Consent Management (CMP)
Usercentrics CMP
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Usercentrics GmbH · usercentrics.com
Compare with OneTrust Cookie Consent → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Usercentrics CMP at a glance
- Vendor
- Usercentrics GmbH
- Headquarters
- Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 29 Oct 2026
- Panel verdict
- The AI panel rates Usercentrics CMP 3.5/5, the mean of 6 judges. Usercentrics CMP is a consent management platform from Usercentrics GmbH, Munich, for websites, apps and connected TV. how scores are made
- As of
- Vendor pages captured 29 Oct 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Usercentrics CMP is a consent management platform from Usercentrics GmbH, Munich, for websites, apps and connected TV. Its top scores go to banner and choice and to standards and platforms, at 7 to 8: five documented layouts, EU and US rule sets applied by visitor location, WCAG 2.2 AA certification, Google-certified Consent Mode v2, and SDKs from iOS and Android to eight TV platforms. Pricing transparency also scores 7 to 8, with web tiers from €7 a month for one domain and 1,500 sessions up to €750 for a million sessions and 100 domains, plus a 14-day trial with no credit card required. Consent records scores 5 to 6: we found no public information on retention, a visitor-quotable consent ID, or the banner version behind each stored consent. Sovereignty spans 5 to 7: the pages show Google Cloud EMEA hosting on servers in Germany and Belgium, yet the same privacy policy discloses that US transfers under FISA 702 cannot be ruled out, and where the banner script and consent logs sit is unconfirmed. Weighted totals run 6.4 to 7.2.
Speaks for it
- Five documented banner layouts with granular consent, withdrawal at any time, EU and US rule sets by visitor location, and WCAG 2.2 AA certification.
- Google-certified Consent Mode v2 with Gold Tier partner status, plus Microsoft UET, Amazon and a Meta signals gateway, and plugins for sixteen CMS and shop platforms.
- Web pricing published from €7 a month for one domain and 1,500 sessions up to €750 for a million sessions and 100 domains, with a 14-day trial and no credit card required.
- A live-user scanner that aggregates every 24 hours and flags third-party technology firing outside the consent platform against a database of more than 2,200 services.
- A published data processing agreement, ISO 27001 certification, a named German data protection officer and a subprocessor list with addresses.
Held against it
- We found no public information on retention periods for consent logs, a visitor-quotable consent ID, or the banner version tied to each stored consent.
- We found no public information on browser-test steps verifying that nothing loads before consent, on embed placeholders for videos and maps, or on passing consent to forms and CAPTCHAs.
- The privacy policy discloses that transfers to the USA subject to FISA 702 access cannot be ruled out, with support on Zendesk and payments on Stripe, both US providers.
- We found no public information on where the banner script and the consent logs are served and stored.
- The captured pages give different figures for the IAB TCF version, 2.2, 2.3 and 2.4, and for the same web plans in euro and US dollars, and we found no public information on a registered IAB Europe CMP ID or Global Privacy Platform support.
Best for
- You run multilingual sites across the EU and US and want geolocation rule sets, sixty banner languages and Google-certified Consent Mode v2 signalling.
- You want to budget from public prices, from €7 a month for one domain and 1,500 sessions up to €750 for a million sessions and 100 domains, with a 14-day trial and no credit card required.
- You manage a portfolio of domains — multi-domain management starts at the Pro tier and packages upgrade automatically when limits are exceeded.
- You publish apps or games and need iOS, Android, Flutter, React Native and Unity SDKs plus TV platforms from tvOS to Xbox.
Avoid if
- Your compliance review requires a data-processing chain without US exposure — the vendor's own privacy policy discloses that transfers to the USA subject to FISA 702 access cannot be ruled out, with Zendesk and Stripe in the chain.
- You need a fixed published price at large scale — the Corporate tier and the app plan from 500,000 daily active users upward are priced only on request.
- You depend on IAB TCF and need one confirmed framework version — the captured pages give different figures, 2.2, 2.3 and 2.4.
