# Piwik PRO Consent Manager — Consent Management (CMP)

Piwik PRO Consent Manager by Piwik PRO S.A. holds a panel rating of 2/5 from 6 AI judges (category median 3/5), as of 2026-11-03. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: Piwik PRO S.A. (https://piwik.pro)
- Category: [Consent Management (CMP)](https://whats-best.ai/software/consent-management.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/consent-management/piwik-pro-consent-manager
- Alternatives: https://whats-best.ai/software/consent-management/piwik-pro-consent-manager/alternatives ([markdown](https://whats-best.ai/software/consent-management/piwik-pro-consent-manager/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-11-03 · oldest source captured 2026-11-03

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Piwik PRO S.A.
- Headquarters: Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 3 Nov 2026

## The panel's verdict

Piwik PRO Consent Manager's strongest scores come in standards and platforms, at 6 throughout — Google Consent Mode v2 with stated full Google partnership certification, built-in Microsoft UET consent signals, integrations from WordPress to React Native — and sovereignty, at 6 to 7. The sovereignty scores credit EU hosting — Azure in Germany and the Netherlands plus Elastx in Sweden — a signable data processing agreement, ISO 27001 and SOC 2, and an on-premises option said to fully remove Piwik PRO as a data processor; no subprocessor list or contracting-entity jurisdiction is public. Consent records, at 2 to 3, is the weakest compliance area: the only documented log tracks teammate settings changes, and no public information covers per-visitor consent records or consent-log export. Banner and choice sits at 3: the documented opt-out form opts visitors in by default, and the vendor says it doesn't comply with the GDPR. Prior blocking runs 4 to 5, judges differing over whether the scanner's pre-consent check offsets undocumented blocking outside the tag manager. Pages show no prices beyond a free 30-day trial.

**Speaks for it:**
- Tracking tags are documented to fire only if visitors agree, with a consent type set per tag and client- and server-side Google Tag Manager integrations supported
- A free scanner with no installation or sign-up loads a page like a first-time visitor, records which cookies, requests and trackers fire before consent, and emails results in about a minute
- Google Consent Mode v2 is supported with stated full Google partnership certification, the four Google consent types mapped to banner categories, and Microsoft UET consent signals built in
- Hosting options include Azure in Germany and the Netherlands and EU-operated Elastx in Sweden, alongside a signable data processing agreement and ISO 27001 and SOC 2 certifications
- An on-premises deployment is documented to fully remove Piwik PRO as a data processor, with each client's data in a dedicated database

**Held against it:**
- Only a teammate audit log is documented, covering settings changes in the administration menu alone, with no public information on per-visitor consent records or consent-log export
- The documented opt-out form opts visitors in by default and the vendor itself says it doesn't comply with the GDPR, and we found no public information on the banner's first-layer reject, withdrawal or customisation
- Consent gating is documented inside Piwik PRO's own Tag Manager, with no public information on automatic blocking of scripts added outside it
- We found no public information on IAB TCF or a registered CMP ID, nor on GPP or Global Privacy Control
- The free scanner checks one page at a time, with rescans left to a manual recommendation of after every script-adding change and at least quarterly

**Best for:**
- You run Google Ads or Microsoft Advertising and need consent signals documented to the four mapped Google consent types
- You want a verifiable pre-consent check before each campaign launch — the free scanner reports what fires before any consent, in about a minute
- You need named EU hosting choices, a signable data processing agreement, and an on-premises option that can fully remove the vendor as a data processor
- You build on WordPress or Shopify and want consent gating applied per tag inside the vendor's own tag manager

**Avoid if:**
- You must produce visitor-level consent records with banner versions and retention to answer a supervisory authority — only a teammate audit log is documented
- Your banner's reject option and withdrawal flow must be verifiable in public documentation before purchase — the fully documented mechanism is an opt-out form the vendor itself says doesn't comply with the GDPR
- You need scheduled site-wide scanning or a cookie declaration generated from the scan — the documented scanner checks one page at a time and rescans are left to you
- You cannot install the Google tag (gtag.js) on your site — the documented Consent Mode v2 integration works only with it installed

