# Sourcepoint — Consent Management (CMP)

Sourcepoint by Sourcepoint USA Inc. holds a panel rating of 1.5/5 from 6 AI judges (category median 3/5), as of 2026-10-30. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Sourcepoint USA Inc. (https://sourcepoint.com/)
- Category: [Consent Management (CMP)](https://whats-best.ai/software/consent-management.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/consent-management/sourcepoint
- Alternatives: https://whats-best.ai/software/consent-management/sourcepoint/alternatives ([markdown](https://whats-best.ai/software/consent-management/sourcepoint/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-10-30 · oldest source captured 2026-10-29

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Sourcepoint USA Inc.
- Headquarters: Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 29 Oct 2026

## The panel's verdict

Sourcepoint's captured pages present a Google-certified consent management platform with fully customizable messages for GDPR and US state laws, a dedicated guide to IAB TCF v2.2, and consent products for mobile apps and OTT/CTV with choices persisting across environments. Standards and platforms draws the highest scores, clustering at 4-5. The low marks fall on prior blocking, which spans 0 to 2 — the widest spread here, reflecting how judges weigh the absence of any documented blocking against Diagnose, the compliance-monitoring product for vendor vulnerabilities — and on sovereignty at 2-3, where the contract picture is a Delaware company under New York law with binding arbitration, softened by a Berlin subsidiary for EU data subjects, standard contractual clauses or binding corporate rules for transfers, and ISO 27001 and 27701 certification. Where the banner script and consent records are hosted, and which subprocessors run in the chain, is unknown on these pages. Banner and choice, scanning and consent records cluster at 3-4. No prices are published; persona-weighted totals run 3.1 to 3.6.

**Speaks for it:**
- Presented on the vendor's own pages as a Google-certified CMP meeting Google's requirements for serving ads in the UK and EEA, with standards and platforms scoring 4-5.
- TCF coverage includes a dedicated guide to IAB TCF v2.2, with dedicated consent products for mobile apps and OTT/CTV.
- Consent decisions are mapped to a randomly generated UUID in the vendor's processor role, with choices persisting across environments.
- Diagnose is documented as a compliance-monitoring product uncovering vendor privacy vulnerabilities on owned-and-operated properties, alongside automated vendor risk assessment.
- ISO 27001 and 27701 certification audited annually, standard contractual clauses or binding corporate rules for transfers, and a Berlin subsidiary as contact for EU data subjects.

**Held against it:**
- We found no public information on automatic or manual blocking of scripts, pixels and embedded content before consent, or on tag-manager integration and placeholders.
- The operator named in the terms is a Delaware company governed by New York law with binding arbitration and a class-action waiver, and hosting locations and subprocessors are unknown on the captured pages.
- We found no public information on where reject sits on the first layer, consent by category or vendor, or how a visitor withdraws.
- We found no public information on consent-record retention, export of the consent log, or records tied to the banner version shown.

**Best for:**
- You run advertising in the UK and EEA and want a CMP the vendor presents as Google-certified for Google's serving requirements there.
- You collect and syndicate consent across web, mobile apps and connected TV and want choices to persist across environments.
- You work under TCF and value a vendor publishing a dedicated guide to IAB TCF v2.2.
- You want vendor monitoring alongside consent, via the documented Diagnose product and the platform's automated vendor risk assessment.

**Avoid if:**
- Your procurement requires an EU-governed contract — the terms name a Delaware company under New York law, with binding arbitration and a class-action waiver.
- You expect the CMP itself to keep scripts and pixels dark until consent — the documented vendor-side product is Diagnose, a monitoring tool, and we found no public information on blocking modes or tag-manager integration.
- You need broad contractual recourse — the terms disclaim warranties and cap aggregate liability at any compensation you pay.
- You must price an annual cost before talking to sales — the only commercial step documented on these pages is a product demo.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Data Protection Officer | The Agency Developer | The Publisher Marketing Lead | The In-House Lawyer | The WordPress Webmaster | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Banner & choice architecture | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 2/5 | 1.5/5 |
| Prior blocking & script control | n/r | 1/5 | 1/5 | 1/5 | 1/5 | n/r |
| Scanning & cookie classification | 1.5/5 | 2/5 | 2/5 | 2/5 | 1.5/5 | 1.5/5 |
| Consent records & proof | 2/5 | 2/5 | 2/5 | 2/5 | 1.5/5 | 2/5 |
| Frameworks, signals & platforms | 2/5 | 2/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2/5 |
| European sovereignty | 1/5 | 1/5 | 1/5 | 1.5/5 | 1/5 | 1.5/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **1.5/5** | **1.5/5** | **2/5** | **1.5/5** | **1.5/5** | **1.5/5** |