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 4 of 5 |
| Prior blocking & script control | 3 of 5 |
| Scanning & cookie classification | 3.5 of 5 |
| Consent records & proof | 2.5 of 5 |
| Frameworks, signals & platforms | 4 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 4 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Automatic blocking of non-necessary services until consent is documented and backed by a large service repository, a Google Tag Manager integration where Consent Initialization triggers apply consent settings before other tags fire, and a server-side tagging solution that filters data forwarding by consent choice. A live-user scanner flags third-party technology that fires outside the configured CMP, which is the monitoring check I look for; we found no public information on placeholders for embedded videos or maps, a manual blocking mode, or consent passed to forms and CAPTCHAs. 1 2 11 10 12
The Agency Developer
Automatic blocking of non-essential services via their repository until consent, a Google Tag Manager template with Consent Initialization triggers so only consented tags fire, and a documented server-side tagging solution with consent-based forwarding filters — that covers the core of what my themes need without rewrites. But I found no public information on placeholders for YouTube or Maps embeds, a JavaScript API that passes consent to forms, CAPTCHAs or plugins, a manual blocking mode, or instructions to verify in the browser that nothing loads before consent. 2 11 1 10 15
The Publisher Marketing Lead
Automatic blocking of non-essential services from a maintained repository, tags that fire only for consented purposes through Google Tag Manager consent initialisation and a data-layer integration, and a server-side tagging solution whose logic filters stop non-consented data reaching third parties are all documented. We found no public information on placeholders for embedded videos or maps, a manual blocking mode alongside the automatic one, consent passed to forms or CAPTCHAs, or a documented way to verify on the live site that nothing loads before consent. 1 2 10 11 15
The In-House Lawyer
Automatic blocking of non-essential services until consent via an extensive repository, a Google Tag Manager template with Consent Initialization triggers so only tags for consented purposes fire, and server-side tagging with server-side filters described to stop non-consented data reaching third parties. The scanner monitors live users' domain calls and flags any technology triggered outside the CMP as a data breach, which gives the site owner a real check. We found no public information on placeholders for embedded videos or maps, a manual blocking mode, or coverage of local storage and fingerprinting. 2 11 10 12 13
The WordPress Webmaster
Automatic blocking of non-essential services until consent is stated as a core feature, backed by a repository of more than 2,200 service templates, and the Google Tag Manager path is documented in depth: a GTM template, data-layer integration and consent-initialization triggers so tags fire only after consent. Server-side tagging with consent-based forwarding filters is documented too. We found no public information on placeholders for embedded videos or maps, on consent being passed to forms or CAPTCHAs through a JavaScript API, or on instructions to test in the browser that nothing loads before consent. 1 2 4 10 11
The Skeptic
Automatic blocking of non-essential services until consent is stated on more than one page, a Smart Data Protector is named, a Google Tag Manager template exists with consent types wired so only consented tags fire, and server-side tagging with consent filters is described. But "automatic" is a claim until the test steps are published: I found no instructions to verify in the browser or tag-manager preview that nothing loads before consent, and no public information on embed placeholders, manual versus automatic modes with their limits, or consent passed to forms and CAPTCHAs through a JavaScript API. 2 15 11 10 1
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
Scans run on a stated schedule (monthly on the paid web tiers, weekly on Corporate), detected third-party requests are matched against a database of more than 2,200 classified services and vendors, and the cookie notice and privacy policy are updated automatically with new trackers. The scanner monitors live users rather than crawling and publishes its user agent, and gaps where technology fires outside the CMP are flagged for action rather than silently classified; we found no public information on local storage and pixel coverage or email alerts on new trackers. 4 9 12 13
The Agency Developer
