Consent Management (CMP)
Sourcepoint
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Sourcepoint USA Inc. · sourcepoint.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Sourcepoint at a glance
- Vendor
- Sourcepoint USA Inc.
- Headquarters
- Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 29 Oct 2026
- Panel verdict
- The AI panel rates Sourcepoint 1.5/5, the mean of 6 judges. Sourcepoint's captured pages present a Google-certified consent management platform with fully customizable messages for GDPR and US state laws, a dedicated guide to IAB TCF v2.2, and consent products for mobile apps and OTT/CTV with choices persisting across environments. how scores are made
- As of
- Vendor pages captured 29 Oct 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Sourcepoint's captured pages present a Google-certified consent management platform with fully customizable messages for GDPR and US state laws, a dedicated guide to IAB TCF v2.2, and consent products for mobile apps and OTT/CTV with choices persisting across environments. Standards and platforms draws the highest scores, clustering at 4-5. The low marks fall on prior blocking, which spans 0 to 2 — the widest spread here, reflecting how judges weigh the absence of any documented blocking against Diagnose, the compliance-monitoring product for vendor vulnerabilities — and on sovereignty at 2-3, where the contract picture is a Delaware company under New York law with binding arbitration, softened by a Berlin subsidiary for EU data subjects, standard contractual clauses or binding corporate rules for transfers, and ISO 27001 and 27701 certification. Where the banner script and consent records are hosted, and which subprocessors run in the chain, is unknown on these pages. Banner and choice, scanning and consent records cluster at 3-4. No prices are published; persona-weighted totals run 3.1 to 3.6.
Speaks for it
- Presented on the vendor's own pages as a Google-certified CMP meeting Google's requirements for serving ads in the UK and EEA, with standards and platforms scoring 4-5.
- TCF coverage includes a dedicated guide to IAB TCF v2.2, with dedicated consent products for mobile apps and OTT/CTV.
- Consent decisions are mapped to a randomly generated UUID in the vendor's processor role, with choices persisting across environments.
- Diagnose is documented as a compliance-monitoring product uncovering vendor privacy vulnerabilities on owned-and-operated properties, alongside automated vendor risk assessment.
- ISO 27001 and 27701 certification audited annually, standard contractual clauses or binding corporate rules for transfers, and a Berlin subsidiary as contact for EU data subjects.
Held against it
- We found no public information on automatic or manual blocking of scripts, pixels and embedded content before consent, or on tag-manager integration and placeholders.
- The operator named in the terms is a Delaware company governed by New York law with binding arbitration and a class-action waiver, and hosting locations and subprocessors are unknown on the captured pages.
- We found no public information on where reject sits on the first layer, consent by category or vendor, or how a visitor withdraws.
- We found no public information on consent-record retention, export of the consent log, or records tied to the banner version shown.
Best for
- You run advertising in the UK and EEA and want a CMP the vendor presents as Google-certified for Google's serving requirements there.
- You collect and syndicate consent across web, mobile apps and connected TV and want choices to persist across environments.
- You work under TCF and value a vendor publishing a dedicated guide to IAB TCF v2.2.
- You want vendor monitoring alongside consent, via the documented Diagnose product and the platform's automated vendor risk assessment.
Avoid if
- Your procurement requires an EU-governed contract — the terms name a Delaware company under New York law, with binding arbitration and a class-action waiver.
- You expect the CMP itself to keep scripts and pixels dark until consent — the documented vendor-side product is Diagnose, a monitoring tool, and we found no public information on blocking modes or tag-manager integration.
- You need broad contractual recourse — the terms disclaim warranties and cap aggregate liability at any compensation you pay.
- You must price an annual cost before talking to sales — the only commercial step documented on these pages is a product demo.