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Data Protection Officer | The Agency Developer | The Publisher Marketing Lead | The In-House Lawyer | The WordPress Webmaster | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Banner & choice architecture | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 |
| Prior blocking & script control | 2.5/5 | 2/5 | 2.5/5 | 2/5 | 2/5 | 2/5 |
| Scanning & cookie classification | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Consent records & proof | 1/5 | 1/5 | 1.5/5 | 1.5/5 | 1/5 | 1/5 |
| Frameworks, signals & platforms | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| European sovereignty | 3/5 | 3/5 | 3/5 | 3/5 | 3.5/5 | 3/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **2/5** | **2/5** | **2.5/5** | **2/5** | **2/5** | **2/5** |

### The judges

- **The Data Protection Officer** (v1.0): External DPO for a dozen mid-sized companies, two of which received a letter from a state supervisory authority about their cookie banner last year. Wants reject on the first layer, nothing loaded before the click, a consent log that shows which banner version each visitor saw, a cookie list that matches the site, and a DPA and subprocessor list that keep visitor data in the EU.
- **The Agency Developer** (v1.0): Lead developer at a web agency that maintains forty client sites on WordPress, TYPO3 and Shopify. Wants one account for every client, blocking that works without rewriting each theme, content blockers for YouTube and Maps, a Tag Manager template, a scanner that flags the tracker a client added on Friday, and a JavaScript API documented well enough that forms and plugins can ask for consent.
- **The Publisher Marketing Lead** (v1.0): Runs marketing for an ad-funded news site and an online shop in the same group, where every point of consent rate shows up in ad revenue and in Google Ads conversions. Wants a registered IAB TCF CMP, Google Consent Mode v2 in advanced mode, banner tests within what the law allows, consent shared between the site and the app, and a dashboard that shows where visitors drop off.
- **The In-House Lawyer** (v1.0): In-house counsel at a retailer with shops in Germany, France and Austria, who has read the court decisions on missing reject buttons and the regulators' banner guidance. Wants § 25 TDDDG and the GDPR mapped to concrete settings, equal-weight choices as the default, consent that can be withdrawn as easily as it was given, and records that would hold up if a competitor or a consumer group sued.
- **The WordPress Webmaster** (v1.0): Looks after the WordPress site of a mid-sized engineering company on top of the actual job, with Google Analytics, a YouTube channel, a Maps embed and a contact form with reCAPTCHA. Wants a plugin that finds these by itself, blocks them until the visitor agrees, survives the next plugin update and caching, and costs a known amount per site per year without a call to sales.
- **The Skeptic** (v1.0): Has opened the browser's network tab on sites with a "certified" banner and watched the ad pixels fire before anything was clicked. Reads "consent rate optimisation" as a hint that reject will be grey and small, "auto-blocking" as a claim until the test steps are published, and "EU hosting" next to a US script CDN — and asks what leaving would cost: the consent logs, and every visitor asked again.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Audit log HIPAA: yes [S11]
- Audit trails: yes · yes [S3]
- Baa infrastructure: yes [S3]
- Certifications: ISO 27001 · SOC 2 [S3]
- Certifications: ISO 27001 · SOC 2 · HIPAA [S2]
- Data residency control: yes [S2]
- DPA available: yes [S2]
- External audits: yes [S2]
- GDPR: yes [S1]
- HIPAA: yes [S1]
- HIPAA baa: yes [S3]
- Noconsent analytics: yes [S3]
- Regulations: GDPR · LGPD · PIPEDA · DORA · TTDSG/TDDDG · CNIL guidelines [S2]
- Sectoral standards: yes · yes · yes [S2]

