# Didomi — Data Protection

Didomi by Didomi SAS holds a panel rating of 1.5/5 from 6 AI judges (category median 2.5/5), as of 2026-10-15. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: Didomi SAS (https://didomi.io)
- Category: [Data Protection](https://whats-best.ai/software/data-protection.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/data-protection/didomi
- Alternatives: https://whats-best.ai/software/data-protection/didomi/alternatives ([markdown](https://whats-best.ai/software/data-protection/didomi/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Didomi SAS
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026

## The panel's verdict

Didomi presents as a privacy platform for consent and preference management, and the scores follow that shape: strongest on framework coverage and audit readiness (both 5 to 6), weakest on privacy management (0 to 1). The credit sits in consent mechanics — up to 21 regulations (GDPR, noted Law-25 compliant, plus 20 US state laws) configurable on a single notice with per-territory settings and GPP mapping, and consent proofs stored five years, retrievable within 24 hours of collection for an end-user's request or a supervisory audit, with the full consent base and notice versions exportable via API. The weakness is the legal core: we found no public information on records of processing, DPIA workflows, processor and DPA management, or TOMs, and the captured incident pages describe the vendor's own uptime monitoring rather than client-side breach handling. The one-point spreads on framework coverage and audit readiness reflect how far to credit consent-shaped breadth; rights and incidents and sovereignty each scored a uniform 2. Pricing shows only as a demo request and a monthly report allotment.

**Speaks for it:**
- Up to 21 regulations — GDPR (Law-25 Compliant) plus 20 US state laws — configurable on a single notice with per-territory settings, vendors, GPP mapping, and purposes and categories
- Consent proofs stored five years and retrievable within 24 hours of collection, individually for an end-user's request or a supervisory audit
- Full consent-base export via API, notice versions retrievable via API, and a daily batch export of end-user consent information
- Vendor support can supply individual proofs of consent for all of an organization's end-users plus the notice configurations for a domain under supervisory review
- Consent-signal frameworks documented by vendor (IAB TCF, Google Consent Mode, Microsoft Consent Mode, Amazon Consent Signal, WordPress Consent API) and by country/region (GPP, Google Consent Mode, GPC)

**Held against it:**
- We found no public information on records of processing, DPIA workflows, processor and DPA management, or TOMs — the lowest-scoring area at 0 to 1
- We found no public information on request workflows with statutory clocks, a breach register, or deletion execution; the captured incident pages describe the vendor's own uptime and response-time monitoring
- We found no public information on hosting region, a published DPA, or a subprocessor list for a system holding five years of consent proofs; monitoring tools named include AWS CloudFront and New Relic
- We found no public information on directory import, SSO/SCIM, webhooks, or ticketing and asset connectors — the documented automation surface is consent export
- We found no public information on European regimes beyond GDPR — UK GDPR, Swiss nDSG, ePrivacy, AI Act duties — or on a documented update cadence when the law moves

**Best for:**
- You operate consent notices under the GDPR and multiple US state privacy laws and want one notice carrying up to 21 regulations with per-territory settings and GPP mapping
- You must answer a supervisory authority with individual consent proofs for your end-users plus the notice configurations for the domain under review
- You need long-hold, exportable consent evidence — five-year retention, retrieval within 24 hours of collection, full consent-base export via API and a daily batch export
- Your records of processing, DPIAs and TOMs already live elsewhere and you are buying a consent and preference platform rather than a full data protection management system

**Avoid if:**
- You expect one tool to keep your records of processing, DPIA workflows, processor management and TOMs — the captured pages present Didomi throughout as a consent and preference platform
- Your rights program needs request intake with statutory clocks, a breach register and deletion execution — the incident pages captured describe Didomi's own uptime and response-time monitoring
- You must verify hosting region, a published DPA and the subprocessor list before signing — ask the vendor: the public pages we read do not show it
- Your automation plan depends on directory import, SSO/SCIM, webhooks or ticketing connectors — the documented surface is a consent API, notice-version retrieval and a daily batch export

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v2). "n/r" = not rated: the vendor publishes no price.

| Criterion | The External DPO | The In-House Counsel | The Drafted Generalist | The Lead Auditor | The IT Integrator | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Records & DPIA depth | 0.5/5 | 0/5 | 0/5 | 0/5 | 0/5 | 0/5 |
| Data subject rights & incidents | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 |
| Privacy regime coverage | 3/5 | 2.5/5 | 2.5/5 | 3/5 | 3/5 | 2.5/5 |
| Audit readiness & evidence | 2.5/5 | 3/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 |
| Integrations & automation | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| European sovereignty | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **1.5/5** | **1.5/5** | **1/5** | **2/5** | **1.5/5** | **1.5/5** |

### The judges

- **The External DPO** (v2.0): Carries thirty client mandates and bills by the hour they save. Optimizes for multi-client capability, reusable templates, a RoPA that drives the rest, and client-ready reports. Rejects single-tenant tools that treat the consultancy as thirty separate customers.
- **The In-House Counsel** (v2.0): Answers personally when the authority writes. Optimizes for defensibility: request clocks that never slip, a breach workflow that produces the Art. 33 notification, regime coverage that matches where the company actually operates. Rejects tools whose legal content nobody maintains.
- **The Drafted Generalist** (v2.1): Office manager at an 80-employee firm who got compliance added to her job title, not her calendar. Optimizes for guided workflows in plain language and software that knows the law so she does not have to. Rejects consultant-shaped platforms that assume a compliance department.
- **The Lead Auditor** (v2.0): Audits management systems for a living and has seen every folder of screenshots. Optimizes for revision-safe history, evidence packs on demand, and a defensible answer to "show me the state on date X". Rejects systems where the audit trail is assembled the week before the audit.
- **The IT Integrator** (v2.0): Has to feed the compliance platform from the estate that already exists: Entra ID, Jira, the CMDB. Optimizes for directory import, a real API, webhooks and SSO — compliance data that stays current because it syncs, not because someone retypes it. Rejects data islands with a CSV drawbridge.
- **The Skeptic** (v2.1): Hunts certification logos that link nowhere, "AI-powered" features with no substance behind them, consulting bundled as software, legal-update promises with no named lawyer, and customer counts that disagree between pages. Exists to keep the rest of the bench honest.