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 1.5 of 5 |
| Prior blocking & script control | 1 of 5 |
| Scanning & cookie classification | 2 of 5 |
| Consent records & proof | 2 of 5 |
| Frameworks, signals & platforms | 2.5 of 5 |
| European sovereignty | 1 of 5 |
Prior blocking & script control
n/r
n/r
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer not rated — no public information
We found no public information on blocking of scripts, pixels or embedded content before consent, on tag-manager or server-side tagging integration, or on any way for the site owner to verify nothing loads early. The consent platform and vendor diagnostics pages I read describe consent collection and vendor monitoring only. 2 5
The Agency Developer
I found no public information on automatic blocking of scripts before consent, content blockers for YouTube or Maps embeds, or a tag-manager template — the things I need so I don't rewrite forty themes by hand. What the captures do show is Diagnose, a compliance-monitoring product that "uncovers the privacy vulnerabilities of vendors" on owned properties, which speaks to checking what fires but not to keeping it dark until the visitor decides. 5 1
The Publisher Marketing Lead
The captured pages describe a companion monitoring product, Diagnose, that "uncovers the privacy vulnerabilities of vendors" on owned properties, which bears on finding misbehaving trackers. We found no public information on automatic blocking of scripts, pixels and cookies before consent, on placeholders for embedded videos or maps, or on tag-manager and server-side tagging integration. 2 5
The In-House Lawyer
We found no public information on how scripts, pixels or embedded content are held back before consent, on tag-manager integration, or on a way for the site owner to verify nothing fires early. The closest fact is the Diagnose product, which "uncovers the privacy vulnerabilities of vendors" on owned properties — that speaks to monitoring vendors, not to documented prior blocking. 5
The WordPress Webmaster
The only capability near this in the captures is Diagnose, a separate monitoring product that "uncovers the privacy vulnerabilities of vendors" on owned properties — a check after the fact, not blocking before consent. We found no public information on automatic blocking of scripts, pixels or cookies, placeholders for videos and maps, tag-manager integration, or consent passed to plugins, which is exactly what I need around my Analytics, YouTube and Maps embeds. 5
The Skeptic not rated — no public information
We found no public information on what happens to scripts, pixels and embedded content before a visitor consents — no automatic or manual blocking mode, no tag-manager integration, no placeholders and no test procedure is described on the captured homepage, consent features page or mobile pages. I treat blocking as a claim until the test steps are published, and here even the claim is absent from the captured pages. 1 2 3
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
A compliance monitoring product called Diagnose is described as one that “uncovers the privacy vulnerabilities of vendors” on owned properties, which evidences some scanning of what vendors do on a site. We found no public information on a maintained cookie database, classification by purpose or lifetime, scan schedules, or a cookie declaration generated from a scan. 5 6
The Agency Developer
Diagnose is documented as a compliance-monitoring product that uncovers vendor privacy vulnerabilities on owned-and-operated properties, and the platform summary promises automated vendor risk assessment — that is the ongoing discovery that catches the tracker a client added on Friday. I found no public information on a maintained cookie classification database with purposes, providers and lifetimes, or a cookie declaration generated from the scans. 5 1
The Publisher Marketing Lead
Diagnose is presented as a compliance monitoring product for vendor privacy vulnerabilities on owned-and-operated properties, and the homepage mentions automated vendor risk assessment. We found no public information on scheduled scans with a stated depth or page count, classification of cookies and services from a maintained database, alerts on new trackers, or a cookie declaration generated from the scan. 1 5
The In-House Lawyer
Diagnose is documented as a compliance-monitoring product that uncovers vendor privacy vulnerabilities on owned properties, and the platform summary promises "automated vendor risk assessment" — ongoing discovery of what runs on the site, a step beyond a one-off scan. We found no public information on cookie-level scanning, a maintained classification database with purposes and lifetimes, alerts on new trackers, or a cookie declaration generated from the scan. 1 5
The WordPress Webmaster
Diagnose is described as a monitoring product that finds vendor vulnerabilities on the site's own properties, so detection of third parties on a live site exists in the portfolio. We found no public information on scheduled rescans, a maintained database classifying cookies by purpose and lifetime, alerts on new trackers, or a generated cookie declaration. 5
The Skeptic
A separate compliance monitoring product is confirmed, described in one marketing sentence as uncovering "the privacy vulnerabilities of vendors lurking on your O&O properties", alongside automated vendor risk assessment on the homepage. What a buyer needs to judge it — what is scanned, how cookies and services are classified, rescans, alerts on new trackers, a self-updating cookie declaration — is not described on any captured page. 5 1
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
The security page describes a “randomly generated UUID for mapping consent decisions only”, which points to per-visitor consent records, and choices are said to persist across environments. We found no public information on retention of the consent log, export, re-consent on configuration change, or any record of which banner version a visitor saw. 8 9
