How we make this list: we compare pricing pages, product documentation and public user reviews. Rankite is independent; if a vendor ever pays for a featured spot, that listing is clearly labeled Partner.
Key takeaways
- CookieYes ($100/year per domain) and Secure Privacy ($15/month per domain) give small sites real compliance for the price of a pizza; OneTrust starts around five figures a year.
- Usercentrics Cookiebot (Premium from €15/month per domain) pairs automated cookie scanning with a free plan, which keeps the banner accurate as trackers change.
- Termly and iubenda bundle the banner with legal policy generators, which suits small businesses that need both without hiring a lawyer.
- OneTrust, TrustArc and Didomi are quote-based enterprise platforms: buy them for a privacy program, not for a cookie banner.
Quick comparison
| Tool | Best for | Starting price | Free plan |
|---|
 CookieYes | Small businesses, bloggers and single-site owners | $100/year/domain (Basic); Pro $250; Ultimate $550 (annual, 2 months free) | Yes (Free plan: 5,000 pageviews/month, 100 pages per scan) |
 Usercentrics Cookiebot | SMB websites needing solid GDPR and cookie-law compliance | €15/month/domain (Premium, 4+ domains); €30/month/domain (1-3 domains) | Yes (Free plan: 1 domain, under 50 subpages; 14-day Premium trial, no card) |
 Secure Privacy | SMBs and agencies wanting transparent per-domain CMP pricing | $15/month/domain (Small); Business $59; Advanced $249 (per domain/month) | Yes (Free plan: up to 10 domains, 500 consents/month, 1 language) |
 Termly | Small businesses needing a cookie banner plus legal policies | See website (per-website pricing; third-party figures unverified on vendor page) | Limited (third parties report a free plan; unverified on vendor page) |
 iubenda | Small to midsize sites needing consent plus legal documents | See website (per-site pricing; third-party figures unverified on vendor page) | Limited (third parties report a free plan; unverified on vendor page) |
 Osano | US-focused SMBs and midmarket companies wanting a privacy suite | See website (no public pricing confirmed on vendor page) | Limited (third parties report a free tier; unverified on vendor page) |
 InMobi CMP | Publishers and app developers needing IAB-standard consent | See website (no public pricing confirmed on vendor page) | Limited (third parties report a free Essentials tier; unverified on vendor page) |
 Didomi | Midmarket and enterprise companies treating consent as UX and compliance | See website (quote-based; reportedly priced on monthly unique visitors) | No (no free tier reported) |
 OneTrust | Enterprises and regulated midmarket companies needing full privacy management | See website (quote-based; third-party estimates unverified) | No (no free plan reported) |
 TrustArc | Highly regulated enterprises needing a full privacy program | See website (quote-based; third-party estimates unverified) | No (no free tier reported) |
Is your product missing or out of date?
We review this list regularly. Vendors can request a listing, send updated pricing or ask about featured placement.
CookieYes charges $100 a year per domain. OneTrust starts around five figures a year. Both sell consent management platforms, and both can be the right answer, for very different buyers. A CMP does three jobs: scan your site for trackers, show visitors a compliant consent banner, and record their choices as proof. These ten platforms cover the range from free banners for blogs to the privacy suites enterprises run.
Starting price$100/year/domain (Basic); Pro $250; Ultimate $550 (annual, 2 months free)
Free planYes (Free plan: 5,000 pageviews/month, 100 pages per scan)
CookieYes is the value leader for small sites. The free tier covers 5,000 pageviews a month, and paid plans start at $100 a year per domain with two months free on annual billing. It is a Gold-tier Google CMP Partner with Consent Mode v2 and IAB TCF v2.3 support, so the compliance substance is real, not a decorative banner. Setup takes minutes via plugin or script.
The per-domain model is the thing to model. Every domain needs its own subscription, with pageview overage charges ($0.30 per 1,000 extra pageviews reported), so an agency managing 20 client sites pays 20 subscriptions. Lower tiers lack API access for technical teams. For a single site or a handful of small sites, the value is unmatched. For multi-site operations, price the whole portfolio.
