Consent Management (CMP)
Real Cookie Banner
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by devowl.io GmbH · devowl.io
Compare with Borlabs Cookie → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Real Cookie Banner at a glance
- Vendor
- devowl.io GmbH
- Headquarters
- Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 29 Oct 2026
- Panel verdict
- The AI panel rates Real Cookie Banner 3/5, the mean of 6 judges. Real Cookie Banner is a consent-management plugin from devowl.io GmbH (HRB 5100, Amtsgericht Deggendorf), Grafling, Germany, that runs inside the customer's own WordPress: the banner is served from the customer's webspace and every consent record sits in the customer's database. how scores are made
- As of
- Vendor pages captured 29 Oct 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Real Cookie Banner is a consent-management plugin from devowl.io GmbH (HRB 5100, Amtsgericht Deggendorf), Grafling, Germany, that runs inside the customer's own WordPress: the banner is served from the customer's webspace and every consent record sits in the customer's database. Strongest marks: pricing transparency at 7 to 8, sovereignty at 6 to 8. Five public tiers run from 59 € Brutto pro Jahr for 1 website to 299 € Brutto pro Jahr for 25 websites, VAT included, with staging licences of equal count. The sovereignty spread mirrors a trade-off: top scores credit self-hosting and the vendor's stated no-access position, while scores of 6 weigh telemetry to devowl's licence and update servers, no data processing agreement for operation and no published subprocessor list. Its weakest mark is scanning and classification, a flat 4 — the vendor states it offers a service scanner, not a cookie scanner, and recommends manual checks. Banner and choice, prior blocking and consent records sit at 6 to 7; standards and platforms holds at 6, WordPress only. The captured pages give different statements on Google CMP certification.
Speaks for it
- The banner and all consent records run on the customer's own server, with the vendor stating no access to settings or documented consents except on an explicit support request
- Each consent record carries a server-generated pseudonymous UUID and a revision hash tying it to the exact banner settings shown, forcing re-consent when those settings change
- All five price tiers are public with VAT included, from 59 € Brutto pro Jahr for 1 website to AGENCY at 299 € Brutto pro Jahr for 25 websites, plus staging licences of equal count and a free sandbox
- Prior blocking rests on 130-plus content-blocker templates with lazy loading, and documented paths exist for Google Tag Manager and Matomo Tag Manager
- The banner is documented as WCAG 2.2 Level AA with keyboard and screen-reader support, an accessibility score in the customizer and 19 languages
Held against it
- Scanning and classification scores a flat 4, with the vendor stating it offers a service scanner rather than a cookie scanner and recommending manual checks
- We found no public information on scheduled rescans or alerts when trackers change, so coverage depends on manual re-runs
- We found no public statement that reject carries the same weight as accept on the first banner layer, nor on a persistent way for visitors to change their choice later
- The vendor states it offers no data processing agreement for operation, on the position that it is not a processor, and offers one only for support access
- The captured pages give different statements on Google CMP certification — one names certification for AdSense and IAB Europe, others state the product is not part of the Partner Program
Best for
- You run WordPress sites and want the banner and every consent record on your own server, under a German contracting entity (devowl.io GmbH, Amtsgericht Deggendorf, HRB 5100)
- You must be able to reconstruct a consent afterwards for a supervisory authority: each record carries a pseudonymous UUID and a revision hash of the exact banner settings shown
- You want a computable annual cost across up to 25 websites, with public tiers, VAT included, staging licences and cancellation at any time without notice
- You use IAB TCF and Google Consent Mode v2 inside WordPress and can build on the documented JavaScript and REST APIs
Avoid if
- You rely on an automated cookie scanner to keep your banner current: the vendor states it offers a service scanner only and recommends manual checking
- You require a data processing agreement covering operation: the vendor's stated position is that it is not a processor during operation, and an agreement is offered only for support access
- You need consent management for platforms other than WordPress: the product is documented as a native WordPress plugin
- You operate more than 25 websites and need a published price up front: the Enterprise tier and the expert setup service are available on request, and we found no public price for either
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 3.5 of 5 |
| Prior blocking & script control | 3.5 of 5 |
| Scanning & cookie classification | 2 of 5 |
| Consent records & proof | 3.5 of 5 |