## European sovereignty — proven facts

No sovereignty finding yet.

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Data**
- Consent proof retention: 5 · 24 [S6]

**Legal**
- Copyright entity: Didomi SAS [S2]

**Pricing**
- Consent proof report limit: both found and not-found requests count towards allotment · 10 [S7]

**Product**
- Access type: Consent Proof Reports - Viewer [S7]
- Allotment balance location: Allotment balance viewable under Versions & Proofs > Notice Versions tab, tracked in the Reports generated section [S7]
- Batch export alternative: Didomi batch export feature provides daily information about end-user consent [S7]
- Clients count: 2000 [S1]
- Consent base API export: api [S6]
- Consent proof definition: A consent proof is a record of an individual's consent selections in response to a consent notice published on a website or application. [S7]
- Consent proof retrievability: yes [S6]
- Consent proof storage: yes [S6]
- Consent volume monitoring: consents collected per property monitored against historical trends [S2]
- Demo cta: yes [S1]
- Distributed dev team: yes [S2]
- Frameworks availability dependent: Available frameworks depend on the regulation's data collection scope (by vendor or by country/region). [S4]
- Frameworks definition: Optional industry-recognized standards for recording, storing, and/or transmitting an end-user's consent status, added to a regulation so requisite data objects and/or APIs are loaded. [S4]
- Frameworks region scope: by country/region · Global Privacy Protocol (GPP) · Google Consent Mode · Global Privacy Control (GPC) [S4]
- Frameworks vendor scope: by vendor · IAB TCF · Google Consent Mode · Microsoft Consent Mode · Amazon Consent Signal · WordPress Consent API [S4]
- Monitored elements: Overall health of servers, applications and content delivery network [S2]
- Monitoring 24 7: AWS CloudFront · New Relic · yes [S2]
- Notice versions API: api [S6]
- Overview: privacy platform for consent & preference management [S1]
- Redundant infrastructure: yes [S2]
- Regulation definition: A regulation is a set of settings applied to a notice in the configured territories [S5]
- Regulation limit per notice: 21 [S5]
- Regulation settings: applicable_territories · vendors · gpp_mapping · purposes_and_categories · additional_settings [S5]
- Response time monitoring: consent read/write requests · average · 95 · 99 · 99.9 [S2]
- Supervisory authority support: yes [S6]
- Supported regulations: 21 · GDPR (Law-25 Compliant) · CPA · CPRA · CTDPA · DPDPA · FDBR · INCDPA · ICDPA · Kentucky Consumer Data Protection Act · MODPA · MNCDPA · MCDPA · NDPA · NHPA · NJDPA · OCPA · RIDTPPA · TIPA · TDPSA · UCPA · VCDPA [S5]

## Questions

### Is Didomi European?

Not determined: the vendor’s pages as captured do not say where Didomi is based.

### Where does Didomi store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Didomi have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to Didomi?

As of 21 Oct 2026, the panel rates [preeco | datenschutz (4/5)](https://whats-best.ai/software/data-protection/preeco), [Dastra (3/5)](https://whats-best.ai/software/data-protection/dastra) and [caralegal (3/5)](https://whats-best.ai/software/data-protection/caralegal) highest among the other 41 Data Protection products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [preeco | datenschutz](https://whats-best.ai/software/data-protection/preeco) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Didomi alternatives](https://whats-best.ai/software/data-protection/didomi/alternatives).

## What this page leaves out

- We could not confirm any compliance information on the vendor’s own pages as captured, so this page shows none rather than a statement we cannot stand behind.
- 15 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor page: https://didomi.io (checked 2026-10-13)
- [S2] Data subject rights & incidents — found from sitemap: https://support.didomi.io/incident-management/support-provided-by-didomi (checked 2026-10-13)
- [S3] Data subject rights & incidents — found from sitemap: https://docs.didomi.io/organization-and-account-settings/account-settings-and-support/service-level-agreement-sla-and-incident-management (checked 2026-10-13)
- [S4] Privacy regime coverage — found from sitemap: https://docs.didomi.io/regulations-manager/frameworks (checked 2026-10-13)
- [S5] Privacy regime coverage — found from sitemap: https://docs.didomi.io/consent-management-platform-cmp/frameworks-regulations (checked 2026-10-13)
- [S6] Audit readiness & evidence — found from sitemap: https://docs.didomi.io/versions-and-proofs/consent-proofs-reports (checked 2026-10-13)
- [S7] Audit readiness & evidence — found from sitemap: https://docs.didomi.io/versions-and-proofs/consent-proofs-reports/consent-proof-report-limit (checked 2026-10-13)
- [S8] Integrations & automation — found from sitemap: https://docs.didomi.io/integrations/introduction (checked 2026-10-13)
- [S9] Integrations & automation — found from sitemap: https://developers.didomi.io/integrations/tutorials (checked 2026-10-13)

---

Cite as: whats-best.ai, "Didomi — Data Protection", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/data-protection/didomi

Corrections: https://whats-best.ai/correct/698?target=page