**Data**
- Audit log retention: Administration > Account > Subscription · yes [S11]
- Audit log shortened retention: yes [S11]
- Backup policy: Database Data · HTTP Access Logs · System Configuration [S2]

**Hosting**
- Cloud infrastructure: US · Germany · Hong Kong · Netherlands · Sweden · yes · 99.5 [S2]
- Options: Azure US · Azure NL · Azure DE · Azure HK · EU-operated data centers in Sweden · Azure (60+ regions) · Elastx [S3]
- Options: dedicated database · dedicated hardware · yes · 60 [S2]

**Integrations**
- Ab tasty: AB Tasty integration [S13]
- Amp: AMP integration [S13]
- Android sdk: Android SDK [S13]
- Angular: Angular integration [S13]
- Audit log API export: yes [S11]
- Audit log CSV export: yes [S10]
- Automation tools: No-code automation tools such as Zapier [S13]
- Aws s3: AWS S3 data storage integration [S13]
- Azure blob storage: Azure Blob Storage integration [S13]
- Bigquery: BigQuery raw data export [S13]
- Client side gtm: Client-side Google Tag Manager integration [S13]
- Conductrics: Conductrics integration [S13]
- Cookie information: Cookie Information CMP integration [S13]
- Cookiebot: Cookiebot CMP integration [S13]
- Data import: Data import via incoming webhooks or direct integrations [S13]
- Didomi: Didomi CMP integration [S13]
- Drupal: Drupal module [S13]
- Flutter sdk: Flutter SDK [S13]
- Gatsby: Gatsby integration [S13]
- Google ads: Google Ads integration for campaign traffic and conversion data [S13]
- Google consent mode v2: yes [S3]
- Google search console: Google Search Console integration [S13]
- Google sheets: Google Sheets export integration [S13]
- Ios sdk: iOS SDK [S13]
- Looker studio: Looker Studio (Google Data Studio) integration [S13]
- Microsoft ads: yes [S3]
- Nextjs: Next.js integration [S13]
- Nuxt: Nuxt integration [S13]
- Omniconvert: Omniconvert integration [S13]
- Onetrust: OneTrust integration [S13]
- Optimizely: Optimizely integration [S13]
- Piwik tag manager: Piwik PRO Tag Manager with Facebook Ads, Google Ads, YouTube and tag templates [S13]
- Power bi: Microsoft Power BI integration [S13]
- Pwa: Progressive web apps integration [S13]
- React: React integration [S13]
- React native sdk: React Native SDK [S13]
- Sdg: Single digital gateway (SDG) monthly report integration, available upon request to all users [S13]
- Server side gtm: Server-side Google Tag Manager integration [S13]
- Sftp: SFTP server data export [S13]
- Shopify: Shopify integration [S13]
- Shopify app: Piwik PRO Shopify app [S13]
- Squarespace: Squarespace integration [S13]
- Supermetrics: Supermetrics integration [S13]
- Tools: Cookie Scanner · URL Builder · ROI calculator · Google Consent Mode Scanner [S1]
- Vue: Vue integration [S13]
- Vwo: VWO (Visual Website Optimizer) integration [S13]
- Webhooks: Webhooks for CDP data activation [S13]
- Webtrends optimize: Webtrends Optimize integration [S13]
- Wix: Wix integration [S13]
- Woocommerce: WooCommerce integration [S13]
- Wordpress: WordPress plugin [S13]

**Legal**
- Bug bounty: yes [S1]
- Copyright entity: Piwik PRO [S3]
- Documents: Privacy policy · Service Level Agreement · Sitemap · Bug bounty program [S3]
- Verified domain: piwik.pro · yes [S4]

