Consent Management (CMP)
Termly
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Termly Inc. · termly.io
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Termly at a glance
- Vendor
- Termly Inc.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention United States source, captured 29 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 29 Oct 2026
- Starting price
- “Starter For essential protection € 9,5 Per website/month Billed Annually” (vendor’s words) source, captured 29 Oct 2026
- Panel verdict
- The AI panel rates Termly 2.5/5, the mean of 6 judges. Termly is a consent management platform from Termly Inc., a Delaware company. how scores are made
- As of
- Vendor pages captured 29 Oct 2026 to 1 Nov 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Termly is a consent management platform from Termly Inc., a Delaware company. Its highest scores came in standards and platforms and banner and choice: TCF 2.3 with one-click activation, Google Consent Mode v2 in basic and advanced modes, Gold-status Google CMP certification, a GTM gallery template, and a banner with accept, reject, a reopenable preference centre, thirteen auto-detected languages and regional rules. Its lowest were consent records and sovereignty: we found no public information on record contents, retention or the banner version shown, exports need Pro+ or Agency, the terms state United States hosting with a largely US subprocessor list, and the captured pages give different figures for where European users' data sits. Prior blocking scored 4-5, the Auto Blocker is documented on all plans, but we found no published way to verify nothing fires before consent. Pricing scored 5-6, Starter at € 9,5 and Pro+ at € 13,5 per website/month billed annually public and the Agency price not. The flagged split list flagged none; weighted totals ranged 4.7-5.5.
Speaks for it
- IAB TCF 2.3 with one-click activation, plus per-vendor and per-purpose choices for European visitors on Pro+.
- Google Consent Mode v2 in basic and advanced modes, held by a Google certified CMP partner at Gold status, with a Termly template in the GTM gallery.
- Accept, reject and a reopenable preference centre with thirteen auto-detected languages, documented on all plans.
- The Auto Blocker holds third-party cookies and scripts until consent on all plans.
- Single-site costs are public: a free account without a credit card, Starter at € 9,5 and Pro+ at € 13,5 per website/month billed annually.
Held against it
- Consent-record and preference-change exports are limited to the Pro+ and Agency plans.
- We found no public information on what a consent record contains, retention periods, or a tie to the banner version shown.
- The terms state United States hosting for a Delaware entity, and the subprocessor list is dominated by US providers including AWS, Cloudflare, Stripe, Intercom, Zendesk and Microsoft.
- We found no published way to verify that nothing fires before consent.
- The Agency plan price and bulk licence amounts sit behind a 'Calculate Now' calculator, with overage beyond 50,000 monthly banner views unpriced.
Best for
- You run a WordPress or Shopify site and want Google Consent Mode v2 with a GTM gallery template from a Gold-status Google certified CMP partner.
- You advertise to European visitors and can take Pro+, which carries TCF 2.3 with per-vendor and per-purpose consent choices.
- You want predictable single-site pricing, with a free account that needs no credit card and Starter at € 9,5 per website/month billed annually.
- You manage multiple websites from one dashboard and want consent preferences to carry across subdomains.
Avoid if
- You need an EU contracting entity or EU representative — the published terms name Termly Inc. of Dover, Delaware under Delaware law.
- You must budget a multi-site or agency rollout in advance — the Agency price and bulk licence amounts sit behind a calculator.
- You need consent-record exports on the Free or Starter plan — the pages place them on Pro+ and Agency.
