# Usercentrics — Data Protection

Usercentrics by Usercentrics GmbH holds a panel rating of 2/5 from 6 AI judges (category median 2.5/5), as of 2026-10-15. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: Usercentrics GmbH (https://usercentrics.com)
- Category: [Data Protection](https://whats-best.ai/software/data-protection.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/data-protection/usercentrics
- Alternatives: https://whats-best.ai/software/data-protection/usercentrics/alternatives ([markdown](https://whats-best.ai/software/data-protection/usercentrics/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Usercentrics GmbH
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Yes, per the vendor’s own page [S1]

## The panel's verdict

Usercentrics GmbH is a consent management platform whose captured pages describe collecting, managing and storing user consent, plus a data subject request tool included on all paid plans at no additional cost. The bench scores it highest on integrations and automation at 6 to 7, crediting seventeen CMS and commerce connectors, tag managers, ad-platform consent signals, mobile SDKs and a documented consent management API, with framework coverage close behind at 6 to 7. Weakest are privacy management at 0 to 1, where the judges found no public information on a records register, DPIA tooling or technical and organizational measures; pricing transparency at 1 to 2, with Starter, Professional and Enterprise named but no price figures; and sovereignty at 1 to 2, where the only European signal found is the German entity form. Scores for rights and incidents land at 4 with no spread. Score gaps never exceed one point; the real disagreement is factual — the captured pages give different presentations of request handling, a native tool versus the partner solution MineOS, and different IAB TCF versions, 2.2 and 2.4.

**Speaks for it:**
- Data subject request handling is included on Starter, Professional and Enterprise plans at no additional cost.
- Brandable request intake form embeds in the footer, privacy button or consent banner, with email identity verification and a built-in audit trail.
- Consent records are centralized, securely stored and described as evidence you can pull for audits or regulatory checks.
- Connector coverage spans seventeen CMS and commerce platforms, Google Tag Manager, Adobe Launch, Google and Microsoft consent modes, and mobile SDKs.
- The regulation list is broad and current — EU and UK GDPR, the revised Swiss FADP, LGPD, POPIA and recent US state laws — served by geolocation from one deployment.

**Held against it:**
- No price figure for any plan appears on the captured pages, leaving the real invoice a sales conversation.
- We found no public information on a records-of-processing register, DPIA workflows, processor management or technical and organizational measures as product features.
- We found no public information on statutory deadline clocks, a breach register, authority notification or deletion workflows.
- We found no public information on hosting location, a published data processing agreement or a subprocessor list; the German entity form is the only European signal found.
- The captured pages give different presentations of data subject request handling — a native feature versus the partner solution MineOS — and different IAB TCF versions, 2.2 and 2.4.

**Best for:**
- You need a consent banner platform across a large web and app estate, deployed via tag managers with consent signals to Google and Microsoft ad platforms.
- Your exposure is consumer-facing consent duties across many regimes, with geolocation serving regionally accurate banners from one configuration.
- You want working data subject request intake at no additional cost on a paid plan, live in under ten minutes with no developer work.
- Your audit risk centers on cookie-banner disputes, where centralized consent records are the evidence you must produce.

**Avoid if:**
- You need a privacy-office suite — a records register, DPIA tooling, processor management — in the same product.
- You need breach management — a breach register, authority notification output or deletion execution — alongside consent.
- You must see price figures before engaging sales.
- Your procurement cannot proceed without public documentation of hosting location, a data processing agreement or a subprocessor list.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v2). "n/r" = not rated: the vendor publishes no price.

| Criterion | The External DPO | The In-House Counsel | The Drafted Generalist | The Lead Auditor | The IT Integrator | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Records & DPIA depth | 0.5/5 | 0/5 | 0.5/5 | 0.5/5 | 0.5/5 | 0.5/5 |
| Data subject rights & incidents | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Privacy regime coverage | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | 3/5 |
| Audit readiness & evidence | 2/5 | 2/5 | 2/5 | 2.5/5 | 2/5 | 2/5 |
| Integrations & automation | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 |
| European sovereignty | 1/5 | 1/5 | 1/5 | 0.5/5 | 1/5 | 1/5 |
| Pricing transparency | 1/5 | 0.5/5 | 0.5/5 | 0.5/5 | 0.5/5 | 0.5/5 |
| **Weighted verdict** | **1.5/5** | **2/5** | **1.5/5** | **2/5** | **2/5** | **1.5/5** |