**Pricing**
- Trial credit card: no [S1]

**Product**
- Analytics data ownership: no · yes [S9]
- Anonymous tracking: Anonymous tracking capability claimed to yield more complete traffic data [S1]
- Anonymous tracking: yes [S3]
- Anonymous upgrade: yes [S3]
- API security: JSON Web Tokens [S2]
- Audit log: yes · owner · Tracks how teammates use Piwik PRO; shows who logged in and changed settings [S11]
- Audit log API: Piwik PRO exposes an Audit Log API endpoint for retrieving a list of Audit Log entries [S10]
- Audit log CSV export: exports only currently visible logs · yes [S11]
- Audit log filtering: yes · type=app.added,app.edited [S10]
- Audit log filters: yes · yes [S11]
- Audit log pagination: 100 · 10 · 0 [S10]
- Audit log scope: settings changes in Menu > Administration only [S11]
- Ccpr cpra features: yes · yes [S3]
- Checks cmp: CMP detection [S9]
- Checks consent withdrawal: consent withdrawal check [S9]
- Checks cookies: first-party · third-party · unclassified · cookies [S9]
- Checks google consent mode v2: Google Consent Mode v2 detection [S9]
- Checks network requests: first-party · third-party · network_requests [S9]
- Checks privacy policy: privacy policy link check [S9]
- Checks reject all button: reject-all button check [S9]
- Checks trackers: trackers · analytics · advertising · session recording · tag management [S9]
- Client data separation: yes [S2]
- Consent manager: yes [S2]
- Consent manager required: Consent Manager must be used to collect visitor consents for this integration [S12]
- Consent mode v2 geography: all countries [S12]
- Consent signal flow: yes [S3]
- CRM data consent: scan request data stored in Piwik PRO CRM [S9]
- Data anonymization: yes [S2]
- Data capture claim: 4x more data than the industry standard [S3]
- Data ownership: Captures web and mobile traffic data under demanding regulatory conditions [S1]
- Default tag piwik pro: Piwik PRO tag [S5]
- Free trial: yes [S2]
- Google consent mode v2 integration: Piwik PRO offers an integration with Google consent mode v2 [S12]
- Granular permissions SSO: SAML · Active Directory/LDAP · yes [S2]
- Gtag js required: Google tag (gtag.js) installed on the site · no [S12]
- Laws supported count: 140+ [S3]
- Mapped consent types: ad_storage · ad_user_data · ad_personalization · analytics_storage [S12]
- Markets: 144+ [S3]
- Modules: Analytics · Tag Manager · Consent Manager · Data Activation [S1]
- Modules: Analytics · Tag Manager · Data Activation · Consent Manager · Cookie Information CMP [S3]
- Modules: Web Analytics · Tag Manager · Consent Manager · Data Activation [S11]
- Modules listed: Web Analytics · Tag Manager · Consent Manager · Data Activation [S5]
- Network security: yes · firewall · servers · DNS · page load response times · web requests & errors [S2]
- Optout form customizable: yes [S5]
- Optout form removed from UI: yes · no [S5]
- Optout not GDPR compliant: no · Consent Manager [S5]
- Optout respect dnt setting: Respect opt-out and DNT · yes [S5]
- Physical access control: yes · yes [S2]
- Pre consent data treatment: Data received by Google between page opening and consent update is treated as anonymous or null [S12]
- Privacy score bands: 30-32 · 25-29 · 16-24 · 0-15 [S9]
- Real time actions: Targeted actions can be launched based on real-time user behavior [S1]
- Recommended scan frequency: after every script-adding change and at least quarterly [S9]
- Regulations supported: GDPR · LGPD · Personal Data Protection Bill · CCPA · HIPAA · New Zealand Privacy Bill · 6 [S3]
- Report delivery: email [S9]
- Scan method: loads page like first-time visitor, records pre-consent firing [S9]
- Scan scope: one page at a time [S9]
- Scan speed: Results in about a minute, right here on the page [S9]
- Scanner free no signup: yes · no · no [S9]
- Score not legal compliance: no [S9]
- Self hosted perimeter: yes · yes [S2]
- SSO: yes [S3]
- Tag manager: Server-side tracking and tagging supported [S1]
- Tag manager consent firing: consent-based tag firing · Cookie Information CMP [S9]
- Tag manager setup: Custom code tag in Piwik PRO Tag Manager · All page views plus data layer event 'stg.consentDecisionMade' [S12]
- Trial: 30 · yes [S3]
- User data requests: deletion · change · transfer [S2]
- Visitors opted in by default: yes [S5]