| Frameworks, signals & platforms | 3 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 3.5 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Blocking before consent is the product's core: the service and content-blocker templates block data processing until the choice is given, embeds are lazy-loaded only after consent, external fonts can be blocked granularly, and the documentation describes how to test in the browser that cookies really fire only after consent. Tag-manager integration is documented for Google and Matomo, and a developer API covers custom bypass mechanisms. I found no public information on server-side tagging or consent passed specifically to forms and CAPTCHAs. 1 4 6 12 14
The Agency Developer
Scripts, cookies and embeds stay blocked until consent, 130-plus maintained content-blocker templates cover the YouTube and Maps cases without rewriting each theme, and there are dedicated pages for Google Tag Manager and Matomo Tag Manager plus a documented JavaScript and developer API for forms and custom plugins, with guidance to verify nothing loads before consent. I found no public information on server-side tagging, and the captured pages do not describe separate automatic and manual blocking modes. 1 4 6 12 14
The Publisher Marketing Lead
Templates block data processing before consent, 130+ content-blocker templates cover named services with lazy loading for embeds, a Google Tag Manager integration option is documented alongside a JavaScript and developer API, and the knowledge base walks through testing that nothing is set before consent. We found no public information on server-side tagging support or an automated monitor reporting early-loading scripts on the live site. 1 4 6 14
The In-House Lawyer
Service and content-blocker templates (160+ and 130+) are described as preventing personal-data processing before consent, embeds load only after the consent check with lazy loading, external fonts are blocked granularly, and knowledge-base pages for Google Tag Manager and Matomo Tag Manager, a JavaScript API and a developer API are documented, with guidance to test that cookies really are set only after consent. We found no public information on server-side tagging, on consent being passed to forms and CAPTCHAs, or on distinct automatic and manual blocking modes with their limits explained. 1 6 12 14
The WordPress Webmaster
Blocking is template-driven: over 130 content-blocker templates hold back data processing until consent, YouTube and Google Maps embeds can run banner-less as click-to-consent blockers with lazy loading, inline external fonts are blocked granularly, and my page-cache plugin is flushed automatically after banner changes. A dedicated knowledge-base page covers use with Google Tag Manager or Matomo Tag Manager and the help centre explains testing that cookies are really set only after consent; I found no public information on passing consent into contact-form CAPTCHAs such as reCAPTCHA or on server-side tagging. 1 6 12 14
The Skeptic
Blocking before consent rests on 130+ content-blocker templates, granular blocking of inline fonts, lazy-loaded embeds after consent, a documented Google Tag Manager integration that forwards consents and additional consent types, and a JavaScript and REST API for further mechanisms, with a knowledge-base article on testing that cookies are really set only after consent. The vendor itself says the scanner will not find everything and a manual check is always recommended, and we found no public information on server-side tagging support or on an automated monitor of the live site. 1 4 6 13 14
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
The vendor is unusually candid: it offers a service scanner, explicitly not a cookie scanner, does not promise to find everything, states its limitations (unknown plugins, services loaded later via JavaScript), and recommends manual checking of the website in every article. The scanner crawls the sitemap, detects iframes, script and link tags, font embeds and installed plugins, and suggests manually researched templates — but I found no public information on scheduled rescans, cookie-level classification of the live site, or alerts on new trackers. For my clients this means the cookie declaration rests on templates plus manual work rather than continuous verification against the running site. 1 2 13 14
The Agency Developer
It is a service scanner, not a cookie scanner: it crawls the sitemap, matches found services against 160-plus manually researched templates, and the vendor states plainly what it does not find, such as cookies from unknown plugins or AJAX-loaded embeds, while recommending manual checks. For my Friday-tracker problem the captured pages show no scheduled rescans and no alerts when a new tracker appears, so coverage depends on me re-running the scan myself. 1 2 13 14
The Publisher Marketing Lead
This is a service scanner, not a cookie scanner — it crawls the sitemap, detects iframes, script tags, installed plugins and HTTP-header services, and suggests manually researched templates from a library of 160+, with the limits of what it finds stated unusually openly. It explicitly does not scan specific cookies, we found no public information on scheduled rescans or alerts on changed trackers, and the cookie policy document is generated from the banner configuration rather than from scan results. 1 2 13 14