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 3 of 5 |
| Prior blocking & script control | 2 of 5 |
| Scanning & cookie classification | 2.5 of 5 |
| Consent records & proof | 2 of 5 |
| Frameworks, signals & platforms | 3 of 5 |
| European sovereignty | 2 of 5 |
| Pricing transparency | 2.5 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Automatic blocking of third-party cookies and scripts until consent is stated, along with a Google Tag Manager consent template that passes the visitor's choices to GTM. I found no public information on placeholders for embedded videos and maps, a manual blocking mode, server-side tagging, or any documented way for the site owner to verify that nothing loads before consent. 3 14 2 12
The Agency Developer
Automatic blocking of third-party cookies and scripts until consent is stated on three product pages, and the Google Tag Manager template in the gallery template feed communicates consent preferences to GTM — that covers my WordPress clients without theme surgery. We found no public information on placeholders for YouTube or Maps embeds, on a JavaScript API or events so forms and plugins can ask for consent, on server-side tagging, or on instructions to verify nothing loads before consent, so embedded-video clients would still need a workaround from me. 2 3 9 14 12 16
The Publisher Marketing Lead
Automatic blocking of third-party cookies and scripts until consent is documented on all plans, and Termly ships a consent template in the Google Tag Manager gallery that syncs preferences with GTM. We found no public information on placeholders for video or map embeds, a manual blocking mode, consent passed to forms or CAPTCHAs, or a documented way to verify nothing fires before consent — the verification step is what I would want before trusting my ad stack to it. 3 2 14 12
The In-House Lawyer
Automatic blocking of third-party cookies and scripts until consent is described on all plans, and a Google Tag Manager template in the official gallery synchronises consent choices automatically. We found no public information on content blockers with placeholders for embedded videos or maps, a manual blocking mode with its limits, server-side tagging, or any documented way for me to verify on the live site that nothing loads before consent. 2 3 12 14
The WordPress Webmaster
An Auto Blocker detects third-party scripts and cookies and checks consent before letting them run, and there is a Termly template in the Google Tag Manager gallery that carries the visitor's choices into GTM — the two things my WordPress site needs most. I found no public information on placeholders for YouTube or Maps embeds, on consent being passed to my contact form's reCAPTCHA, on server-side tagging, or on a documented way to test that nothing fires before consent. 3 12 14 2
The Skeptic
Automatic blocking of third-party cookies and scripts until consent is claimed by name ("Auto Blocker") on all plans, and a Google Tag Manager template in the gallery forwards consent preferences. But the captured pages show no placeholder for embedded videos or maps, no manual mode with its limits, and not one instruction for opening the network tab or a preview to check that nothing fires before consent — until the test steps are published, auto-blocking stays a claim. 2 3 9 12 14
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
A scanner searches every page of the site, automatically categorises cookies into six purposes, generates and auto-updates the cookie declaration, and scheduled rescans run monthly or weekly depending on the plan, plus an automatic vendor scanner against the TCF Global Vendor List. Beyond that I found no stated scan depth or page count, no scanning of local storage or pixels, and no alerts on new or changed trackers. 14 2 3 16 5
The Agency Developer
The scanner searches every page, auto-categorises into six categories, scheduled scans run on all plans (monthly on Starter, weekly on Pro+), the cookie policy auto-updates from the scan, and a vendor scanner lists third-party vendors from the TCF Global Vendor List. We found no public information on email alerts when a new tracker appears, on scanning of local storage or pixels specifically, on scanning behind logins, or on exportable scan reports I could hand a client as proof. 2 3 5 14 16
The Publisher Marketing Lead
A scanner that searches every page, auto-categorizes cookies into six categories and compiles each cookie's details for review, with scheduled rescans monthly on Starter and weekly on Pro+, an auto-generated and auto-updated cookie declaration, and a vendor scanner against the TCF Global Vendor List. We found no public information on local storage and pixel scanning, email alerts on new or changed trackers, or exportable scan reports. 14 2 3 5 16
The In-House Lawyer
The scanner searches every page of the site, automatically categorises cookies into six categories, rescans on a schedule that depends on the plan (monthly on Starter, weekly on Pro+), and feeds a generated cookie declaration that the policy keeps updated. We found no public information on alerts for new or changed trackers, scanning of local storage or pixels, or scan reports exportable in a form I could hand an auditor. 2 3 5 14
The WordPress Webmaster
The scanner searches every page for cookies, automatically categorises them into six categories, and scheduled rescans run monthly on Starter and weekly on Pro+, with the cookie declaration generated and auto-updated from the results; a vendor scanner also lists third-party vendors against the TCF Global Vendor List. I found no public information on alerts for new trackers, on local storage and pixels being scanned, or on how the classification database is maintained. 14 3 2 5 16
