Data Protection
Usercentrics
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Usercentrics GmbH · usercentrics.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Usercentrics at a glance
- Vendor
- Usercentrics GmbH
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 13 Oct 2026
- Panel verdict
- The AI panel rates Usercentrics 2/5, the mean of 6 judges. Usercentrics GmbH is a consent management platform whose captured pages describe collecting, managing and storing user consent, plus a data subject request tool included on all paid plans at no additional cost. how scores are made
- As of
- Vendor pages captured 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Usercentrics GmbH is a consent management platform whose captured pages describe collecting, managing and storing user consent, plus a data subject request tool included on all paid plans at no additional cost. The bench scores it highest on integrations and automation at 6 to 7, crediting seventeen CMS and commerce connectors, tag managers, ad-platform consent signals, mobile SDKs and a documented consent management API, with framework coverage close behind at 6 to 7. Weakest are privacy management at 0 to 1, where the judges found no public information on a records register, DPIA tooling or technical and organizational measures; pricing transparency at 1 to 2, with Starter, Professional and Enterprise named but no price figures; and sovereignty at 1 to 2, where the only European signal found is the German entity form. Scores for rights and incidents land at 4 with no spread. Score gaps never exceed one point; the real disagreement is factual — the captured pages give different presentations of request handling, a native tool versus the partner solution MineOS, and different IAB TCF versions, 2.2 and 2.4.
Speaks for it
- Data subject request handling is included on Starter, Professional and Enterprise plans at no additional cost.
- Brandable request intake form embeds in the footer, privacy button or consent banner, with email identity verification and a built-in audit trail.
- Consent records are centralized, securely stored and described as evidence you can pull for audits or regulatory checks.
- Connector coverage spans seventeen CMS and commerce platforms, Google Tag Manager, Adobe Launch, Google and Microsoft consent modes, and mobile SDKs.
- The regulation list is broad and current — EU and UK GDPR, the revised Swiss FADP, LGPD, POPIA and recent US state laws — served by geolocation from one deployment.
Held against it
- No price figure for any plan appears on the captured pages, leaving the real invoice a sales conversation.
- We found no public information on a records-of-processing register, DPIA workflows, processor management or technical and organizational measures as product features.
- We found no public information on statutory deadline clocks, a breach register, authority notification or deletion workflows.
- We found no public information on hosting location, a published data processing agreement or a subprocessor list; the German entity form is the only European signal found.
- The captured pages give different presentations of data subject request handling — a native feature versus the partner solution MineOS — and different IAB TCF versions, 2.2 and 2.4.
Best for
- You need a consent banner platform across a large web and app estate, deployed via tag managers with consent signals to Google and Microsoft ad platforms.
- Your exposure is consumer-facing consent duties across many regimes, with geolocation serving regionally accurate banners from one configuration.
- You want working data subject request intake at no additional cost on a paid plan, live in under ten minutes with no developer work.
- Your audit risk centers on cookie-banner disputes, where centralized consent records are the evidence you must produce.
Avoid if
- You need a privacy-office suite — a records register, DPIA tooling, processor management — in the same product.
- You need breach management — a breach register, authority notification output or deletion execution — alongside consent.
- You must see price figures before engaging sales.
- Your procurement cannot proceed without public documentation of hosting location, a data processing agreement or a subprocessor list.
The scores
| Criterion | Panel median |
|---|---|
| Records & DPIA depth | 0.5 of 5 |
| Data subject rights & incidents | 2 of 5 |
| Privacy regime coverage | 3.5 of 5 |
| Audit readiness & evidence | 2 of 5 |
| Integrations & automation | 3.5 of 5 |
| European sovereignty | 1 of 5 |
| Pricing transparency | 0.5 of 5 |
Records & DPIA depth
Show reasoningHide reasoning
How this is scored
The DSMS core: records of processing (RoPA/VVT), data protection impact assessments, processor/DPA management and TOMs — how deeply the legal artifacts are modeled and connected.
0 — Document templates in a folder tree; the "register" is a Word file with version numbers in the filename.
3 — A structured RoPA with basic fields and a DPIA questionnaire, but processors, TOMs and legal bases live outside the system.
5 — RoPA and DPIA as linked modules with templates; processor management and TOM assignment exist but are shallow, and group reuse is copy-paste.
8 — A connected data model — processing activities linked to systems, processors, TOMs and legal bases — with DPIA triggers derived from the record, reusable group templates, and outputs a supervisory authority accepts.