The In-House Lawyer
The vendor describes a sitemap-based service scanner with several detection methods (iframes, script and link tags, inline fonts, installed WordPress plugins, HTTP headers for services such as Cloudflare) backed by manually researched templates, and a cookie declaration that generates itself from the banner. The vendor's own pages state that no cookie scanner is offered, that specific cookies are not scanned, that services embedded after page load are not found, and that manual checking is always recommended; we found no public information on scheduled rescans or alerts on new or changed trackers. 1 2 13 14
The WordPress Webmaster
A service scanner crawls the sitemap and detects iframes, script and link tags, @font-face embeds, installed WordPress plugins and special services via HTTP headers, suggesting matches from over 160 manually researched templates, and a cookie declaration is generated from the banner configuration. But the vendor itself states it offers no cookie scanner and does not promise to find everything, lists what the scanner misses (cookies from unknown plugins, AJAX-loaded embeds) and recommends always checking manually; I found no public information on scheduled rescans or alerts on new or changed trackers. 1 2 13 14
The Skeptic
This is a service scanner, not a cookie scanner, and the vendor says so plainly: it crawls the site's sitemap, inspects iframes, script and link tags, font-face embeds, installed plugins and HTTP headers, then suggests manually researched service templates, while listing what it misses (unknown plugins without templates, services embedded after page load via JavaScript) and advising a manual check every time. The cookie policy is generated from the banner configuration rather than from scan results, and we found no public information on scheduled rescans or alerts when trackers change. 1 2 13 14
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
Each record carries a server-generated pseudonymous UUID and a revision hash that identifies which banner settings — texts, colours, services, service groups, content blockers — were in force when the choice was made, and any change to those settings triggers re-consent; records sit in the customer's own WordPress database, are deleted automatically after the retention period, and can be viewed and exported in the backend. That is close to what an authority asks to see. I found no public information on a consent ID the visitor could look up, withdrawal recorded as its own event, or tamper-proof logging. 1 5 6
The Agency Developer
Each consent lands in the client's own WordPress database with a pseudonymous UUID and a revision hash tying the record to the exact banner texts, colours, services and content blockers shown, re-consent is triggered automatically when that configuration changes, and the list is viewable and exportable from the backend with automatic deletion after the retention period. I found no public information on a visitor-facing consent-ID lookup or on withdrawal being recorded as its own event. 1 5 6
The Publisher Marketing Lead
Each consent is stored in my own WordPress database with a server-generated pseudonymous UUID, the services and groups consented to, and a revision hash tying the record to the exact banner settings shown, with any configuration change forcing re-consent; the list is viewable and exportable in the backend, and consents forwarded from other sites are marked. We found no public information on a consent ID the visitor could look up, withdrawal recorded as its own event, or a stated retention period for the consent log itself. 1 5 6
The In-House Lawyer
Each consent is documented on the customer's own server with a pseudonymous UUID, the services and service groups consented to by ID, and a revision hash identifying the exact banner settings (texts, colours, functions, services, content blockers) used at the moment of consent; changes to those settings trigger renewed consent, retention follows statutory periods with automatic deletion, and settings and consents can be exported at any time. We found no public information on a consent ID the visitor can look up, on withdrawal being recorded as its own event, or on a tamper-evident log. 1 5 6 8
The WordPress Webmaster
Each consent is documented in my own WordPress database with a server-generated pseudonymous UUID, the chosen services and groups by ID, TCF and Consent Mode choices, and a revision hash tying every record to the exact banner settings (texts, colours, services) shown, so the origin can be reconstructed afterwards and a fresh consent is forced when anything changes; the list is viewable and exportable in the backend, forwarded consents are marked, and records are auto-deleted after the statutory retention period with manual deletion on request. I found no public information on a consent ID the visitor can look up, configurable consent expiry, or withdrawal recorded as its own event. 1 5 6
The Skeptic