**Support**
- Community: yes [S11]
- Community help: community support available [S5]
- Developers: yes [S1]
- Plans: Training and support included with Business and Enterprise plans [S1]
- Services: onboarding, training, implementation support, help center, Community forum, dedicated account manager, technical support [S3]
- SLA: yes [S1]
- SLA uptime: yes · 99 [S2]
- Status page: yes [S1]

## Questions

### Is Piwik PRO Consent Manager European?

Not determined: the vendor’s pages as captured do not say where Piwik PRO Consent Manager is based.

### Where does Piwik PRO Consent Manager store data?

Not stated on the vendor’s pages as of 3 Nov 2026.

### Does Piwik PRO Consent Manager have a free plan?

Not stated on the vendor’s pages as of 3 Nov 2026.

### What are the best alternatives to Piwik PRO Consent Manager?

As of 3 Nov 2026, the panel rates [Usercentrics CMP (3.5/5)](https://whats-best.ai/software/consent-management/usercentrics), [Didomi (3.5/5)](https://whats-best.ai/software/consent-management/didomi) and [CCM19 (3.5/5)](https://whats-best.ai/software/consent-management/ccm19) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Usercentrics CMP](https://whats-best.ai/software/consent-management/usercentrics) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Piwik PRO Consent Manager alternatives](https://whats-best.ai/software/consent-management/piwik-pro-consent-manager/alternatives).

## What this page leaves out

- 9 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor page: https://piwik.pro (checked 2026-11-03)
- [S2] Privacy policy — found from the homepage: https://piwik.pro/privacy-security/ (checked 2026-11-03)
- [S3] Security / trust page — found from the homepage: https://piwik.pro/privacy-compliance/ (checked 2026-11-03)
- [S4] Code repository (open-source licence) — found from the homepage: https://github.com/PiwikPRO (checked 2026-11-03)
- [S5] Banner & choice architecture — found from sitemap: https://help.piwik.pro/support/privacy/opt-out/ (checked 2026-11-03)
- [S6] Banner & choice architecture — found from sitemap: https://help.piwik.pro/support/privacy/consent-form-languages/ (checked 2026-11-03)
- [S7] Prior blocking & script control — found from sitemap: https://help.piwik.pro/support/questions/how-can-i-block-embedded-videos-maps-and-other-iframes-on-my-site-for-visitors-who-didnt-give-consent/ (checked 2026-11-03)
- [S8] Prior blocking & script control — found from sitemap: https://help.piwik.pro/support/integrations/google-tag-manager-server-side-integration/ (checked 2026-11-03)
- [S9] Scanning & cookie classification — found from sitemap: https://piwik.pro/cookie-scanner/ (checked 2026-11-03)
- [S10] Consent records & proof — found from sitemap: https://developers.piwik.pro/reference/audit_log_entries_v1 (checked 2026-11-03)
- [S11] Consent records & proof — found from sitemap: https://help.piwik.pro/support/account/audit-log/ (checked 2026-11-03)
- [S12] Frameworks, signals & platforms — found from sitemap: https://help.piwik.pro/support/integrations/google-consent-mode-v2-integration/ (checked 2026-11-03)
- [S13] Frameworks, signals & platforms — found from sitemap: https://piwik.pro/integrations/ (checked 2026-11-03)

---

Cite as: whats-best.ai, "Piwik PRO Consent Manager — Consent Management (CMP)", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/consent-management/piwik-pro-consent-manager

Corrections: https://whats-best.ai/correct/1378?target=page