclassified, groups trackers by category, and says plainly the score "doesn't confirm legal compliance". It checks one page at a time, rescans are a manual recommendation ("at least once a quarter"), and we found no public information on scheduled crawling, a maintained classification database, alerts on new trackers, or a cookie declaration generated from the scan. 9 1
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
The documented audit log explicitly tracks only teammates' settings changes, not visitor consents, and I found no public information on per-consent records with a pseudonymous ID, the banner version shown, retention, or export of a consent log. Given two of my clients received a supervisory letter over their banner, this is the gap that concerns me most. 10 11 12
The Agency Developer
Everything captured about logging concerns a platform audit log of teammates' logins and settings changes, explicitly scoped to Administration settings, with CSV and API export and an adjustable retention period. I found no public information on records of individual visitor consents — time, pseudonymous ID, choices made, the banner version shown, retention or export — on the pages I read. 10 11
The Publisher Marketing Lead
The vendor claims complete audit trails for data-processing-agreement inquiries and the Consent Manager obtains valid consents, but the audit log actually documented tracks teammate logins and settings changes in the administration area — filterable, exportable to CSV or API, with adjustable retention. We found no public information on per-visitor consent records, banner versions shown, consent expiry or a consent log a supervisory authority could read. 2 3 10 11
The In-House Lawyer
What is documented is a platform audit log of teammates' actions — scoped only to settings changes in the administration menu — with an adjustable retention period, irreversible deletion when the period is shortened, and export as CSV or through an API, alongside a claim of complete audit trails for DPA inquiries. We found no public information on a record per consent with the choices made and the banner version shown, a consent ID the visitor could look up, or withdrawal recorded as its own event — precisely what I would need to hand a supervisory authority or defend against a consumer group. 3 10 11
The WordPress Webmaster
The only record-keeping the captured pages document is an audit log of teammates' settings changes — stated to currently cover only changes made in the administration menu — with adjustable retention and CSV or API export. I found no public information on per-visitor consent records, the banner version shown to each visitor, retention of consents, or an export of the consent log. 10 11
The Skeptic
My leaving-cost question gets no answer: we found no public information on a per-visitor consent record, its retention, the banner version shown, or exporting the consent log. What is documented in depth is an audit log of teammate actions — its own help page says it "only shows changes made to settings in Menu > Administration" — exportable as CSV or via API, which proves who changed settings, not what a visitor consented to. 11 10 12
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
Google Consent Mode v2 with full Google partnership certification, automatic consent signals, Microsoft UET consent signals, mapped Google consent types, iOS, Android and cross-platform SDKs, and a long list of CMS and shop integrations are all documented. I found no public information on IAB TCF or a registered CMP ID, nor on GPP or Global Privacy Control for US states. 3 12 13
The Agency Developer
Google Consent Mode v2 is supported with stated Google partnership certification and mapped to ad storage, ad user data, ad personalization and analytics storage, built-in Microsoft UET consent signals are documented, and there are iOS, Android, Flutter and React Native SDKs, plugins for WordPress, Shopify, Drupal and WooCommerce, multi-site filtering under one account with SSO, and a REST API at least for the audit log. I found no public information on IAB TCF or a registered CMP ID, on GPP or Global Privacy Control, or on an agency or partner program — and no TYPO3 integration in the captured list, which matters to half my clients. 2 3 10 12 13
The Publisher Marketing Lead
Google Consent Mode v2 is documented in real depth — full Google partnership certification, the mapping of ad storage, ad user data, ad personalization and analytics storage to banner choices, applied in all countries, with pre-consent Google data treated as anonymous or null — plus built-in Microsoft UET consent signals, iOS, Android, Flutter and React Native SDKs, and plugins for WordPress, Shopify, Drupal, WooCommerce and more. Two buyer caveats: the Consent Mode v2 integration requires gtag.js installed on the site, and we found no public information on IAB TCF registration with a CMP ID, GPP or Global Privacy Control, or agency accounts. 3 12 13