### The judges

- **The Data Protection Officer** (v1.0): External DPO for a dozen mid-sized companies, two of which received a letter from a state supervisory authority about their cookie banner last year. Wants reject on the first layer, nothing loaded before the click, a consent log that shows which banner version each visitor saw, a cookie list that matches the site, and a DPA and subprocessor list that keep visitor data in the EU.
- **The Agency Developer** (v1.0): Lead developer at a web agency that maintains forty client sites on WordPress, TYPO3 and Shopify. Wants one account for every client, blocking that works without rewriting each theme, content blockers for YouTube and Maps, a Tag Manager template, a scanner that flags the tracker a client added on Friday, and a JavaScript API documented well enough that forms and plugins can ask for consent.
- **The Publisher Marketing Lead** (v1.0): Runs marketing for an ad-funded news site and an online shop in the same group, where every point of consent rate shows up in ad revenue and in Google Ads conversions. Wants a registered IAB TCF CMP, Google Consent Mode v2 in advanced mode, banner tests within what the law allows, consent shared between the site and the app, and a dashboard that shows where visitors drop off.
- **The In-House Lawyer** (v1.0): In-house counsel at a retailer with shops in Germany, France and Austria, who has read the court decisions on missing reject buttons and the regulators' banner guidance. Wants § 25 TDDDG and the GDPR mapped to concrete settings, equal-weight choices as the default, consent that can be withdrawn as easily as it was given, and records that would hold up if a competitor or a consumer group sued.
- **The WordPress Webmaster** (v1.0): Looks after the WordPress site of a mid-sized engineering company on top of the actual job, with Google Analytics, a YouTube channel, a Maps embed and a contact form with reCAPTCHA. Wants a plugin that finds these by itself, blocks them until the visitor agrees, survives the next plugin update and caching, and costs a known amount per site per year without a call to sales.
- **The Skeptic** (v1.0): Has opened the browser's network tab on sites with a "certified" banner and watched the ad pixels fire before anything was clicked. Reads "consent rate optimisation" as a hint that reject will be grey and small, "auto-blocking" as a claim until the test steps are published, and "EU hosting" next to a US script CDN — and asks what leaving would cost: the consent logs, and every visitor asked again.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Access control: yes · yes · yes [S8]
- Backups: yes · at least daily full database backups · 13 [S8]
- Business continuity: yes · yes [S8]
- Certifications: yes · yes · annual [S8]
- Change management: yes [S8]
- Data minimization: yes [S8]
- Dedicated team: Chief Privacy Counsel and Information Security Director with over thirty five years of combined experience [S8]
- Dpas with vendors: yes [S7]
- Incident management: yes · meets or exceeds all regulatory requirements [S8]
- International transfer safeguards: standard contractual clauses · binding corporate rules [S7]
- Log retention: 90 [S8]
- Malware prevention: yes [S8]
- Penetration testing: monthly for high and critical severity · independent third party · annual [S8]
- Processor role: Data Importer and Processor · randomly generated UUID for mapping consent decisions only · location determination for geographic messaging [S8]
- Sale of data position: no [S7]
- Secure development: yes · yes · yes [S8]
- Security measures: Security measures employed against unauthorized access, unlawful processing, accidental loss, destruction and damage [S7]
- Talent pool retention: 3 [S7]
- Third party risk: yes [S8]
- Training: at least annually, onboarding plus up to quarterly; role-based training for key stakeholders [S8]
- US state rights: California · Virginia · Colorado · Connecticut [S7]

**Data**
- Newsletter opt out: yes [S7]

**Legal**
- Address: 228 Park Avenue South, #87903, New York, NY 10003-1502, United States [S7]
- Arbitration required: yes [S6]
- Arbitration rules: AAA [S6]
- California consumer notice: 1789.3 [S6]
- Class action waiver: yes · yes [S6]
- Dispute contact email: help@sourcepoint.com [S6]
- Dispute resolution notice period: 60 [S6]
- Entity name: Sourcepoint Technologies, Inc. [S7]
- Entity name: Sourcepoint USA Inc. [S6]
- EU odr: http://ec.europa.eu/odr · no [S6]
- EU representative: Sourcepoint GmbH · Friedrichstrasse. 68, 10117, Berlin, Germany [S7]
- Governing law: State of New York, USA [S6]
- Indemnification: yes [S6]
- Liability cap: amount of compensation paid for access to or use of the Site [S6]
- Notice entity address: Sourcepoint Technologies, Inc. · 228 Park Avenue South, #87903, New York, NY 10003-1502 [S6]
- Policy last updated: January 2023 [S7]
- Privacy contact email: privacy@sourcepoint.com [S7]
- Site discontinuation right: yes [S6]
- Termination right: yes [S6]
- Terms last updated: 2018-08-15 [S6]
- Terms modification right: yes [S6]
- Warranty disclaimer: yes [S6]