The Agency Developer
The trust page describes "a randomly generated UUID for mapping consent decisions only" and the OTT/CTV page says user consent choices "persist across environments", which points to pseudonymous per-visitor consent records rather than a browser cookie alone. I found no public information on consent-log retention, export of the log, a visitor-facing consent ID, or records tied to the banner version that was shown. 8 9
The Publisher Marketing Lead
Consent decisions are mapped to a "randomly generated UUID" in Sourcepoint's role as processor, choices are stated to persist across environments, and production logs are kept a minimum of 90 days with encrypted daily backups retained no more than thirteen months. We found no public information on export of the consent log, records tied to the banner version shown, a consent ID the visitor can look up, or withdrawal recorded as its own event. 8 9
The In-House Lawyer
The trust page states a randomly generated UUID is used "for mapping consent decisions only", which indicates server-side consent records tied to a pseudonymous identifier, and choices are said to persist across environments. But we found no public information on retention for consent records, the banner version shown, export of the log, a consent ID for the visitor, or proof that withdrawal took effect — the pieces I would need in a dispute with a consumer group. 8 9
The WordPress Webmaster
The trust documentation says a randomly generated UUID is used for mapping consent decisions only, and the OTT/CTV page says choices persist across environments, so decisions are recorded per visitor at some level. Retention for consent logs, export of the log, the banner version shown, and proof that withdrawal took effect are not described in the captured pages. 8 9
The Skeptic
The security pages confirm a processor role with a "randomly generated UUID for mapping consent decisions only", and choices are said to persist across environments, so more than a browser cookie is involved. But nothing states how long consent records are kept, whether the log can be exported, which banner version was shown, or how withdrawal is proven; the ninety-day minimum retention I did find covers production system logs, not consent proof — and on the way out the door, that is exactly what a departing customer cannot price. 8 9
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
The vendor is named as a Google-certified CMP for ads in the UK and EEA, TCF is supported with preferences syndicated on mobile, and separate consent products exist for mobile apps and OTT/CTV. We found no public information on a registered CMP ID, Google Consent Mode v2, Microsoft or US-state signals, CMS plugins, or an API. 3 6 9
The Agency Developer
The pages document a Google-certified CMP, TCF coverage including a dedicated TCF v2.2 guide, a mobile app CMP syndicating consent for GDPR, US state laws and TCF, and consent across OTT/CTV environments. For an agency like mine the gaps matter: I found no public information on WordPress, TYPO3 or Shopify plugins, a JavaScript API, or multi-client agency accounts in the captured pages. 3 4 9 6
The Publisher Marketing Lead
The vendor presents its CMP as Google-certified for serving ads in the UK and EEA, names TCF for syndicating preferences on mobile apps with a dedicated guide to IAB TCF v2.2, and offers the CMP across web, mobile apps and OTT/CTV with choices persisting across environments — the consent-sharing between site and app I need. We found no public information on a registered IAB CMP ID, Consent Mode basic versus advanced mode, Microsoft UET or other ad-platform signals, GPP or GPC, CMS plugins, or a REST API. 3 4 9
The In-House Lawyer
The vendor names a "Google-certified CMP" meeting Google's requirements for serving ads in the UK and EEA, TCF is named alongside GDPR and US state laws on the mobile page, and dedicated consent products exist for mobile apps and OTT/CTV with choices persisting across environments. We found no public information on a registered IAB Europe CMP ID, the TCF version, Google Consent Mode v2 in its modes, GPP or GPC, CMS plugins or an API. 3 9
The WordPress Webmaster
The vendor is named a Google-certified CMP for serving ads in the UK and EEA, TCF is covered with a guide to version 2.2, and the platform is documented for mobile apps and OTT/CTV. We found no public information on a registered IAB Europe CMP ID, Google Consent Mode v2 specifics, Microsoft or GPP/GPC signals, an API, or a WordPress plugin — the last being what I would install first. 3 4 6 9
The Skeptic
Google's CMP certification and TCF syndication on mobile are claimed on the vendor's own pages, with a consent product for connected TV and persistence of choices across environments. But no registered CMP identifier, no Consent Mode detail, no CMS or shop plugins, no API and no multi-domain account model appears in the captured pages — certification is a floor, not evidence the signals are wired to the banner choices. 3 9 6
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
The contracting entity is Sourcepoint Technologies, Inc., a Delaware company, with terms governed by New York law and binding arbitration, and a Berlin subsidiary named as the contact for EU data subjects; transfers rely on standard contractual clauses or binding corporate rules. We found no public information on where the banner script or consent logs are hosted, or on any subprocessor list. 6 7 8
The Agency Developer
The contracting picture is American — a Delaware company under New York law — though a Berlin office, Sourcepoint GmbH, is named for EU data subjects, transfers use standard contractual clauses or binding corporate rules, and ISO 27001/27701 certification is stated. I found no public information on where the banner script is served from, where consent logs and scan results are stored, or which subprocessors are involved, so the chain a European client would ask about stays in the dark. 7 6 8