Scheduled scans by tier (monthly up to weekly for Corporate), a database of 2,200+ categorised vendors with new trackers automatically added to the cookie notice and privacy policy, and a live-user monitor that matches third-party requests to the service database and flags technology firing outside the CMP — that Friday-tracker scenario is covered. The depth markers are thinner: no stated scan depth or page count, no local storage or pixel scanning described, and no email alerts on new or changed trackers. 9 12 4 3 13
The Publisher Marketing Lead
Scans run once at setup and then monthly (weekly on the top web plan), detected third-party requests are matched to a database of more than 2,200 categorised vendors and automatically written into the cookie notice and privacy policy, and a scanner that watches real visitor sessions flags any technology firing outside the CMP as a gap to close immediately. We found no public information on stated scan depth, cookie purposes and lifetimes in the classification, or alerts when new or changed trackers appear. 3 4 9 12 13
The In-House Lawyer
Scans run at stated intervals (monthly in the paid web plans, weekly for Corporate), and the DPS scanner monitors live user sessions, matching detected third-party requests against a database of more than 2,200 vendors and aggregating every 24 hours. New trackers are automatically added and categorised into the cookie notice and privacy policy, gaps are flagged as a data breach, risk levels are reported, and the scanner's user agent is published. We found no public information on email alerts for new trackers, a change history, or audit-ready export of scan reports. 9 4 12 13 3
The WordPress Webmaster
Instead of crawling, the scanner watches live visitors and the domains loaded on their visit, aggregates results every 24 hours, and matches what it finds against a database of more than 2,200 categorised services; anything that fires but is missing from the configuration is flagged as a gap so you can act on it. Scans run monthly or weekly depending on the package, and new trackers are added and categorised into the cookie notice and privacy policy automatically. We found no public information on scanning local storage or pixels, or on email alerts when trackers change. 3 4 9 12 13
The Skeptic
Scans run at stated intervals per plan (once at setup, monthly, weekly on the top tier), new trackers are automatically categorised into the cookie notice and privacy policy, and a database of more than 2,200 services backs the matching. The Data Processing Service scanner is the interesting part: it watches real user traffic instead of crawling, aggregates every 24 hours, flags third-party technology that fires but is missing from the configuration, and publishes its user agent. I found no public information on local storage or pixel scanning, email alerts on new trackers, scan depth, or a change history. 9 4 12 13 3
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
The consent log automatically registers the date and time consent was given or updated, what each individual agreed to, and where they visited the site from, synced to the customer's server and held as a centralized repository usable for audits and data subject requests. However, we found no public information on a retention period for consent records, an export of the log itself, or a record of which banner version the visitor saw — the exact points a supervisory authority asks about first. 14 11 15 4
The Agency Developer
Records capture the date and time consent was given or updated, what each individual agreed to and where they visited from, held centrally for audits and data subject requests and synced to the customer's server, with cross-domain and cross-device sharing. I found no public information on a retention period for consent logs, records tied to the banner version shown, a consent ID the visitor can look up, or export of the consent log itself. 14 11 10 4
The Publisher Marketing Lead
Every consent is logged with date, time, what the visitor agreed to and where they came from, records sit in a central repository usable for audits and data-subject requests and can sync to our own server, and cross-device consent sharing is documented on the higher plans. We found no public information on how long consent records are kept, which banner version and texts were shown, a consent ID a visitor could look up, or export of the consent log itself. 2 10 11 14 15
The In-House Lawyer
Consent logging automatically records the date and time consent was given or updated, what each individual agreed to, and where the visitor came from, held in a centralised repository usable for a regulatory audit or a data subject request. Proof of consent is a named feature alongside multi-factor authentication, cross-domain and cross-device consent sharing is documented, and an analytics export API exists for app plans. We found no public information on banner versions or texts tied to each record, a visitor-lookup consent ID, retention periods for consent logs, consent expiry, or tamper-evident storage. 14 11 15 4 17