### The judges

- **The External DPO** (v2.0): Carries thirty client mandates and bills by the hour they save. Optimizes for multi-client capability, reusable templates, a RoPA that drives the rest, and client-ready reports. Rejects single-tenant tools that treat the consultancy as thirty separate customers.
- **The In-House Counsel** (v2.0): Answers personally when the authority writes. Optimizes for defensibility: request clocks that never slip, a breach workflow that produces the Art. 33 notification, regime coverage that matches where the company actually operates. Rejects tools whose legal content nobody maintains.
- **The Drafted Generalist** (v2.1): Office manager at an 80-employee firm who got compliance added to her job title, not her calendar. Optimizes for guided workflows in plain language and software that knows the law so she does not have to. Rejects consultant-shaped platforms that assume a compliance department.
- **The Lead Auditor** (v2.0): Audits management systems for a living and has seen every folder of screenshots. Optimizes for revision-safe history, evidence packs on demand, and a defensible answer to "show me the state on date X". Rejects systems where the audit trail is assembled the week before the audit.
- **The IT Integrator** (v2.0): Has to feed the compliance platform from the estate that already exists: Entra ID, Jira, the CMDB. Optimizes for directory import, a real API, webhooks and SSO — compliance data that stays current because it syncs, not because someone retypes it. Rejects data islands with a CSV drawbridge.
- **The Skeptic** (v2.1): Hunts certification logos that link nowhere, "AI-powered" features with no substance behind them, consulting bundled as software, legal-update promises with no named lawyer, and customer counts that disagree between pages. Exists to keep the rest of the bench honest.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Regulations covered: Footer lists supported regulations: GDPR (EU), GDPR (UK), CCPA, TCF v2.4 (IAB), DMA (EU), Amazon Consent Signal, Google Consent Mode (EU), Microsoft UET Consent Mode (EU), Microsoft Clarity Consent Mode [S3]
- Regulations covered: GDPR (EU) · GDPR (UK) · CCPA (California) · TCF v2.4 (IAB) · DMA (EU) · Amazon Consent Signal · Google Consent Mode (EU) · Microsoft UET Consent Mode (EU) · Microsoft Clarity Consent Mode [S7]

**Integrations**
- Ab testing: Kameleoon · Optimizely [S10]
- Ad tech platforms: Signals user consent to advertising platforms; includes Google Consent Mode, Google Ads, Microsoft UET Consent Mode, Microsoft Advertising [S10]
- Cms platforms: WordPress · Shopify · Wix · Privacy Policy Generator WordPress · Hubspot · Square · Duda · Shopware · eRecht24 · Joomla · Webflow · Squarespace · GoDaddy · Drupal · TYPO3 · Magento · WooCommerce · no [S10]
- Cms support: yes · yes · yes [S7]
- Dsr tool: DSR management integration with MineOS [S10]
- Mobile app sdks: Flutter · Unity Ads · Adjust · AppLovin · ironSource · Crashlytics · Chartboost [S10]
- Tag management: Google Tag Manager · Adobe Launch [S10]

**Legal**
- Copyright entity: 2026 · Usercentrics GmbH [S4]
- Entity: Usercentrics GmbH [S3]
- Entity: Usercentrics GmbH [S7]
- Entity: Usercentrics GmbH [S6]
- Entity: Usercentrics GmbH [S10]
- Publisher: Tilman Harmeling · Usercentrics GmbH [S8]

**Pricing**
- Business plan: 10 · USD · unlimited · 50000 · 56 [S9]
- Corporate plan: unlimited · unlimited · 1000000 · yes [S9]
- Essential plan: 1 · USD · 1 · 1500 · 8 [S9]
- Free trial: yes · 14 [S5]
- Plus plan: 1 · USD · unlimited · 3000 · 16 [S9]
- Pro plan: 3 · USD · unlimited · 15000 · 34 [S9]
- Trial length: 14 · yes [S4]