The Skeptic
A scanner searches every page, automatically categorises cookies into six named categories and generates a cookie declaration, with scheduled rescans whose cadence is tied to the plan (monthly on Starter, weekly on Pro+) plus an automatic vendor scanner against the TCF Global Vendor List. The depth stops there: we found no public information on alerts for new or changed trackers, coverage of local storage and pixels, or export of scan reports. 2 3 5 14 16
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
Consent logs are stored in accordance with the GDPR, downloadable from the dashboard on Pro+ and Agency, with EU-based storage selectable for visitors' consent records; exports also cover visitors' choice and preference changes. For a dispute I need each record tied to the banner version shown and a stated retention period, and I found no public information on a consent ID the visitor can look up, re-consent when texts change, or an API to the log. 3 2 4
The Agency Developer
Consent logs are stored in accordance with the GDPR and downloadable as a report from the dashboard, with export of records and preference changes on the Pro+ and Agency plans and optional EU-based storage for consent records. We found no public information on what each record contains — timestamp, pseudonymous ID, banner version — on retention periods, on consent expiry or re-prompting when texts change, or on a consent ID the visitor can look up. 2 3 4
The Publisher Marketing Lead
Consent logs are downloadable from the dashboard and exportable on Pro+ and Agency, described as stored in line with the GDPR, with EU-based storage configurable per account and preferences carrying from a main site to its subdomains. We found no public information on what each record contains — banner version, pseudonymous ID — on retention periods, consent expiry, re-consent after configuration changes, or a consent ID visitors can look up. 3 2 4 9
The In-House Lawyer
Consent logs are stored and a report can be downloaded from the dashboard, with records of visitors' choices and preference changes exportable on Pro+ and Agency — enough to show a regulator that consent exists. We found no public information on what each record contains, retention for the log, the banner version shown, a consent ID the visitor could look up, re-consent when services change, or withdrawal recorded as its own event; in a dispute I could not reconstruct what the visitor actually saw. 2 3 4
The WordPress Webmaster
Consent logs are kept and downloadable as a report straight from the dashboard on Pro+ and Agency, with EU-based storage configurable for the records in account settings. I found no public information on what each record contains beyond choices and preference changes, on a retention period, on the banner asking again when texts change, or on a consent ID a visitor could look up. 3 2
The Skeptic
Consent logs are stored with GDPR invoked, downloadable as a report from the dashboard, and consent records and preference changes can be exported — but only on Pro+ and Agency. The captured pages never say what a record contains, how long it is kept, or whether it ties back to the banner version and texts shown; if a supervisory authority asks, the proof you can produce depends on which plan you bought. 2 3 4
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
TCF 2.3 with one-click activation on Pro+, Google Consent Mode v2 in basic and advanced modes under Gold-certified CMP partner status, a template in the GTM template gallery, Shopify and WordPress compatibility, subdomain consent sharing and multi-website management are all documented. I found no public information on a registered IAB Europe CMP ID, Microsoft UET consent mode, GPP or product-side Global Privacy Control, app SDKs, or a REST API. 4 16 2 15 12 1
The Agency Developer
Gold-status Google CMP certification, Google Consent Mode in basic and advanced tiers, TCF 2.3 with per-vendor choices, a Tag Manager gallery template, named WordPress and Shopify support, and multi-website management with multi-user permissions cover most of my stack. We found no public information on a registered IAB Europe CMP ID, Microsoft UET consent mode, GPP or GPC in the consent product itself, iOS or Android SDKs, or a REST API, and the named platforms are WordPress and Shopify — TYPO3 we found no mention of. 1 2 3 12 15 16
The Publisher Marketing Lead
This is where Termly matches my checklist: IAB TCF at the current 2.3 version with granular per-vendor and per-purpose choices, Google Consent Mode v2 explicitly split into basic mode on Free and Starter and advanced mode on Pro+ and Agency, Google certified CMP partner at Gold status, and a GTM gallery template, plus multi-site management and an Agency tier. We found no public information on a registered IAB CMP ID number, Microsoft UET consent mode, GPP or GPC as product signals, iOS and Android SDKs, or a REST API — so one consent shared between my site and an app is not documented. 2 4 15 16 1 12
The In-House Lawyer
IAB TCF 2.3 with one-click activation, Google Consent Mode v2 in basic and advanced tiers, Google CMP certification at Gold status, an official GTM template and multiple websites under one dashboard are all documented. We found no public information on a registered CMP ID, Microsoft UET or other ad-platform signals, GPP, app SDKs or an API, and the Global Privacy Control statement concerns Termly's own site rather than a banner capability — so the documented signal chain is Google-and-TCF only. 1 2 4 12 15 16