The WordPress Webmaster
The consent log automatically registers the date and time consent was given or updated, what each individual agreed to and where they visited from, held in a central repository for audits and data-subject requests, with an analytics export API, BI dashboard integration and cross-device consent sharing. We found no public information on a pseudonymous consent ID per record, the retention period for consent records, records tied to the banner version shown, or configurable consent expiry. 2 4 11 14 15 17
The Skeptic
Each consent is logged with date, time, what the individual agreed to and where they came from, in a central repository pitched at audits and data-subject requests, and consent decisions can be synced to the customer's own server — that last part I like, because the evidence leaves with you. For a dispute I would want more: I found no public information on the banner version or texts tied to each record, a consent ID a visitor could quote, retention for consent logs, withdrawal recorded as its own event, or asking again when the configuration changes. 14 11 10 17 4
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
Consent signals are broad: IAB TCF (named at v2.3 and v2.4) in a Google-certified CMP, Google Consent Mode v2, Microsoft UET and Clarity consent modes, an Amazon consent signal, Google Additional Consent, GPC recognition, and a Meta signals gateway, plus native iOS and Android SDKs with Flutter, React Native and Unity, and TV platforms from tvOS to Xbox. Sixteen CMS and shop plugins including WordPress, Shopify and TYPO3, multi-domain management from the Pro tier, cross-device consent sharing, and configuration via API are documented; we found no public information on a registered IAB Europe CMP ID number or Global Privacy Platform support. 3 10 16 17 4
The Agency Developer
IAB TCF 2.3 support (with TCF 2.4 listed on another page — the captured pages give different versions), a Google-certified CMP with Consent Mode v2 and Additional Consent, Microsoft UET, Amazon and Microsoft Clarity signals, automatic Global Privacy Control recognition, iOS and Android SDKs plus Flutter, React Native and Unity, connected TV platforms, and plugins for WordPress, Shopify, TYPO3 and a dozen more — configuration via API appears in the app plans. I found no public information on a registered IAB CMP ID or Global Privacy Platform support. 2 3 16 17 8 4
The Publisher Marketing Lead
TCF 2.3 with 2.4 named in the signal list, Google Consent Mode v2 in a Google-certified CMP with Gold Tier and App-Ready partner status, Microsoft UET, Amazon and Clarity consent signals, automatic Global Privacy Control recognition, plugins for a long list of CMS and shop systems, iOS, Android, Flutter, React Native and Unity SDKs, and connected-TV platforms from tvOS to PlayStation are all documented, with configuration and analytics-export APIs on the top app plan. We found no public information on a registered IAB Europe CMP ID number or on Consent Mode basic versus advanced mode — the detail my Google Ads conversions hinge on. 2 3 4 10 16 17
The In-House Lawyer
Google Consent Mode v2 comes with Google Gold Tier and App-Ready certification, Microsoft UET and Microsoft Clarity consent modes and the Amazon consent signal are named, Global Privacy Control is recognised automatically, and the captured pages give different figures for the TCF version, 2.3 and 2.4. Native iOS and Android SDKs plus Flutter, React Native and Unity, connected-TV support from tvOS to Xbox, CMS plugins from WordPress and Shopify to TYPO3, and configuration via API on the top app plan are all documented. We found no public information on a registered IAB Europe CMP ID number or the Global Privacy Platform. 2 3 16 17 8
The WordPress Webmaster
A WordPress plugin sits in a list of sixteen CMS and shop integrations, Google Consent Mode v2 comes with Google Gold Tier certification, Microsoft UET, Amazon and Meta signals are supported, Global Privacy Control is recognised automatically, and native iOS and Android SDKs plus Flutter, React Native, Unity and eight connected-TV platforms are documented. Configuration is available via API on the top app plan and multiple domains are managed from one account. The captured pages give different figures for the IAB TCF version (2.2, 2.3 and 2.4), and we found no public information on a registered IAB Europe CMP ID or Global Privacy Platform support. 2 3 4 8 10 16 17
The Skeptic
Google Consent Mode v2 with Google certification and Gold Tier partner status, Microsoft UET, Amazon and Clarity consent signals, Global Privacy Control, sixteen-plus CMS plugins, iOS, Android, Flutter, React Native and Unity SDKs, eight TV platforms, and configuration plus data-export APIs are all documented. The captured pages give different figures for the TCF version (2.3 and 2.4), and I found no public information on a registered IAB Europe CMP ID, GPP for US states, or the distinction between basic and advanced Consent Mode. 3 10 17 16 2 4