What we like- Very low entry price with a genuinely usable free tier
- Gold-tier Google CMP Partner with Google Consent Mode v2 and IAB TCF v2.3 support
- Fast setup with WordPress, Shopify and Wix integrations
Watch out for- Per-domain, per-pageview pricing adds up for agencies managing many client sites
- No API on lower tiers
#2
Usercentrics Cookiebot
Best for: SMB websites needing solid GDPR and cookie-law compliance
Visit cookiebot.com
Starting price€15/month/domain (Premium, 4+ domains); €30/month/domain (1-3 domains)
Free planYes (Free plan: 1 domain, under 50 subpages; 14-day Premium trial, no card)
Cookiebot's core strength is the scanner. It automatically finds and categorizes your trackers every month, so the consent banner reflects what your site actually loads instead of what it loaded when someone last audited it. As a Google-certified CMP with Consent Mode and IAB TCF support, it covers the regulatory bases for EU-facing sites. Pricing is verified on Cookiebot's own page: Premium from €15 a month per domain.
Watch the counting. Subdomains count as separate domains, subpage thresholds push you between tiers, and auto-tier upgrades apply when scans detect growth. A content-heavy site with many subdomains can land on a bigger bill than expected. For a straightforward business site that wants the banner to stay accurate without babysitting, it is the most diligent option at the price.
What we like- Automated monthly cookie scanning with categorization keeps the banner accurate
- Google-certified CMP with Consent Mode and IAB TCF support
- Free plan and trial make evaluation easy
Watch out for- Pricing by domain and subpage count gets expensive for multi-site or content-heavy businesses
- Subdomains count as separate domains
#3
Secure Privacy
Best for: SMBs and agencies wanting transparent per-domain CMP pricing
Visit secureprivacy.ai
Starting price$15/month/domain (Small); Business $59; Advanced $249 (per domain/month)
Free planYes (Free plan: up to 10 domains, 500 consents/month, 1 language)
Secure Privacy's pitch is pricing you can read. Four published tiers (Free, Small $15, Business $59, Advanced $249 per domain per month, verified on its own pricing page), each with defined consent volumes and features, no sales call required. The free tier covers up to 10 domains with 500 consents a month, which suits small portfolios. IAB TCF 2.3 support starts on Small; DSAR handling and cross-domain consent arrive on Business.
The caps are the planning exercise. Consent volumes per tier mean a high-traffic site lands on Business or Advanced quickly, so model your monthly consents before choosing. Brand recognition trails the giants, which matters if your enterprise clients ask for a CMP by name. For SMBs and agencies that want transparent pricing without a sales process, the clarity is the product.
What we like- Clear per-domain pricing with a usable free tier
- IAB TCF 2.3 support from the Small plan up
- DSAR handling and cross-domain consent on Business
Watch out for- Smaller vendor with less brand recognition than OneTrust or Usercentrics
- Consent-volume caps mean high-traffic sites must size plans carefully
#4
Termly
Best for: Small businesses needing a cookie banner plus legal policies
Visit termly.io
Starting priceSee website (per-website pricing; third-party figures unverified on vendor page)
Free planLimited (third parties report a free plan; unverified on vendor page)
Termly bundles the two things small businesses buy together: the consent banner and the legal policies. Privacy policy, terms and cookie policy generators with automatic updates for regulatory changes, aimed at non-lawyers who do not want to hire one. For a small business that needs both, the bundle beats buying a CMP and a policy generator separately.
The pricing needs verification: third-party figures are unverified on Termly's own page, so this article lists "See website," and the per-website model scales linearly with each site. Setup is quick and self-serve. If you need the banner and the policies, price the bundle against CookieYes plus a separate policy generator before deciding.