The WordPress Webmaster
Google Consent Mode v2 is documented in basic and advanced modes by plan with Google-certified CMP partner gold status, IAB TCF 2.2 and 2.3 are supported with one-click enablement from the dashboard, the GTM gallery template passes consent to my tags, and the banner runs on WordPress and Shopify with multiple websites manageable from one account. I found no public information on a registered IAB Europe CMP ID, Microsoft UET consent mode, app SDKs, GPP or GPC as a product feature, or a JavaScript or REST API. 2 15 16 12 9
The Skeptic
Google Consent Mode v2 in both basic and advanced flavours with Google Certified CMP Partner Gold status, IAB TCF 2.3 with one-click activation, a GTM template gallery listing, Shopify and WordPress compatibility, subdomain consent sharing and multi-website management — a solid mid-level story. But TCF support itself is gated to Pro+, the vendor's privacy notice says it honours Global Privacy Control while also stating it does not respond to DNT, and we found no registered CMP ID, no Microsoft UET, no GPP, no app SDK documentation and no API on the captured pages. 2 4 7 12 15 16
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
The contracting entity Termly Inc. sits in Delaware, the terms state the service is hosted in the United States, and the named subprocessor list is dominated by US providers — AWS in Washington for hosting, Cloudflare as proxy, Stripe, Intercom, Zendesk and Microsoft among them — with Standard Contractual Clauses and EU-US Data Privacy Framework certification as the stated safeguards. EU/EEA storage for European users' consent records is offered as an account configuration, but I found no EU contracting entity or representative, and no ISO 27001 or SOC 2 certification stated. 6 7 8 2 15 9
The Agency Developer
Termly Inc. is a Delaware entity, the service is hosted in the United States, and the published subprocessor chain is dominated by US providers (AWS for hosting, Cloudflare, Stripe, Intercom, Zendesk, Microsoft, WPEngine), with Standard Contractual Clauses and Data Privacy Framework certification stated as safeguards. European users' data can be stored in the EU/EEA and consent records have an EU storage option, but we found no public information on an EU contracting entity or EU representative, or on where the banner script itself is served beyond the general US hosting statement. 2 6 7 8 15
The Publisher Marketing Lead
Termly Inc. is a Delaware entity under Delaware law and FTC oversight, and its published sub-processor list runs largely through US providers including Amazon Web Services for hosting and Cloudflare for the proxy. The captured pages give different statements on where data sits: the terms and privacy policy say the servers are in the United States, while product pages say European users' data is stored in the EU/EEA and consent records can be configured for EU-based storage. Safeguards are the EU-US Data Privacy Framework and Standard Contractual Clauses; we found no public information on an EU contracting entity or EU delivery of the banner script. 6 7 8 2 9
The In-House Lawyer
The contracting entity is Termly Inc. of Delaware, the terms state the service is hosted in the United States, and the published subprocessor list is largely US providers (AWS, Cloudflare, Stripe, Intercom, Zendesk, Microsoft), with SCCs and Data Privacy Framework participation as the stated safeguards. Marketing pages state European users' data is stored in the EU/EEA and consent records can be configured for EU storage, so the captured pages give different figures for hosting, and no EU entity or representative and no ISO 27001 or SOC 2 certification appear — a chain with US Cloud Act exposure that I would need to paper over carefully for a German-French-Austrian estate. 2 6 7 8 9 15
The WordPress Webmaster
This is a US company on US infrastructure: the terms state the service is hosted in the United States, Termly Inc. is registered in Delaware, and the published subprocessor list puts the chain — AWS, Cloudflare, WPEngine, Stripe — almost entirely in the US, with only Mixpanel noting Netherlands hosting. Subprocessors are at least listed with countries and Standard Contractual Clauses plus Data Privacy Framework certification are stated, and consent records can be stored in the EU through account settings, though the captured pages state both US hosting and EU/EEA storage for European users' data; I found no public information on a European contracting entity or the banner script being served from the EU. 6 7 8 2
The Skeptic
The contracting entity is Termly Inc. of Dover, Delaware under Delaware law, the services are hosted in the United States, and the published subprocessor list — at least it is published, with countries — is overwhelmingly US: AWS for hosting, Stripe, Intercom, Zendesk, Microsoft, Cloudflare. Consent records can be switched to EU-based storage and one captured page says European users' data sits in the EU/EEA, while other captured pages state the servers are in the United States; the stated safeguards are the EU-US Data Privacy Framework and Standard Contractual Clauses. We found no EU entity or representative, no ISO 27001 or SOC 2, and nothing on export or deletion of the consent logs when you leave. 2 6 7 8 15