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
The contracting entity is Usercentrics GmbH in Munich with a German register entry, a named German data protection officer, a published data processing agreement, ISO 27001 certification, and cloud hosting contracted through Google Cloud EMEA Ltd. with servers in Germany and Belgium. The same privacy policy discloses that data may be transferred to the USA and exposed to FISA 702 access and names US providers in the chain (Zendesk for support, Stripe, Zapier, WP Engine), and we found no public information confirming where the banner script and the consent logs are stored. 4 5 6
The Agency Developer
A German GmbH in Munich with a published data processing agreement, hosting on Google Cloud EMEA with servers in Germany and Belgium, ISO 27001 certification, and a subprocessor list with locations including Zendesk in San Francisco, Stripe and WP Engine in the USA, alongside a disclosed possibility of FISA 702 access to transferred data. Where the banner script itself is served from, and SOC 2 certification, are not described. 5 6 4
The Publisher Marketing Lead
The contracting entity is Usercentrics GmbH in Munich with a published data processing agreement and ISO 27001 stated, and hosting sits on Google Cloud EMEA with servers in Germany and Belgium, with the vendor openly disclosing the risk of US transfers under FISA 702 and the Article 44 GDPR safeguards in place with Google. Where the banner script is served from and where consent logs are stored are not confirmed on the captured pages, and support runs on Zendesk in the USA. 4 5 6
The In-House Lawyer
The contracting entity is Usercentrics GmbH in Munich with a commercial register number at the Munich court, hosting runs on Google Cloud EMEA with servers in Germany and Belgium, a data processing agreement is published, ISO 27001 is stated, and subprocessors are listed with their addresses. The privacy policy itself discloses that transfers to the USA subject to FISA 702 access cannot be ruled out, and support (Zendesk, San Francisco) and payments (Stripe, USA) run through US providers. The chain is visible, but the certification scope is not published and the pages do not separate out where the banner script and consent logs sit within it. 5 6 4
The WordPress Webmaster
Usercentrics GmbH is registered in Munich with a German data protection officer, product hosting runs on Google Cloud EMEA with servers in Germany and Belgium, general terms and a data processing agreement are published alongside ISO 27001 certification, and the privacy policy lists subprocessors with their addresses. We found no public information confirming where the banner script and consent logs are served and stored, or on SOC 2, and the support system and payment provider are US companies with a disclosed possibility of FISA 702 access on transfers to the USA. 4 5 6
The Skeptic
A German GmbH with Munich address and commercial register number, a published data processing agreement, ISO 27001, and hosting on Google Cloud EMEA with servers named in Germany and Belgium — plus an unusually frank disclosure that data may still reach the USA and be exposed to FISA 702 access. The chain shows US links regardless: support through Zendesk in San Francisco, payments through Stripe, the vendor's own website on WP Engine in Texas; I found no public information on where the banner script and consent logs are served, and nothing on ownership. 5 6 4
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
All five web tiers are public from €7 per month with their domain counts, session limits and language counts, a scaling table runs up to 100 domains and 1,000,000 monthly sessions for 750€, the session is defined as 30 minutes, packages auto-upgrade when limits are exceeded, VAT treatment is stated, and the app plans price by daily active users at €50 / month up to 6,000 DAU with unlimited apps at no extra cost. For full computability we found no public information on setup fees, agency or reseller terms, or a minimum term. 2 4 15 17
The Agency Developer
Every web tier is priced with its domains, session limit and banner languages, a scaling ladder runs to 100 domains and 1,000,000 sessions at € 750, packages auto-upgrade when limits are exceeded, VAT treatment and monthly-versus-annual billing are stated, and the app plans are priced per average daily active users with unlimited apps — I can compute the annual cost for a 40-domain agency book from these pages. Setup fees, agency or reseller terms, and data-return terms on cancellation are not stated. 2 4 15 17
The Publisher Marketing Lead