Each consent lands in the customer's own WordPress database with a server-generated pseudonymous UUID, the consented services and groups by ID, the TC string, and a revision hash that ties the record to the exact banner texts, colours, functions and services shown; re-consent is forced and notified when settings change, records auto-delete after the statutory retention period with manual deletion on request, forwarded consents are marked as such, and everything is exportable. We found no public information on a consent ID the visitor could look up themselves, on withdrawal being recorded as its own event, or on searchability through an API. 1 5 6 8
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
TCF support is deep — automatic weekly Global Vendor List updates, a vendor management tab, non-conforming options hidden when TCF is on — and Google Consent Mode v2 is documented down to additional consent types, ad-data redaction and per-country region signals, alongside JavaScript and REST APIs and multisite or multilingual operation. The captured pages give different figures for Google CMP certification — one page names certification by Google and IAB Europe, others state the product is not part of the Partner Program — and I found no registered CMP ID. The product is WordPress-only; I found no public information on app SDKs, connected TV, GPP or Microsoft signals. 1 3 4 5 18
The Agency Developer
TCF 2.2 with weekly automatic Global Vendor List updates and Google Consent Mode v2, including additional consent types passed to the tag manager and per-country signals, are documented to a depth I can build against, alongside a JavaScript and REST API. But the product is documented for WordPress only, and I found no public information on TYPO3 or Shopify plugins, app SDKs, GPP or Microsoft signals; the captured pages also give different statements on Google CMP certification, the homepage naming it certified and a knowledge base page saying it is not part of the Partner Program. Services must additionally be configured separately on each website, which I would feel across forty client installs. 1 3 4 5 18
The Publisher Marketing Lead
TCF 2.2 is implemented with weekly Global Vendor List updates and vendor management, and Google Consent Mode v2 transmits automatically via the Google Tag including additional consent types to Google Tag Manager — the core of what my Ads conversions need. The captured pages give different statements on Google certification (one calls the product a CMP certified by Google for AdSense, others state it is not part of the Partner Program), and we found no public information on a registered IAB CMP ID, on Consent Mode advanced mode by name, on Microsoft UET, GPP or GPC for US states, or on app SDKs — the product runs on WordPress. 1 3 4 8 18
The In-House Lawyer
TCF 2.2 is documented in depth (weekly Global Vendor List updates, a vendor tab with autofill, service-specific scope, non-conform options hidden when TCF is active) alongside Google Consent Mode v2 with per-country region signals, additional consent types and privacy-friendly defaults; a REST API, WordPress actions and filters, a JavaScript API, multisite operation, consent forwarding and an agency licence for 25 websites are described. The captured pages give different figures on Google's CMP certification (certified for AdSense on the product page; not part of the Partner Program on two help pages), and we found no public information on a registered IAB CMP ID, Microsoft UET consent mode, GPP or GPC, or app SDKs — the product runs on WordPress only. 1 3 4 5 18
The WordPress Webmaster
TCF is supported with a weekly auto-updated Global Vendor List and per-vendor consents, Google Consent Mode v2 transmits choices automatically including additional consent types to Google Tag Manager, and a REST API, a JavaScript API, multisite operation and cross-installation consent forwarding are documented, with agency licences covering up to 25 sites. The captured pages give different statements on Google's CMP partner certification and different figures for the supported TCF version, no registered CMP ID is shown, and I found no public information on Microsoft UET, GPP or Global Privacy Control signals — the product is a native WordPress plugin. 1 3 4 18
The Skeptic
TCF is supported and off by default, with the Global Vendor List auto-downloaded weekly, non-conformant options hidden once TCF is on, and a vendor management tab; Google Consent Mode v2 is documented in depth with its consent types, additional consent types passed to Google Tag Manager and per-country behaviour, and a REST API, multisite operation and consent forwarding cover several sites. The captured pages give different figures for Google CMP certification — the homepage claims certification for AdSense and IAB Europe while the Consent Mode documentation states the product is not part of the Partner Program — and we found no public information on a registered IAB CMP ID, Microsoft UET consent mode, GPP or GPC, or app SDKs; the product runs on WordPress. 1 3 4 8 18
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