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
The tiers are public with their prices — Free at € 0, Starter at € 9,5 and Pro+ at € 13,5 per website/month billed annually — and with per-tier limits such as 50,000 banner views per month on Starter, monthly versus weekly scans, a 25% annual saving, and terms on auto-renewal, proration, cancellation and sales tax. I found no public price for the Agency tier, for additional website licences (a 'Calculate Now' calculator), or for usage overage — the terms only reserve additional fees for usage that significantly exceeds normal patterns. 5 6 2
The Agency Developer
Free, Starter at € 9,5 per website/month billed annually and Pro+ at € 13,5 per website/month billed annually are public, with per-plan limits (50,000/mo banner views on Starter) and unusually clear feature gating — TCF needs Pro+, advanced Consent Mode needs Pro+ or Agency. But the Agency plan price and bulk license terms sit behind a 'Calculate Now' calculator and the terms only speak of additional fees for usage significantly exceeding normal patterns, so I cannot compute the real annual cost for forty client sites from the public pages alone. 5 6 2 16
The Publisher Marketing Lead
Free, Starter at € 9,5 and Pro+ at € 13,5 per website per month billed annually are public, Starter's 50,000 monthly banner-view limit and Pro+'s unlimited views are stated, tax treatment, cancellation, prorated upgrades and auto-renewal sit in the terms, and TCF is gated by plan rather than priced as a separate add-on. The Agency tier's price, what happens above the banner-view limit, and bulk license amounts behind a calculator mean a full agency annual cost cannot be worked out from the captured pages alone. 5 6 2 16
The In-House Lawyer
Starter at € 9,5 and Pro+ at € 13,5 per website/month billed annually, the free tier, Starter's 50,000 monthly banner-view limit and each plan's inclusions are public, alongside auto-renewal, upgrade proration, cancellation, refund and tax treatment. The Agency plan, additional website licence prices (behind a bulk-savings calculator) and what happens above the banner-view limit are unpriced on the captured pages, so I cannot compute the full annual cost of a multi-site rollout from public information alone. 2 5 6
The WordPress Webmaster
I can read the main tiers publicly — a free plan, Starter at € 9,5 and Pro+ at € 13,5 per website/month billed annually — with Starter's 50,000 monthly banner views and the plan limits visible, plus auto-renew, cancellation, proration and refund terms in the terms of use. Extra website licences sit behind a 'Calculate Now' calculator, the Agency plan carries no price on the captured pricing page, TCF is priced only implicitly through the Pro+ requirement, and I found no public information on what exceeding the banner-view limit costs. 5 6 16
The Skeptic
Starter at € 9,5 and Pro+ at € 13,5 per website per month billed annually are published with their limits — 50,000 banner views a month on Starter, unlimited on Pro+ — next to a free tier, a 25% annual saving and stated auto-renewal and cancellation terms, so a single-site cost is computable. What a buyer cannot compute from the captured pages: the Agency plan's price, what happens above 50,000 banner views (the terms only promise additional fees for usage that "significantly exceeds normal patterns"), the bulk-license discount hiding behind a calculator, and the fact that TCF itself only arrives at Pro+. 2 5 6 16
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Termly
Is Termly European?
No. whats-best.ai classifies Termly as Rest of world.
Where does Termly store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention United States as hosting location, per the vendor’s page captured 29 Oct 2026.
Does Termly have a free plan?
Yes. Termly has a free plan, per the vendor’s page captured 29 Oct 2026.
What are the best alternatives to Termly?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Termly alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 29 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (17)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage termly.io Checked 29 Oct 2026 Details →
- 2 Features page (consent management platform) termly.io Checked 29 Oct 2026 Details →
- 3 Features page (cookie scanner) termly.io Checked 29 Oct 2026 Details →
- 4 Features page (IAB TCF) termly.io Checked 29 Oct 2026 Details →
- 5 Pricing page termly.io Checked 29 Oct 2026 Details →
- 6 Terms of service termly.io Checked 29 Oct 2026 Details →
- 7 Privacy policy termly.io Checked 29 Oct 2026 Details →
- 8 Subprocessor list termly.io Checked 29 Oct 2026 Details →
- 9 Banner & choice architecture — found from sitemap termly.io Checked 29 Oct 2026 Details →
- 10 Banner & choice architecture — found from sitemap termly.io Checked 29 Oct 2026 Details →
- 11 Prior blocking & script control — found from sitemap termly.io Checked 29 Oct 2026 Details →
- 12 Prior blocking & script control — found from sitemap termly.io Checked 29 Oct 2026 Details →
- 13 Scanning & cookie classification — found from sitemap termly.io Checked 29 Oct 2026 Details →
- 14 Scanning & cookie classification — found from sitemap termly.io Checked 29 Oct 2026 Details →
- 15 Frameworks, signals & platforms — found from sitemap termly.io Checked 29 Oct 2026 Details →
- 16 Frameworks, signals & platforms — found from sitemap termly.io Checked 29 Oct 2026 Details →
- 17 Security / trust page — found from the homepage termly.io Checked 1 Nov 2026 Details →