What we like- Combines consent management with legal policy generators (privacy policy, terms)
- Beginner-friendly setup aimed at non-lawyers
- Auto-updated policies track regulatory changes
Watch out for- Per-website pricing penalizes businesses with multiple sites
- Reported plan prices could not be verified on the vendor's page
#5
iubenda
Best for: Small to midsize sites needing consent plus legal documents
Visit iubenda.com
Starting priceSee website (per-site pricing; third-party figures unverified on vendor page)
Free planLimited (third parties report a free plan; unverified on vendor page)
iubenda is the other bundle play: cookie consent plus privacy policies and terms generators in one subscription, with multi-language support for international sites. The pageview-based tiers scale from small sites to large publishers, which suits growing content businesses better than flat per-site pricing.
Like Termly, the pricing figures floating around are third-party reported and unverified on the vendor's own page, so confirm before budgeting. The pageview caps are the planning variable: traffic growth forces plan upgrades on a schedule you do not control. For a site that needs the banner, the policies and multiple languages in one place, it is the most complete small-business bundle.
What we like- All-in-one compliance: cookie consent, privacy policies and terms generators
- Pageview-based tiers scaling from small sites to publishers
- Multi-language support for international sites
Watch out for- Reported prices could not be verified on the vendor's own page
- Pageview caps mean traffic growth forces upgrades
#6
Osano
Best for: US-focused SMBs and midmarket companies wanting a privacy suite
Visit osano.com
Starting priceSee website (no public pricing confirmed on vendor page)
Free planLimited (third parties report a free tier; unverified on vendor page)
Osano is the suite for companies whose privacy needs outgrew a banner. Consent management connects to data mapping, subject rights requests and vendor risk management, with strong positioning for US state privacy laws alongside GDPR. For a US-focused SMB or midmarket company building a real privacy program, the connected suite beats stitching point tools.
The pricing transparency went missing: the vendor page did not show public pricing at last check, so buyers need a sales conversation and this article lists "See website." The breadth is also a fit question: if you need a cookie banner, the suite is overkill. Buy Osano for the program, not the banner.
What we like- Privacy platform beyond consent: data mapping, DSARs and vendor risk in one suite
- Strong positioning for US state privacy laws alongside GDPR
- Polished admin experience
Watch out for- Current pricing could not be confirmed on the vendor's own page
- Platform breadth may exceed what a simple banner buyer needs
#7
InMobi CMP
Best for: Publishers and app developers needing IAB-standard consent
Visit inmobi.com
Starting priceSee website (no public pricing confirmed on vendor page)
Free planLimited (third parties report a free Essentials tier; unverified on vendor page)
InMobi CMP, formerly Quantcast Choice, is the ad-tech industry's consent tool. IAB TCF-compliant consent for web and mobile apps fits publishers and app developers where generic banners fall short on ad-tech requirements. The reported free Essentials tier makes it accessible for ad-supported businesses watching costs.
Confirm the identity before you evaluate: Quantcast Choice became InMobi CMP after the 2023 acquisition, so reviews and comparisons use both names. Pricing and plan details could not be verified on the vendor's page. For publishers and app developers in the ad ecosystem, the TCF fit is the reason to look. For a standard business website, the generalist CMPs above are simpler.
What we like- IAB TCF-compliant consent for web and mobile apps
- Reported free tier suits publishers and app developers
- Backed by InMobi's ad-tech scale
Watch out for- The Quantcast Choice to InMobi CMP rebrand creates research confusion
- Pricing and plan details unverified on the vendor page
#8
Didomi
Best for: Midmarket and enterprise companies treating consent as UX and compliance
Visit didomi.io
Starting priceSee website (quote-based; reportedly priced on monthly unique visitors)
Free planNo (no free tier reported)
Didomi treats the consent banner as a conversion surface, not just a legal checkbox. The banner builder and preference center are polished, multi-regulation coverage spans GDPR through CCPA/CPRA, and the analytics show consent rates so teams can optimize banner performance like any other funnel. For companies where consent UX affects revenue, that lens matters.