The In-House Lawyer
Google Consent Mode v2 is supported with full Google partnership certification and the four Google consent types mapped to banner categories, and built-in Microsoft UET consent signals are documented; there are iOS, Android, Flutter and React Native SDKs, WordPress, Shopify, Drupal and WooCommerce plugins, and multiple sites manageable from one account. We found no public information on an IAB TCF registration with a CMP ID, the Global Privacy Platform or Global Privacy Control, agency accounts, or connected TV — and for European advertising the TCF silence is the gap that stands out. 3 11 12 13
The WordPress Webmaster
Google Consent Mode v2 is supported with stated full Google partnership certification, the four Google consent signals mapped to banner categories and applied in all countries, and Microsoft UET consent signals are built in; there are plugins for WordPress, Drupal, Shopify, Wix and Squarespace plus iOS, Android, Flutter and React Native SDKs, which covers my stack and more. I found no public information on IAB TCF or a registered CMP ID, on GPP or GPC for US states, or on agency accounts managing many client sites. 3 12 13
The Skeptic
Consent Mode v2 is documented to the signal level — the four Google consent types mapped to remarketing and analytics — with "full Google partnership certification" claimed, Microsoft UET consent signals built in, and app SDKs for iOS, Android, Flutter and React Native alongside WordPress, Shopify and a long integration list. The gaps: we found no public information on IAB TCF or a registered CMP ID, nor on GPP or GPC, and consent mode is "automatically applied in all countries" with no regional rule described. 12 3 13 10
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
EU hosting is named concretely — Azure Germany and the Netherlands, EU-operated Elastx in Sweden — with EU data residency, a data processing agreement to sign, ISO 27001 and SOC 2, a dedicated database per client, and an on-premises option that removes the vendor as processor entirely. But I found no public information on a subprocessor list with locations, or on where the banner script and consent data are served. 2 3 9
The Agency Developer
EU hosting sits on named infrastructure — Azure in Germany and the Netherlands and Elastx's EU-operated data centers in Sweden — with customer choice of data location, an on-premises option stated to fully remove Piwik PRO as a data processor, a detailed data processing agreement on offer, and ISO 27001 and SOC 2 certifications named. The captured pages state nothing about the contracting entity's jurisdiction, where the banner script is served, where consent logs are stored, or who the subprocessors are. 2 3
The Publisher Marketing Lead
EU hosting is named and concrete — Azure in Germany and the Netherlands plus EU-operated Elastx data centers in Sweden — with EU data residency claimed, a data processing agreement offered, ISO 27001 and SOC 2 stated, a dedicated database per client, and an on-premises deployment that fully removes Piwik PRO as a data processor. Beyond hosting, we found no public information on the contracting entity's jurisdiction, where the banner script is served from, or the subprocessor list with locations. 2 3
The In-House Lawyer
The vendor names its hosting — public cloud on Azure in Germany, the Netherlands, the US and Hong Kong or Elastx's EU-operated Swedish data centres, plus private cloud options — states it offers EU data residency under European jurisdiction, offers a data processing agreement, cites ISO 27001 and SOC 2, and can deploy on-premises so the customer can fully remove Piwik PRO as a data processor. The captured pages leave open the contracting entity's jurisdiction, where the banner script itself is served from, and any list of subprocessors with their locations; for a tool that sees every visitor on every page, that missing chain is what keeps me from scoring higher. 2 3
The WordPress Webmaster
Hosting is publicly documented with named EU options — Azure in Germany or the Netherlands and EU-operated data centres in Sweden — alongside stated EU data residency, a signable data processing agreement, ISO 27001 and SOC 2 certifications, and an on-premises deployment said to fully remove Piwik PRO as a data processor. I found no public information on a subprocessor list with locations or on the contracting entity's jurisdiction, which is what keeps this short of the top level. 2 3