10 — Privacy records as a system of record: the RoPA drives DPIAs, processor management and TOM coverage from one data model, multi-client/mandate capability included, and the documentation is audit-ready without manual assembly.
The External DPO
What the captured pages evidence is a website scanner that identifies data processing services and lets you set a legal basis, plus a privacy policy generator as a product line. I found no public information on a records-of-processing register, DPIA workflow, processor/DPA management or TOMs as product capability. For a consultant carrying mandates, that fragment will not hold a client's legal artifacts. 7 11 10
The In-House Counsel
The captured pages on records of processing and impact assessments are knowledge-hub articles rather than product modules; I found no public information on a processing register, a DPIA workflow, processor and DPA management, or technical and organizational measures inside the product. The nearest capability is setting the legal basis of data processing services for the consent banner, which is banner configuration, not a register of record. 2 3 7
The Drafted Generalist
This is a consent platform, and I found no public information on a records-of-processing register, a DPIA module, processor management or TOMs. The closest things on offer are a Privacy Policy Generator product and a setting to mark the legal basis for the tracking services on your website — a document and a dropdown, not a connected register. 7 10
The Lead Auditor
This is a consent platform, and the only structured legal artifact I can find is assigning the correct legal basis to the data processing services found on a website. We found no public information on a records-of-processing register, DPIA tooling, processor or agreement management, or technical and organizational measures — the pages on those topics read as educational content rather than product modules. 2 3 7
The IT Integrator
What the pages evidence is a consent engine — legal-basis configuration for the data processing services on your website and a privacy policy generator — while the RoPA and DPIA captures are educational knowledge-hub articles, not product modules. I found no public information on records of processing, DPIA workflows, processor/DPA management or TOM assignment anywhere in the suite listing. 2 3 7 10
The Skeptic
The knowledge-hub pages on records of processing and impact assessments are educational articles — their captured quotes describe cookie scanning and consent banners, and we found no public information on a records register, DPIA module, processor management or TOMs as product features. The single fragment is configuring the correct legal basis for the data processing services used on a website, which reads as consent-banner configuration rather than a records system. 2 3 7
Data subject rights & incidents
Show reasoningHide reasoning
How this is scored
The operational half of the DSMS: data subject request handling with statutory clocks, breach register and authority notification, deletion concepts that actually delete.
0 — Requests arrive by email and live there; breaches are a phone call and a memo.
3 — A request log and a breach list exist, but deadlines are manual, intake is unstructured, and deletion rules are documentation rather than workflow.
5 — DSR workflows with the Art. 12 clock tracked, structured breach register with the 72-hour clock, deletion concepts assignable to records; automation is reminders.
8 — Intake channels for requests (portal/form), identity-check support, deadline automation with escalation, breach severity assessment and authority-report output, deletion rules tied to the RoPA with execution tracking.
10 — Rights and incidents as operations: end-to-end request handling an authority audit walks through, breach workflows that produce the Art. 33 notification, and deletion automation with evidence that the deletion happened.
The External DPO
The data subject request tool is real — an embeddable, brandable intake form with email identity verification and a dashboard tracking status, submission date and request type with a built-in audit trail, with fuller DSAR management delivered through the partner MineOS. I found no public information on statutory deadline clocks or escalation, nothing on a breach register or authority notification, and no deletion workflow. The rights half stands partway; the incidents half I could not see at all. 4 5 9
The In-House Counsel
Request intake is genuinely operational — a brandable form embedded in the banner or footer, identity confirmed by email before a request reaches the dashboard, and centralized tracking of status and request type with an audit trail. But I found no public information on statutory clocks, escalation, a breach register, authority notification output, or deletion execution; the pages also describe request management both as a native feature and as a partner solution, so I would verify which one I am contracting for. 4 5 9
The Drafted Generalist
The request half is real and refreshingly simple — a brandable intake form you can embed in the footer, banner or a privacy button, email identity verification, and a dashboard tracking status, submission date and request type with a built-in audit trail, switchable on in under ten minutes at no extra cost on paid plans. But I found no public information on statutory deadline automation or escalation, and nothing on a breach register or deletion execution; one page frames DSAR handling as a partner solution (MineOS) fully integrated with the CMP, which is worth knowing before you rely on it. GDPR and CCPA/CPRA requests are supported at launch, with more regulations planned. 4 5 9
The Lead Auditor