The whole product runs on the customer's own server: the banner is served from the customer's webspace with nothing loaded from vendor servers for visitors, consents are processed and stored there, and the vendor states it has no access to settings or documented consents — the strongest posture a consent tool can have for keeping visitor data in the EU. The contracting entity is the devowl.io GmbH in Grafling, Germany, registered at Amtsgericht Deggendorf. The residual chain — license activation on license.devowl.io and assets.devowl.io, Global Vendor List downloads from rcb.devowl.io, and telemetry including the number of documented consents of the last thirty days — comes with no subprocessor list, no certification, and no data processing agreement for operation, which the vendor declines to offer on the stated ground that it is not a processor; an agreement is offered for support access. 1 6 7 8
The Agency Developer
The banner is served from the client's own webspace and every consent log lives in their WordPress database, with the German GmbH, registered at Amtsgericht Deggendorf, stating it has no access to settings or documented consents except on an explicit support request — the strongest model I can offer a client short of building it myself. The remaining chain is disclosed honestly: licence activation, updates and telemetry such as monthly consent counts run through the vendor's own servers with an opt-out, and no processing agreement is offered for operation because the vendor takes the position it is not a processor. I found no public information on security certifications or on where the licence and download servers are hosted. 1 6 7 8
The Publisher Marketing Lead
The whole consent chain sits on my own server — the plugin runs in my WordPress, the banner is served from my webspace with nothing loaded from the vendor's servers for visitors, the vendor states it has no access to settings or documented consents, and the contracting entity is a German GmbH with full register details at the Deggendorf court. Against that, no data processing agreement is offered for operation (the vendor's documented legal position, with one available for support access), subprocessors for the license and update services are not listed, activation telemetry includes consent counts, and we found no public information on security certifications or ownership. 1 6 7 8
The In-House Lawyer
The banner and all consent records run on the customer's own webspace and in the customer's WordPress database, with the vendor stating it has no access to settings or documented consents outside support tickets; the contracting entity is a German GmbH registered at Amtsgericht Deggendorf with a German address and VAT ID, and geolocation uses a locally stored MaxMind database so the IP address is not sent to a third party. The vendor's stated position is that it is not a processor within Art. 28 GDPR during operation and therefore offers no data processing agreement for it — one is requested only for support access — while licence activation and updates run through the vendor's own servers with telemetry that can be deactivated, and we found no public information on ISO 27001 or SOC 2 certifications or on the infrastructure behind those servers. 1 6 7 8
The WordPress Webmaster
The contracting entity is devowl.io GmbH in Grafling, registered at Amtsgericht Deggendorf, and the whole product runs on my server: the banner is served from my webspace, consent logs sit in my WordPress database with no vendor access during operation, and geolocation uses a locally stored MaxMind database. The licence, update and Global Vendor List chain reaches devowl's own servers (license.devowl.io, assets.devowl.io) with telemetry I can stop by deactivating the licence, and export and deletion are documented — but I found no public information on where those servers are hosted, on subprocessors there, on the owner or parent, or on security certifications, and the vendor states it offers no data processing agreement for operation because it processes nothing while the plugin runs. 6 7 8
The Skeptic
The contracting entity is proven German — devowl.io GmbH, registered at Amtsgericht Deggendorf under HRB 5100, in Grafling — and the self-hosted model keeps the banner script and every consent log on the customer's own server, with the vendor stating no data is loaded from its servers for visitors, geolocation resolved locally so the IP never leaves the server, and the scanner working through a browser job queue. The residual chain — a licence server and download server that receive system data on activation, an endpoint serving the Global Vendor List, and telemetry that includes the number of documented consents with opt-out only by deactivating the licence — is disclosed but its hosting is not stated; the vendor takes the position that no data processing agreement is needed for operation and offers one only for support access, and we found no public information on subprocessors or security certifications. 1 6 7 8
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
All five tiers are public with their price and website count — from 59 € Brutto pro Jahr for one website to 299 € Brutto pro Jahr for twenty-five — each including all features, updates and premium support, with VAT treatment stated, cancellation at any time without notice, and staging licences matching the site count; no traffic or consent limits are documented, so there is no overage to price. Above twenty-five websites the Enterprise offer is unpriced, and the expert setup service carries no stated fee. 1 13 14