The Skeptic
EU residency is a customer's choice rather than the product's default — public cloud runs on Azure in the US, Germany, Hong Kong or the Netherlands, plus EU-operated Elastx in Sweden — with ISO 27001 and SOC 2 stated, a detailed data processing agreement offered, and an on-premises option to "fully remove Piwik PRO as a data processor". But the captured pages give no contracting-entity jurisdiction, no subprocessor list, and no statement of where the banner script or consent logs are served and stored. 2 3
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
Only a free 30-day trial without a credit card and the plan names Business and Enterprise are public; I found no public prices per domain or traffic band, no tier limits, and no add-on or agency pricing. A buyer cannot compute an annual cost from the captured pages alone. 1 2 3
The Agency Developer
All I can compute from the captured pages is a free 30-day trial — "No credit card required for trial." — and a support note that training and support come with Business and Enterprise plans. The pages I read carry no price figures, tier inclusions, per-domain or traffic scaling rules, overage costs or agency terms. 1 3
The Publisher Marketing Lead
Public pages show a 30-day free trial with no credit card required, and plan names surface only indirectly through training and support included with Business and Enterprise plans. We found no public prices, tier limits or per-domain costs on the captured pages, so I cannot compute the annual cost for my news site and shop from public information alone. 1 2 3
The In-House Lawyer
The captured pages show a free 30-day trial with no credit card required, plan names — training and support included with Business and Enterprise — and a subscription area where retention is set, but we found no public prices, no scaling rule per domain or traffic, and no add-on or overage pricing. As a buyer I cannot compute an annual cost from these pages alone. 1 3 11
The WordPress Webmaster
The captured pages contain no price figures at all — only a free 30-day trial without a credit card and plan names (Business, Enterprise) with training and support said to be included. As the person who wants a known annual cost per site without calling sales, I cannot compute that cost from what is public. 1 2 3
The Skeptic
The captured pages go as far as plan names — "Training and support included with Business and Enterprise plans" — a "free 30-day trial" with "No credit card required for trial", and a free scanner. Beyond that we found no public information on prices, tier limits, or how cost scales with domains or traffic, so a buyer cannot compute the annual cost from these pages. 1 2 3
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Piwik PRO Consent Manager
Is Piwik PRO Consent Manager European?
Not determined: the vendor’s pages as captured do not say where Piwik PRO Consent Manager is based.
Where does Piwik PRO Consent Manager store data?
Not stated on the vendor’s pages as of 3 Nov 2026.
Does Piwik PRO Consent Manager have a free plan?
Not stated on the vendor’s pages as of 3 Nov 2026.
What are the best alternatives to Piwik PRO Consent Manager?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Piwik PRO Consent Manager alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 3 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 9 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (13)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page piwik.pro Checked 3 Nov 2026 Details →
- 2 Privacy policy — found from the homepage piwik.pro Checked 3 Nov 2026 Details →
- 3 Security / trust page — found from the homepage piwik.pro Checked 3 Nov 2026 Details →
- 4 Code repository (open-source licence) — found from the homepage github.com Checked 3 Nov 2026 Details →
- 5 Banner & choice architecture — found from sitemap help.piwik.pro Checked 3 Nov 2026 Details →
- 6 Banner & choice architecture — found from sitemap help.piwik.pro Checked 3 Nov 2026 Details →
- 7 Prior blocking & script control — found from sitemap help.piwik.pro Checked 3 Nov 2026 Details →
- 8 Prior blocking & script control — found from sitemap help.piwik.pro Checked 3 Nov 2026 Details →
- 9 Scanning & cookie classification — found from sitemap piwik.pro Checked 3 Nov 2026 Details →
- 10 Consent records & proof — found from sitemap developers.piwik.pro Checked 3 Nov 2026 Details →
- 11 Consent records & proof — found from sitemap help.piwik.pro Checked 3 Nov 2026 Details →
- 12 Frameworks, signals & platforms — found from sitemap help.piwik.pro Checked 3 Nov 2026 Details →
- 13 Frameworks, signals & platforms — found from sitemap piwik.pro Checked 3 Nov 2026 Details →