The request side is real: embeddable brandable intake forms, email verification before a request reaches the dashboard, tracking of status, submission date and request type with a built-in audit trail, GDPR and CCPA/CPRA request types, and fuller request management delivered through the partner solution MineOS. We found no public information on a statutory deadline clock with escalation, and no public information on a breach register, 72-hour authority notification output, or deletion execution — this sits between a structured request log and clocked workflows. 4 5 9 10
The IT Integrator
The DSR half is genuinely operational: brandable embeddable intake forms, email identity verification before a request reaches the dashboard, status/type tracking with a built-in audit trail, and a toggle in the admin interface with no developer work. I found no public information on a breach register, the 72-hour authority clock, statutory deadline automation with escalation, or deletion execution tied to processing records — the incidents half of this criterion is unevidenced. 4 5 9 10
The Skeptic
The DSR side is genuinely evidenced: a brandable intake form, email verification before a request reaches the dashboard, status, submission date and request type tracked with a built-in audit trail, live on all paid plans at no additional cost. The captured pages give different presentations of DSAR handling — one describes this native feature, another delivers DSAR management through the partner solution MineOS — and we found no public information on statutory deadline clocks, a breach register, authority notification or deletion workflows. 4 5 10
Privacy regime coverage
Show reasoningHide reasoning
How this is scored
Which privacy regimes the product actually operationalizes — GDPR, BDSG, Swiss nDSG, UK GDPR, ePrivacy, EU AI Act privacy duties — and whether one record maps across them or each regime is a fresh island.
0 — One regime, hard-coded; anything else is "on the roadmap".
3 — GDPR plus one national law as separate checklists; the same processing activity is documented once per regime.
5 — The major regimes for its market with partial cross-mapping; newer duties (AI Act, ePrivacy changes) present as content packs of varying depth.
8 — Broad current coverage with one-record-many-regimes mapping and visible maintenance as regimes evolve.
10 — Regime coverage as a living product: multiple privacy regimes on one data basis, per-country variants, and documented update cadence when the law moves.
The External DPO
The regulation list is broad and visibly current — GDPR in both EU and UK variants, Switzerland's revised nFADP, LGPD, a long run of fresh US state laws, IAB TCF v2.4 and the DMA — with geolocation driving per-regime banner behavior from one configuration. That coverage is consent-side; I found no public information on BDSG or ePrivacy being operationalized, AI-related duties appear only as consent-based data access control for AI agents, and the request tool supports only CCPA/CPRA and GDPR at launch with more regulations planned. 6 7 1 11
The In-House Counsel
The regime list is broad and visibly current — EU and UK GDPR, the revised Swiss FADP, the DMA, IAB TCF, LGPD, POPIA and a run of newly enacted US state laws — with geolocation applying regionally accurate banners from one deployment. What is operationalized is consent-banner behavior rather than documentation mapping one processing activity across regimes, I found no documented update cadence, and the captured pages give different versions of the IAB TCF standard (2.2 and 2.4). 6 7 9
The Drafted Generalist
The regulations page lists an unusually current spread — GDPR for EU and UK, the revised Swiss FADP, LGPD, POPIA, a long roster of US state laws including brand-new ones like Oklahoma and Alabama, plus consent signals for Google and Microsoft — and geolocation with dynamic consent text means one deployment serves many regimes without re-documenting per market. It stops at consent duties though: I found no public information on AI Act privacy obligations or other non-consent regime content. 6 7 9 11
The Lead Auditor
The regulation catalogue is genuinely broad and current — EU and UK GDPR, the revised Swiss act, IAB TCF, the EU DMA, a shelf of recent US state laws, LGPD and POPIA — served from one configuration with geolocation delivering the regionally accurate banner. The mapping I can see operates at the consent-configuration level rather than a privacy record documented once and mapped across regimes, and we found no public information on BDSG, ePrivacy or AI Act duties. 6 7 9
The IT Integrator
Breadth is real and current-looking: the regulations page lists GDPR in both EU and UK variants, CCPA with a long tail of US state laws, the revised Swiss act, TCF, and DMA, and geolocation drives regionally accurate banners from one consent configuration rather than per-regime rebuilds. That mapping lives entirely on the consent side, though — I found no public information on BDSG variants, ePrivacy duties or AI Act privacy duties as operational content. 6 7 9 11
The Skeptic
The regulations list is long and current — GDPR EU and UK, the revised Swiss FADP, a dozen-plus US state laws including recent ones, LGPD, DMA and IAB TCF — with geolocation serving regionally accurate banners from one deployment. The captured pages give different IAB TCF versions, v2.2 on one page and v2.4 on another. We found no public information on German BDSG specifics, ePrivacy or AI Act privacy duties. 6 7 9 4
Audit readiness & evidence
Show reasoningHide reasoning
How this is scored
Whether the system produces defensible proof: revision-safe history, evidence collection, reports for auditors, authorities and management.