The model is sales-led with no public pricing, reportedly scaled on monthly unique visitors, and positioned above simple banner tools. There is no self-serve path. If consent is a compliance checkbox, the small-business tools above do it for a tenth of the cost. If it is a managed, optimized, multi-regulation program, Didomi is built for that job.
What we like- Strong consent UX and preference management with a polished banner builder
- Good multi-regulation coverage (GDPR, CCPA/CPRA and others)
- Solid consent-rate analytics for optimizing banner performance
Watch out for- No public pricing
- Everything runs through sales
- Positioned and priced above simple banner tools
#9
OneTrust
Best for: Enterprises and regulated midmarket companies needing full privacy management
Visit onetrust.com
Starting priceSee website (quote-based; third-party estimates unverified)
Free planNo (no free plan reported)
OneTrust is the privacy platform, not the cookie banner. Consent management connects to data mapping, subject rights requests, assessments and governance in one suite, with enterprise-grade coverage across global regulations and deep integrations into marketing and data stacks. For a company running a full privacy program, the connected platform is the argument.
The price of the platform is enterprise everything: third-party estimates point to five-figure annual minimums (unverified), implementation runs weeks to months, and the product needs dedicated ownership. A small site buying OneTrust for a banner is burning money. Buy it when privacy is a program with headcount, not a checkbox.
What we like- Broadest privacy platform: consent, DSAR, assessments and governance in one suite
- Enterprise-grade compliance across global regulations
- Deep marketing and data stack integrations
Watch out for- Enterprise pricing puts it out of reach for small sites
- Platform breadth means longer implementation and heavier administration
#10
TrustArc
Best for: Highly regulated enterprises needing a full privacy program
Visit trustarc.com
Starting priceSee website (quote-based; third-party estimates unverified)
Free planNo (no free tier reported)
TrustArc is the veteran: years of compliance depth, a broad platform spanning consent, assessments, certifications and data inventory, and strength in highly regulated industries where audit history matters. Certification offerings built over many years carry weight with regulators and enterprise buyers.
The trade is modernity and access. Pricing is quote-based at enterprise levels with a sales-led process and no self-serve path, and the platform can feel dated next to consent-first tools like Didomi. For a regulated enterprise that values an established vendor with certification depth, TrustArc fits. For everyone else on this list's small-business end, it is the wrong decade.
What we like- Long-established privacy vendor with deep compliance expertise
- Broad platform: consent, assessments, certifications and data inventory
- Strong for highly regulated industries
Watch out for- Enterprise pricing and sales process with no self-serve path
- Platform can feel dated next to newer consent-first tools
What actually keeps you compliant
A CMP keeps you compliant through three mechanisms, and the banner is only the first. Scanning: the platform finds your trackers and categorizes them, monthly (Cookiebot) or on demand, so the banner describes reality. Blocking: scripts that set cookies or fire pixels must wait for consent before running; a banner that loads Google Analytics before the visitor clicks is decoration. Records: every consent choice is logged with a timestamp, which is the proof a regulator asks for.
Evaluate in that order. Ask how the scanner works and how often it runs. Ask whether the platform actually blocks tags pre-consent or just displays a banner (this is where cheap banners fail). Ask what the consent records look like and how long they are retained. Google Consent Mode support (CookieYes, Cookiebot, Secure Privacy) matters if you run Google ads and analytics. IAB TCF support matters for ad-funded sites. The banner design is the least important part of the purchase.
Free vs. paid: where the line is
The free tiers here are real but bounded. CookieYes free covers 5,000 pageviews a month. Cookiebot free covers one domain under 50 subpages. Secure Privacy free covers 10 domains at 500 consents a month. Those suit blogs, side projects and very small sites. The moment you have real traffic, multiple domains or legal exposure worth protecting, the paid tiers ($100 a year at CookieYes, €15 a month at Cookiebot, $15 a month at Secure Privacy) are cheap insurance.