Every web plan is priced with its domains, sessions, regulations and banner languages, the top web tier scales in published steps up to 1,000,000 sessions and 100 domains for 750€, packages upgrade automatically when limits are exceeded, VAT treatment, monthly-versus-annual billing, the session definition and cancellation are all stated, and the app plans are priced per daily active user at 50€ per month up to 6,000 DAU. The captured pages give different figures for the same web plans (EUR and USD), the top tiers are priced only on request, and we found no public information on agency or reseller terms or setup fees. 2 4 15 17
The In-House Lawyer
Every web tier is public with its scaling rule, from €7 a month for one domain and 1,500 sessions to a ladder of €100 for 100,000 sessions and ten domains up to €750 for a million sessions and a hundred domains, with monthly or annual billing, automatic upgrade when limits are exceeded, subdomains counted, the session defined, and VAT treatment stated. App pricing is public too, based on average daily active users from €50 a month to custom pricing from 500,000 DAU. The captured pages give different figures for the currency (euro prices and dollar prices on different pages), and we found no public information on agency or reseller terms. 2 4 15 17
The WordPress Webmaster
For one WordPress domain the public pages are enough to budget: €7 per month for up to 1,500 sessions, €15 for 3,000, €30 for three domains and 15,000 sessions, prices quoted plus VAT, monthly or annual billing, automatic upgrade when package limits are exceeded, and a 14-day trial without credit card. The session and domain ladder continues publicly up to €750 per month for a million sessions and 100 domains. The Corporate tier and the large-scale app tier are custom-priced on request, and we found no public information on agency or reseller terms, setup fees or a minimum term. 2 4 15 17
The Skeptic
Four web tiers are priced in euros with domains, session limits and languages each, scaling tiers are listed up to a million sessions and a hundred domains, packages upgrade automatically when limits are crossed, a session is defined as thirty minutes, monthly versus annual billing is a stated choice, VAT is stated as possibly added, and the trial runs fourteen days without a credit card; the app product is priced per daily active user with the definition published. The top tiers are custom-priced, and I found no public information on setup fees or agency and reseller terms. 2 4 17 15
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Usercentrics CMP
Is Usercentrics CMP European?
Yes. whats-best.ai classifies Usercentrics CMP as EU-Made.
Where does Usercentrics CMP store data?
Not stated on the vendor’s pages as of 29 Oct 2026.
Does Usercentrics CMP have a free plan?
Yes. Usercentrics CMP has a free plan, per the vendor’s page captured 29 Oct 2026.
What are the best alternatives to Usercentrics CMP?
As of 3 Nov 2026, the panel rates Didomi (3.5/5), CCM19 (3.5/5) and Cookie Information (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Didomi (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Usercentrics CMP alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 15 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (17)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage usercentrics.com Checked 29 Oct 2026 Details →
- 2 Features page (website consent management) usercentrics.com Checked 29 Oct 2026 Details →
- 3 Features page (publishers and IAB TCF) usercentrics.com Checked 29 Oct 2026 Details →
- 4 Pricing page usercentrics.com Checked 29 Oct 2026 Details →
- 5 Legal notice usercentrics.com Checked 29 Oct 2026 Details →
- 6 Privacy policy usercentrics.com Checked 29 Oct 2026 Details →
- 7 Security / trust page trust.usercentrics.com Checked 29 Oct 2026 Details →
- 8 Banner & choice architecture — found from sitemap usercentrics.com Checked 29 Oct 2026 Details →
- 9 Banner & choice architecture — found from sitemap usercentrics.com Checked 29 Oct 2026 Details →
- 10 Prior blocking & script control — found from sitemap usercentrics.com Checked 29 Oct 2026 Details →
- 11 Prior blocking & script control — found from sitemap usercentrics.com Checked 29 Oct 2026 Details →
- 12 Scanning & cookie classification — found from sitemap usercentrics.com Checked 29 Oct 2026 Details →
- 13 Scanning & cookie classification — found from sitemap usercentrics.com Checked 29 Oct 2026 Details →
- 14 Consent records & proof — found from sitemap usercentrics.com Checked 29 Oct 2026 Details →
- 15 Consent records & proof — found from sitemap usercentrics.com Checked 29 Oct 2026 Details →
- 16 Frameworks, signals & platforms — found from sitemap usercentrics.com Checked 29 Oct 2026 Details →
- 17 Frameworks, signals & platforms — found from sitemap usercentrics.com Checked 29 Oct 2026 Details →