0 — Exports are screenshots; history is overwritten in place.
3 — PDF reports exist but evidence is attached ad hoc and changes leave no reliable trail.
5 — Versioned records, standard report generators for the core registers, evidence attachments per activity; assembling a full audit file still takes days.
8 — Revision-safe change history, audit-scoped evidence packs on demand, management and authority reports current at a click, auditor access roles.
10 — Audit readiness as a standing state: continuous documentation status per regime and scope, exportable proof packs an auditor accepts as-is, and a defensible answer to "show me the state on date X".
The External DPO
Consent records are centralized and stored as audit evidence that can be handed to a supervisory authority, and the request dashboard carries an audit trail — genuine proof, but scoped to consent and request tracking. I found no public information on revision-safe change history, auditor access roles, or management report packs beyond consent analytics. The audit-ready language on the captured pages rests on the consent log alone. 9 5 4
The In-House Counsel
Consent records are centralized, securely stored and described as suppliable to data protection authorities on demand, and the request tracker keeps an audit trail — real evidence for consent, which the GDPR obliges me to demonstrate. Beyond the consent logs, I found no public information on revision-safe change history, auditor access roles, report generators, or evidence packs covering the wider compliance file. 2 4 5 9
The Drafted Generalist
Consent records are centralized, securely stored and describable as audit evidence that can be handed to a data protection authority, and the request dashboard keeps an audit trail — exactly the proof you need for a cookie-banner dispute, and the free scanner gives you a risk picture up front. Beyond consent logs I found no public information on revision-safe change history, audit-scoped evidence packs, auditor access roles or management reports. 4 5 9 11
The Lead Auditor
Consent proof is the one register this system keeps properly: records are centralized and securely stored, described as pullable for authorities and for subject requests, with cookie scanning framed as audit-ready record-keeping and an audit trail on the request dashboard. Beyond consent we found no public information on revision-safe change history, on-demand evidence packs, auditor access roles, or any way to reconstruct the state on a given date. 2 4 9
The IT Integrator
Consent records are centralized, securely stored and can be supplied to data protection authorities, and the DSR dashboard carries an audit trail — defensible evidence for the consent register specifically, which the vendor frames as audit-ready record-keeping. I found no public information on revision-safe change history across records, audit-scoped evidence packs, auditor access roles, or reconstructing the state on a given date. 2 4 9
The Skeptic
Consent evidence is the one defensible piece: centralized, securely stored consent records described as ready for audits or regulatory checks, audit-ready consent logs, and an audit trail on the DSR dashboard. Beyond the consent record, we found no public information on revision-safe change history, auditor access roles, evidence packs, or answering what the state was on a given date — the captured phrase about audit-ready record-keeping refers to consent, not a full program file. 9 4 5 11
Integrations & automation
Show reasoningHide reasoning
How this is scored
Whether the platform feeds from the real IT estate — directory import, ticketing, API — and automates the recurring privacy work instead of re-typing it.
0 — A closed island: manual entry in, PDF out, no API.
3 — CSV/Excel import and export; no live connections, no API worth the name.
5 — Directory import (AD/Entra), a documented REST API for core objects, a handful of native connectors (ticketing or SSO); automation is reminders and recurrence.
8 — Real connector set (ticketing, HR or asset sources), webhooks, SSO/SCIM, workflow automation with delegation and escalation, useful AI assistance with human review.
10 — The platform behaves like infrastructure: API parity for the data model, event streams, bidirectional sync with the estate, and automation that measurably removes the recurring toil (reviews, attestations, evidence pulls) rather than renaming it.