The Publisher Marketing Lead
The terms name a Delaware company governed by New York law as the operator, while a Berlin Sourcepoint office serves as EU contact, and the privacy policy names standard contractual clauses and binding corporate rules as transfer safeguards alongside ISO 27001 and 27701 certification. We found no public information on where the banner script, consent logs and scan results are hosted, on the parent company, or on named subprocessors and their locations. 6 7 8
The In-House Lawyer
The contracting picture is American: terms governed by New York law with binding arbitration and a class-action waiver, a Delaware company as operator — softened only by a German subsidiary in Berlin that data subjects may contact, standard contractual clauses or binding corporate rules for transfers, and ISO 27001/27701 certification. Hosting location, the banner script's origin and the subprocessor list are unknown in the captured pages, so the European chain I would need for our shops is not evidenced. 6 7 8
The WordPress Webmaster
The operator is Sourcepoint USA Inc. under New York law, with a Delaware company named and an office in Berlin for EU data subjects, transfers covered by standard contractual clauses or binding corporate rules, and ISO 27001/27701 certification stated. We found no public information on where the banner script or consent logs are hosted, on the subprocessors in the chain, or on a data processing agreement offered to customers. 6 7 8
The Skeptic
The contracting picture is American — a Delaware company at a New York address, terms under New York law, binding arbitration and a class-action waiver — softened only by a Berlin subsidiary acting as EU representative, standard contractual clauses or binding corporate rules for transfers, data processing agreements with its own service providers, and ISO 27001/27701 certification. No captured page states where the banner script is served from, where the consent UUIDs and records are stored, or names a single subprocessor, and for a product that sits on every page of the customer's site and sees every visitor, that silence is the whole chain unaccounted for. 7 6 8
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer not rated — no public information
We found no public information on pricing: no tiers, per-domain prices, page-view limits, add-on fees or terms appear on the homepage, features or terms pages I read. A demo is offered, but nothing that would let a buyer compute an annual cost. 1 2 6
The Agency Developer not rated — no public information
I found no public information on pricing on the homepage, features and product pages I read — no tiers, per-domain or traffic limits, free tier, or agency terms; only an offer to provide a demo. Computing an annual cost for a client site from these pages is impossible, so every quote starts with a sales conversation. 1 2 3 5 9
The Publisher Marketing Lead not rated — no public information
We found no public information on pricing: the captured homepage, CMP features pages and legal pages show no tiers, per-domain or traffic limits, free tier limits, add-on prices, agency terms, minimum term or setup fees, and instead offer a product demo. A buyer cannot compute an annual cost from these pages. 1 2 7
The In-House Lawyer not rated — no public information
We found no public information on pricing in the captured pages — no tiers, per-domain prices, traffic limits or add-on costs appear on the homepage, the features pages or the terms; the privacy policy mentions only that a demo may be offered. A buyer cannot compute an annual cost from what was captured. 1 2 3 6
The WordPress Webmaster not rated — no public information
We found no public information on pricing in any of the captured pages — no tiers, no per-site or per-domain price, no traffic limits, no free tier — only an offer to "provide a demo of our products and services", while the terms cap liability at whatever compensation you pay without stating a figure. For me that means the annual cost per site cannot be computed without talking to sales. 1 2 3 6 7
The Skeptic not rated — no public information
We found no public information on pricing — no tier, licence price, page-view or consent limit, free tier or minimum term appears on any captured page, from the homepage through the features pages to the terms. The only commercial gesture documented is that the vendor may "provide a demo of our products and services to you", which points to a sales conversation rather than a computable annual cost. 1 2 7
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Sourcepoint
Is Sourcepoint European?
No. whats-best.ai classifies Sourcepoint as Rest of world.
Where does Sourcepoint store data?
Not stated on the vendor’s pages as of 29 Oct 2026.
Does Sourcepoint have a free plan?
Not stated on the vendor’s pages as of 29 Oct 2026.
What are the best alternatives to Sourcepoint?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Sourcepoint alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We could not confirm any pricing information on the vendor’s own pages as captured, so this page shows none rather than a statement we cannot stand behind. Know more? Tell us
- 75 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (9)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage sourcepoint.com Checked 29 Oct 2026 Details →
- 2 Features page (consent management platform) sourcepoint.com Checked 29 Oct 2026 Details →
- 3 Features page (mobile apps) sourcepoint.com Checked 29 Oct 2026 Details →
- 4 Features page (IAB TCF) sourcepoint.com Checked 29 Oct 2026 Details →
- 5 Features page (tracker diagnostics) sourcepoint.com Checked 29 Oct 2026 Details →
- 6 Terms of service sourcepoint.com Checked 29 Oct 2026 Details →
- 7 Privacy policy sourcepoint.com Checked 29 Oct 2026 Details →
- 8 Security / trust page sourcepoint.com Checked 29 Oct 2026 Details →
- 9 Frameworks, signals & platforms — found from sitemap sourcepoint.com Checked 29 Oct 2026 Details →