**Product**
- Arbitration fee payment low claims: 75000 · yes [S6]
- Cross environment persistence: User consent choices persist across environments [S9]
- Demo offer: yes [S7]
- Diagnose purpose: Diagnose is a compliance monitoring product that uncovers privacy vulnerabilities of vendors on owned-and-operated properties [S5]
- Google certified cmp: meet Google requirements for serving ads in UK and EEA · yes [S3]
- Industries: Publishers · Brands · Gaming [S7]
- Industries served: Publishers · Brands · Gaming [S6]
- Mobile consent: Mobile CMP collects and syndicates user consent/preferences for GDPR, US state laws, TCF [S3]
- Ott ctv cmp: Dialogue CMP offered for OTT/CTV consent management [S9]
- Platform summary: single platform for consumer privacy rights, cross-functional team alignment, and automated vendor risk assessment [S1]
- Platforms: CTV · Mobile Apps [S6]
- Product modules: Consent Management · Compliance Monitoring · Marketing Preferences · DSAR Handling · Privacy Measurement [S7]
- Product solutions: CTV · CMP for mobile apps [S7]
- Products listed: Consent Management · Compliance Monitoring · Marketing Preferences · DSAR Handling · Privacy Measurement [S6]
- Regulations covered: CCPA · GDPR [S7]
- Regulations covered: CCPA · GDPR [S6]
- Small claim doc hearing threshold: 10000 · yes [S6]
- Website cookie controls: yes [S7]

**Support**
- Help center: yes [S7]
- Help center: yes [S6]
- Security contact: privacy@sourcepoint.com · [email] [S8]

## Questions

### Is Sourcepoint European?

No. whats-best.ai classifies Sourcepoint as Rest of world.

### Where does Sourcepoint store data?

Not stated on the vendor’s pages as of 29 Oct 2026.

### Does Sourcepoint have a free plan?

Not stated on the vendor’s pages as of 29 Oct 2026.

### What are the best alternatives to Sourcepoint?

As of 3 Nov 2026, the panel rates [Usercentrics CMP (3.5/5)](https://whats-best.ai/software/consent-management/usercentrics), [Didomi (3.5/5)](https://whats-best.ai/software/consent-management/didomi) and [CCM19 (3.5/5)](https://whats-best.ai/software/consent-management/ccm19) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Usercentrics CMP](https://whats-best.ai/software/consent-management/usercentrics) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Sourcepoint alternatives](https://whats-best.ai/software/consent-management/sourcepoint/alternatives).

## What this page leaves out

- We could not confirm any pricing information on the vendor’s own pages as captured, so this page shows none rather than a statement we cannot stand behind.
- 75 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://sourcepoint.com/ (checked 2026-10-29)
- [S2] Features page (consent management platform): https://sourcepoint.com/cmp-2/ (checked 2026-10-29)
- [S3] Features page (mobile apps): https://sourcepoint.com/cmp-for-mobile-apps/ (checked 2026-10-29)
- [S4] Features page (IAB TCF): https://sourcepoint.com/guide-to-iab-tcf-v2-2/ (checked 2026-10-29)
- [S5] Features page (tracker diagnostics): https://sourcepoint.com/diagnose/ (checked 2026-10-29)
- [S6] Terms of service: https://sourcepoint.com/terms-of-use/ (checked 2026-10-29)
- [S7] Privacy policy: https://sourcepoint.com/privacy-policy/ (checked 2026-10-29)
- [S8] Security / trust page: https://sourcepoint.com/trust-and-security/ (checked 2026-10-29)
- [S9] Frameworks, signals & platforms — found from sitemap: https://sourcepoint.com/ott-ctv/ (checked 2026-10-29)

---

Cite as: whats-best.ai, "Sourcepoint — Consent Management (CMP)", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/consent-management/sourcepoint

Corrections: https://whats-best.ai/correct/1164?target=page