The External DPO
The connector surface is unusually wide for this category — seventeen CMS and commerce platforms, tag managers, ad-tech consent signals, mobile SDKs — plus a documented consent management API built for partners running hundreds to tens of thousands of sites. The connections serve consent delivery rather than estate ingestion: I found no public information on directory import, ticketing or HR sources, SSO/SCIM or webhooks, and the automation shown is consent collection and reporting rather than recurring privacy-office toil. 10 11 7
The In-House Counsel
The connector set is real within its estate: seventeen-odd CMS and commerce platforms, Google Tag Manager and Adobe Launch, Google and Microsoft consent signaling, mobile SDKs, and a documented consent management API scaling across thousands of sites, with activation that needs no developer work. Beyond that I found no public information on directory or HR feeds, webhooks, single sign-on, or delegated escalation workflows. 7 9 10 11
The Drafted Generalist
This is where a consent platform earns its keep: seventeen CMS and shop platforms, Google Tag Manager and Adobe Launch, consent signals to the big ad platforms, mobile SDKs, and a documented Consent Management API the pages say can run banners across hundreds to tens of thousands of sites — with no coding for the standard script-tag or tag-manager setup. What I did not find is directory import, single sign-on, SCIM, webhooks or ticketing connections; the automation here is consent signalling and banner logic, not delegated case workflows. 7 10 11
The Lead Auditor
The connector footprint is the strongest part of the estate: dozens of native integrations across CMS platforms, tag managers, ad tech with consent signaling, A/B testing and mobile SDKs, plus a consent management API that claims to manage banners across hundreds to tens of thousands of websites, with automatic blocking of third-party collection absent consent. We found no public information on directory, ticketing, HR or asset sources, on SSO or SCIM, or on webhooks and event streams. 7 9 10 11
The IT Integrator
This is the platform's strongest suit for the web estate: a documented developer API with a testing environment, seventeen-plus CMS connectors, tag managers, ad-platform consent signals, mobile SDKs and script or tag-manager installation — live connections, not a CSV drawbridge. But nothing on the connector surface feeds the corporate estate: I found no public information on directory import from Entra ID, ticketing, HR or asset sources, SSO/SCIM or webhooks, and the API is scoped to consent management rather than parity with the full data model. 7 10 11
The Skeptic
The connector evidence is real and extensive: seventeen-plus CMS and shop platforms, Google Tag Manager and Adobe Launch, Google and Microsoft consent modes, mobile SDKs from Flutter to Adjust, plus a documented Consent Management API positioned for hundreds to tens of thousands of websites. Automation is substantive rather than reminders — Smart Data Protector blocks third-party tools until users consent, and consent signals flow to ad platforms automatically. We found no public information on directory or HR sources, SSO/SCIM, webhooks or ticketing integration. 10 11 9 7
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where the compliance record of the whole company actually lives and under whose law — entity, hosting, subprocessors, DPA. A platform that maps your processing is itself your most concentrated processing.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for the system holding your RoPA.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The External DPO
The vendor trades as Usercentrics GmbH and the captured pages name the German entity form, but that is the whole of what I can see. I found no public information on the governing jurisdiction, hosting locations, subprocessor list or a published DPA. For a platform that maps a client's consent estate, an undocumented chain is not something I can put in front of thirty mandates. 2 1
The In-House Counsel
The vendor presents as a German GmbH, which is a start, but I found no public information on hosting location, ownership, a subprocessor list or a published data processing agreement. This platform centrally stores the consent records themselves, which is concentrated processing under my map, so that documentation set would have to be on the table before I could defend the engagement. 2 9
The Drafted Generalist
For a platform reporting 8.8 billion consents a month, I found no public information on where that data is hosted, which subprocessors touch it, or the data processing agreement terms. The only European signal in the captured pages is the German legal form in the company name; on the rest of the chain a buyer is being asked to trust first and ask sales later. 2 11
The Lead Auditor
The only jurisdictional signal on the captured pages is the German company form in the author byline; we found no public information on hosting location or data residency, a published data processing agreement, or a subprocessor list. For a system that centralizes consent records as audit evidence, that silence is the whole story for now. 2 9
The IT Integrator
The support article byline names the vendor as a GmbH, which points at a German entity, and there the trail ends. I found no public information on hosting location, ownership, a published DPA or a subprocessor list — for a platform that would hold your compliance record, that silence is itself the finding. 2
The Skeptic
The vendor name carries a German legal form, but on the captured pages every sovereignty fact is absent: we found no public information on hosting location, named data centers, a published DPA, TOMs or a subprocessor list — for a platform whose business is centralizing consent records and DSAR traffic. A compliance vendor with an undocumented chain of its own belongs at the bottom of this measure; the German entity form is the only European signal found. 1
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real invoice — per module, per entity, per year, with consulting unbundled — from public pages alone. Unpublished pricing is the B2B norm in this market, so this criterion describes rather than condemns; the benches weight it accordingly.