The bigger line is between banner tools and privacy platforms. Everything up to iubenda on this list sells consent plus adjacent documents for tens to hundreds of dollars. Osano, Didomi, OneTrust and TrustArc sell privacy programs for thousands to tens of thousands, with data mapping, DSARs and assessments attached. Do not buy a platform for a banner problem, and do not expect a $100 banner to run your enterprise privacy program. Name the job, then pick the side of the line.
How we chose
We started with the searches buyers actually run: consent management platform, cookie consent tool, GDPR compliance software and cookie banner. For each candidate we opened the vendor's own pricing page, checked plan names and prices against public reviews on G2 and Capterra and practitioner discussion on Reddit, and compared feature lists, scanning capability, regulation coverage and company-size fit. Where a price could not be verified on the vendor's page we wrote "See website" instead of guessing. The shortlist mixes affordable banner tools with enterprise privacy suites, because a blog and a bank are not buying the same compliance.
Frequently asked questions
Do I need a consent management platform, or just a cookie banner?
If your site sets non-essential cookies or fires tracking pixels, you need consent management, not just a banner graphic. The legal requirement is prior consent plus proof: the banner collects it, the platform blocks trackers until given and logs the choice. A banner that does not block scripts is decoration that creates liability instead of removing it.
What is Google Consent Mode, and do I need it?
Consent Mode lets Google tags adjust their behavior based on the visitor's consent choice: analytics and ads model the gaps instead of going blind. If you run Google Analytics or Google Ads, your CMP should support Consent Mode v2. CookieYes, Cookiebot and Secure Privacy all do. Without it, declining visitors become invisible to your measurement.
What is IAB TCF?
The Transparency and Consent Framework is the ad industry's standard for passing consent signals between publishers, CMPs and ad-tech vendors. If your site runs programmatic ads, you need a TCF-registered CMP (CookieYes, Cookiebot, Secure Privacy, InMobi CMP). If you do not run ads, TCF support is irrelevant to your purchase.
How much should a CMP cost?
For a single small site: $0 to $550 a year (CookieYes free to Ultimate, Cookiebot free to €30 a month, Secure Privacy free to $15 a month). For multi-site portfolios, multiply per domain. Midmarket consent programs (Didomi) run into the thousands annually; enterprise privacy suites (OneTrust, TrustArc) start around five figures. The per-domain model means agencies should price the whole portfolio, not one site.
Can a CMP handle US state privacy laws too, or just GDPR?
Most modern CMPs cover both: CookieYes, Cookiebot, Secure Privacy, Osano and Didomi all handle CCPA/CPRA-style opt-outs alongside GDPR opt-ins. The US model (opt-out of sale/sharing) differs from the EU model (prior opt-in consent), so confirm the platform supports both frameworks if you serve both audiences. Osano positions specifically for US state law coverage.
Will a CMP slow down my website?
A well-built CMP adds minimal load: the banner script is small and tag blocking happens before the heavy marketing scripts fire. In practice, blocking non-consented trackers often speeds up the initial page load. The performance risk comes from poorly implemented banners that block rendering; the established vendors here load asynchronously. Test with your actual tag stack before and after.
Sources we checked (12)
- https://www.cookieyes.com/pricing/
- https://www.cookiebot.com/en/pricing/
- https://secureprivacy.ai/pricing
- https://www.termly.io/pricing/
- https://www.iubenda.com/en/pricing
- https://www.osano.com/pricing/
- https://www.inmobi.com/trust/
- https://www.didomi.io/
- https://www.onetrust.com/
- https://www.trustarc.com/
- https://www.g2.com/categories/consent-management
- https://www.capterra.com/consent-management-software/
Is your product missing or out of date?
We review this list regularly. Vendors can request a listing, send updated pricing or ask about featured placement.
Shihab Mia · Founder, Rankite
Shihab has spent more than a decade helping SaaS and e-commerce brands grow through search. He writes Rankite's software buying guides from pricing pages, documentation and public user reviews. More about Shihab.