**Product**
- Analytics optimization: yes [S7]
- Analytics reporting: Analytics and reporting on user interactions and consent rates [S9]
- API purpose: Consent Management API for embedding CMP into platforms, for website builders and digital agencies [S11]
- Article scope: 13 [S8]
- Automation: yes [S11]
- Categories: CMS and Website Builders · Tag Management · Ad tech platforms · Mobile Apps · DSR · A/B Testing [S10]
- Cmp capabilities: geo-localized banners, cross-device syncing, and regulation-specific tooling [S2]
- Cmp functions: collect · manage · store consent and privacy preferences [S7]
- Cmp GDPR: Usercentrics CMP enables meeting evolving GDPR compliance requirements [S7]
- Cmp platforms: CMP automates cookie scanning, consent collection, and audit-ready record-keeping [S2]
- Cobranded banner: yes [S11]
- Compliance scanner: Free privacy compliance scanner for websites and apps [S1]
- Configurable banner: yes [S7]
- Consent management: Usercentrics offers a consent management solution [S3]
- Consent management modules: Consent banners customized for geography, regulations, consent choices, DSARs, audit-ready consent logs [S5]
- Consent platform: CMP that collects, manages, securely stores, and signals user consent in accordance with GDPR, CCPA, LGPD, and POPIA [S9]
- Consent records storage: Centralizes and securely stores consent records as audit evidence [S9]
- Consent storage: yes [S11]
- Consent withdrawal: yes [S11]
- Customization: Banner tailoring by user location, language, or website content [S11]
- Data privacy audit: Data privacy audit: scan website for cookies and trackers to understand compliance risk level [S9]
- Dma consent: yes [S7]
- Dsar admin interface: Usercentrics solution provides an Admin Interface for tracking and centralized management of DSARs [S5]
- Dsar alternatives named: Named DSAR solutions: MineOS DSR, DataGrail, Ketch [S5]
- Dsar features: DSAR solution features customizable intake forms, secure data handling, and automation [S5]
- Dsar partner solution: DSAR management delivered via partner solution MineOS DSR, fully integrated with Usercentrics CMP [S5]
- Dsar support: Stored consent records can be supplied to data protection authorities or for DSARs [S9]
- Dsr availability: yes · all paid plans [S4]
- Dsr brandable form: yes [S4]
- Dsr dashboard audit trail: status · submission_date · request_type · yes [S4]
- Dsr email verification: yes [S4]
- Dsr embed options: footer · privacy button · consent banner [S4]
- Dsr no extra cost: Starter · Professional · Enterprise · no [S4]
- Dsr setup no developer: no · yes [S4]
- Dsr setup time: under ten minutes [S4]
- Dsr supported regulations: CCPA/CPRA · GDPR · yes [S4]
- Dynamic consent text: yes [S11]
- Free audit scan: free website scan report of cookies and trackers with privacy compliance risk level [S9]
- Free tier: free start / demo, no credit card required · yes [S1]
- Free trial: free trial · yes [S7]
- Free trial: one privacy regulation on one domain · Web CMP · yes · 14 [S9]
- Geolocation: Geolocation-based regionally accurate consent banners with preferred language [S9]
- Google consent mode: Google Consent Mode adjusts Google tags based on user consent status [S11]
- Granular consent: yes [S11]
- Implementation time: 7 · customer quote [S7]
- Installation methods: direct script tag · Google Tag Manager · SDK for mobile apps [S7]
- Integrations surface: Footer lists Web compliance scan, App compliance scan, and an Integrations entry [S9]
- Legal basis config: yes [S7]
- Newsletter available: yes [S3]
- Optimization features: A/B Testing · Contextual Consent [S7]
- Platform: Platform manages consent across website and app, sends signals to ad platforms and analytics, controls data access for AI agents [S1]
- Prebuilt banners: yes [S11]
- Pricing model: Competitive pricing designed for scalability; partner owns customer relationship [S11]
- Product suite: Web CMP, App CMP, CTV CMP, Privacy Policy Generator, Server-side Tagging Solution [S11]
- Products: Web CMP · App CMP · CTV CMP · Privacy Policy Generator · Server-side Tagging Solution [S10]
- Products list: Usercentrics Web CMP · Usercentrics App CMP · Usercentrics CTV CMP · Usercentrics Privacy Policy Generator · Server-side Tagging Solution [S3]
- Products list: Web CMP · App CMP · CTV CMP · Privacy Policy Generator · Server-side Tagging Solution [S7]
- Products list: Web CMP · App CMP · CTV CMP · Privacy Policy Generator · Server-side Tagging Solution [S9]
- Purpose: Connects Usercentrics to CMS, CRM, and analytics tools for privacy compliance and consent management [S10]
- Regional frameworks: LGPD (Brazil) · CCPA (California) · IAB TCF v2.2 [S7]
- Regulations: GDPR, CCPA and more [S2]
- Regulations africa count: 1 · Africa [S6]
- Regulations apdpa: Alabama Personal Data Protection Act [S6]
- Regulations asia pacific count: 2 · Asia Pacific [S6]
- Regulations canada count: 1 · Canada [S6]
- Regulations europe UK count: 8 · Europe and UK [S6]
- Regulations footer list: GDPR (EU) · GDPR (UK) · CCPA (California) · TCF v2.4 (IAB) · DMA (EU) · Amazon Consent Signal · Google Consent Mode (EU) · Microsoft UET Consent Mode (EU) · Microsoft Clarity Consent Mode [S6]
- Regulations ldpa: Louisiana Data Privacy Act [S6]
- Regulations nfadp: Switzerland's Federal Act on Data Protection (revised) [S6]
- Regulations ocdpa: Oklahoma Consumer Data Privacy Act [S6]
- Regulations ri dtppa: Rhode Island Data Transparency and Privacy Protection Act (RI-DTPPA) [S6]
- Regulations south america count: 1 · South America [S6]
- Regulations supported: Regulations listed include GDPR (EU), GDPR (UK), CCPA (California), TCF v2.4 (IAB), DMA (EU), Google Consent Mode (EU), Microsoft UET Consent Mode (EU) [S9]
- Regulations tdpsa: Texas Data Privacy and Security Act [S6]
- Regulations tipa: Tennessee Information Protection Act [S6]
- Regulations ucpa: Utah Consumer Privacy Act [S6]
- Regulations UK GDPR: UK General Data Protection Regulation [S6]
- Regulations US federal count: 4 · United States (federal) [S6]
- Regulations vcdpa: Virginia Consumer Data Protection Act [S6]
- Regulations vppa: Video Privacy Protection Act [S6]
- Regulations wmhmda: Washington My Health My Data Act [S6]
- Reseller model: yes [S11]
- Scale: Supports hundreds to tens of thousands of websites [S11]
- Scale stats: 195 · 8800000000 · 2400000 · 99 [S11]
- Scan tools: Web compliance scan · App compliance scan [S7]
- Smart data protector: Smart Data Protector prevents third-party tools from collecting user data without explicit consent [S9]
- Target platforms: Website CMS, ecommerce platforms, landing page builders, hosters, large agencies, full-service providers, B2B SaaS companies, legal-tech SaaS solutions [S11]
- Website audit tool: Data privacy audit / compliance scan offered (CTA) [S3]