0 — No public prices at all; every configuration is a sales conversation.
3 — An entry price exists, but module add-ons, entity counts or bundled consulting make the real total incomputable.
5 — Most editions carry real numbers with billing period stated and software separated from services; at least one commonly needed module or scale step is unpriced.
8 — Every edition and module priced publicly with entity/user boundaries and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: modules, scale steps, service packages and renewal rules public, so the invoice for a 100-employee company and a 10-client consultancy is a two-minute exercise.
The External DPO
The captured pages name three tiers — Starter, Professional and Enterprise — state that the request tool is included on all paid plans at no additional cost, and describe a fourteen-day trial limited to one privacy regulation on one domain. No figure for any plan or module appears anywhere, so the real invoice stays a sales conversation; I found no public information on per-domain or per-mandate scale pricing. 4 9 1 11
The In-House Counsel
The pages name Starter, Professional and Enterprise plans, confirm request handling is included at no additional cost on all of them, and describe a 14-day trial on one regulation and one domain. We found no public price figures for any edition, module or scale step — only a stated intent of competitive pricing designed for scalability — so the real invoice remains a sales conversation. 1 4 9 11
The Drafted Generalist
I found no public prices at all — only tier names (Starter, Professional, Enterprise), a free compliance scanner, and a 14-day free trial covering one privacy regulation on one domain. The one cost fact I can hold onto is that request handling is included on all paid plans at no additional cost; the actual invoice remains a sales conversation. 1 4 9
The Lead Auditor
The plan ladder is public by name — Starter, Professional and Enterprise — and one boundary is stated outright: request handling is included on all paid plans at no additional cost, with a 14-day trial scoped to one privacy regulation on one domain. We found no public figures for those plans, so the real invoice remains a sales conversation. 1 4 9
The IT Integrator
Plan names are public — Starter, Professional, Enterprise — with DSR stated as included on all paid plans at no additional cost, a 14-day free trial on Web CMP and a free start advertised without a credit card. Not one price figure appears anywhere, so the real invoice stays a sales conversation; the only pricing language is 'competitive pricing designed for scalability'. 1 4 9 11
The Skeptic
No price figure appears anywhere in the captures: Starter, Professional and Enterprise are named, and DSR is stated as included on those plans at no additional cost, but no edition, module or user count carries a number. The only concretely defined commercial terms are the free trial's scope — fourteen days, one regulation, one domain — and the phrase about competitive pricing designed for scalability, which is a sentence rather than a price. Computing any real invoice requires a sales conversation. 4 9 11 1
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Questions about Usercentrics
Is Usercentrics European?
Not determined: the vendor’s pages as captured do not say where Usercentrics is based.
Where does Usercentrics store data?
Not stated on the vendor’s pages as of 13 Oct 2026.
Does Usercentrics have a free plan?
Yes. Usercentrics has a free plan, per the vendor’s page captured 13 Oct 2026.
What are the best alternatives to Usercentrics?
As of 21 Oct 2026, the panel rates preeco | datenschutz (4/5), Dastra (3/5) and caralegal (3/5) highest among the other 41 Data Protection products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is preeco | datenschutz (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Usercentrics alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 13 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 21 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (11)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page usercentrics.com Checked 13 Oct 2026 Details →
- 2 Records & DPIA depth — found from sitemap usercentrics.com Checked 13 Oct 2026 Details →
- 3 Records & DPIA depth — found from sitemap usercentrics.com Checked 13 Oct 2026 Details →
- 4 Data subject rights & incidents — found from sitemap usercentrics.com Checked 13 Oct 2026 Details →
- 5 Data subject rights & incidents — found from sitemap usercentrics.com Checked 13 Oct 2026 Details →
- 6 Privacy regime coverage — found from sitemap usercentrics.com Checked 13 Oct 2026 Details →
- 7 Privacy regime coverage — found from sitemap usercentrics.com Checked 13 Oct 2026 Details →
- 8 Audit readiness & evidence — found from sitemap usercentrics.com Checked 13 Oct 2026 Details →
- 9 Audit readiness & evidence — found from sitemap usercentrics.com Checked 13 Oct 2026 Details →
- 10 Integrations & automation — found from sitemap usercentrics.com Checked 13 Oct 2026 Details →
- 11 Integrations & automation — found from sitemap usercentrics.com Checked 13 Oct 2026 Details →