The Agency Developer
Five public tiers scale cleanly by website count — 59 €, 89 €, 129 €, 229 € and 299 € gross per year for 1, 3, 5, 10 and 25 websites — each including all features, updates and premium support, with staging environments matching the site count, VAT included, and cancellation at any time without notice. For a 40-site shop like mine the Enterprise tier above 25 websites and the expert setup service are the unpriced pieces I would have to ask about. 1 14
The Publisher Marketing Lead
All five tiers are published with gross annual prices scaling by number of websites (59 € to 299 €), every tier includes all features, updates and premium support, staging environments are included in equal number, VAT treatment and cancellation terms are stated, and a free sandbox and a free version exist. Expert setup by the vendor's cookie experts and the enterprise tier above 25 websites are the pieces we found no public prices for, and a single extra domain beyond a tier is not priced individually. 1 14
The In-House Lawyer
Five tiers are public with a clear per-website scaling rule — 59 € (1 website), 89 € (3), 129 € (5), 229 € (10) and 299 € (25) gross per year, each with all features, updates and premium support, staging environments included at the same count, VAT included, cancellation at any time without notice period, plus a free version and a free sandbox. Enterprise above 25 websites and the expert setup service are available on request, so the setup cost cannot be computed from the public pages. 1 14
The WordPress Webmaster
Five tiers are public with every feature included — from 59 € Brutto pro Jahr for 1 Website up to the AGENCY tier at 299 € Brutto pro Jahr for 25 Websites — with VAT included, cancellation any time without notice, staging environments included at the same count, and a free version plus sandbox trial described, so the annual cost per site is exactly what I can compute myself. Only the optional expert setup service and the Enterprise terms above 25 websites are not priced publicly. 1 14
The Skeptic
Five tiers are published with gross annual prices scaling cleanly per website — 59 € Brutto for one site up to 299 € Brutto for 25 — all including every feature, updates and premium support, with VAT included, cancellation at any time without notice, free staging licences equal to the site count, a free version and a free sandbox, so the annual cost is computable for anyone running 25 sites or fewer. Above 25 websites the Enterprise tier is unpriced and the expert setup service carries no published price; we found no public information on traffic or consent limits, consistent with a plugin licensed per site. 1 14
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Real Cookie Banner
Is Real Cookie Banner European?
Yes. whats-best.ai classifies Real Cookie Banner as EU-Made.
Where does Real Cookie Banner store data?
Not stated on the vendor’s pages as of 29 Oct 2026.
Does Real Cookie Banner have a free plan?
Yes. Real Cookie Banner has a free plan, per the vendor’s page captured 29 Oct 2026.
What are the best alternatives to Real Cookie Banner?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Real Cookie Banner alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Legal entity, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 11 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (18)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (product page with prices) devowl.io Checked 29 Oct 2026 Details →
- 2 Documentation (service scanner) devowl.io Checked 29 Oct 2026 Details →
- 3 Documentation (IAB TCF) devowl.io Checked 29 Oct 2026 Details →
- 4 Documentation (Google Consent Mode) devowl.io Checked 29 Oct 2026 Details →
- 5 Documentation (consent forwarding across sites) devowl.io Checked 29 Oct 2026 Details →
- 6 Documentation (data processing) devowl.io Checked 29 Oct 2026 Details →
- 7 Legal notice devowl.io Checked 29 Oct 2026 Details →
- 8 Privacy policy devowl.io Checked 29 Oct 2026 Details →
- 9 Banner & choice architecture — found from sitemap devowl.io Checked 29 Oct 2026 Details →
- 10 Banner & choice architecture — found from sitemap devowl.io Checked 29 Oct 2026 Details →
- 11 Prior blocking & script control — found from sitemap devowl.io Checked 29 Oct 2026 Details →
- 12 Prior blocking & script control — found from sitemap devowl.io Checked 29 Oct 2026 Details →
- 13 Scanning & cookie classification — found from sitemap devowl.io Checked 29 Oct 2026 Details →
- 14 Scanning & cookie classification — found from sitemap devowl.io Checked 29 Oct 2026 Details →
- 15 Consent records & proof — found from sitemap devowl.io Checked 29 Oct 2026 Details →
- 16 Consent records & proof — found from sitemap devowl.io Checked 29 Oct 2026 Details →
- 17 Frameworks, signals & platforms — found from sitemap devowl.io Checked 29 Oct 2026 Details →
- 18 Frameworks, signals & platforms — found from sitemap devowl.io Checked 29 Oct 2026 Details →