**Support**
- Article metadata: Strategy & Market Intelligence, Usercentrics GmbH · Tilman Harmeling · 2025-02-07 · 10 [S2]
- Dedicated partner manager: yes [S11]
- Docs: yes [S10]
- Partner docs: yes · yes [S11]
- Partner technical specialists: yes [S11]

## Questions

### Is Usercentrics European?

Not determined: the vendor’s pages as captured do not say where Usercentrics is based.

### Where does Usercentrics store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Usercentrics have a free plan?

Yes. Usercentrics has a free plan, per [the vendor’s page captured 13 Oct 2026](https://whats-best.ai/evidence/7606).

### What are the best alternatives to Usercentrics?

As of 21 Oct 2026, the panel rates [preeco | datenschutz (4/5)](https://whats-best.ai/software/data-protection/preeco), [Dastra (3/5)](https://whats-best.ai/software/data-protection/dastra) and [caralegal (3/5)](https://whats-best.ai/software/data-protection/caralegal) highest among the other 41 Data Protection products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [preeco | datenschutz](https://whats-best.ai/software/data-protection/preeco) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Usercentrics alternatives](https://whats-best.ai/software/data-protection/usercentrics/alternatives).

## What this page leaves out

- 21 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor page: https://usercentrics.com (checked 2026-10-13)
- [S2] Records & DPIA depth — found from sitemap: https://usercentrics.com/knowledge-hub/ropa/ (checked 2026-10-13)
- [S3] Records & DPIA depth — found from sitemap: https://usercentrics.com/knowledge-hub/data-protection-impact-assessment-dpia/ (checked 2026-10-13)
- [S4] Data subject rights & incidents — found from sitemap: https://usercentrics.com/knowledge-hub/usercentrics-dsr-data-subject-requests/ (checked 2026-10-13)
- [S5] Data subject rights & incidents — found from sitemap: https://usercentrics.com/knowledge-hub/data-subject-access-requests/ (checked 2026-10-13)
- [S6] Privacy regime coverage — found from sitemap: https://usercentrics.com/regulations-and-frameworks/ (checked 2026-10-13)
- [S7] Privacy regime coverage — found from sitemap: https://usercentrics.com/gdpr/ (checked 2026-10-13)
- [S8] Audit readiness & evidence — found from sitemap: https://usercentrics.com/knowledge-hub/compliance-reporting-tools/ (checked 2026-10-13)
- [S9] Audit readiness & evidence — found from sitemap: https://usercentrics.com/knowledge-hub/compliance-audit-software/ (checked 2026-10-13)
- [S10] Integrations & automation — found from sitemap: https://usercentrics.com/integrations/ (checked 2026-10-13)
- [S11] Integrations & automation — found from sitemap: https://usercentrics.com/consent-management-api/ (checked 2026-10-13)

---

Cite as: whats-best.ai, "Usercentrics — Data Protection", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/data-protection/usercentrics

Corrections: https://whats-best.ai/correct/697?target=page