Every "best consent management platform" list ranks the same names from the same source: the vendors' own marketing pages. We tested them instead. In July 2026 we ran our compliance scanner across 912 live small and mid-sized business sites running the four most common consent tools (Cookiebot, OneTrust, Ketch, and CookieYes), the way a real EU visitor experiences them. What we found breaks the premise of every roundup in this category: it barely mattered which tool a site had installed. As they were configured, 91% of those sites (829 of 912) fired a third-party tracker before the visitor answered the banner, and only 6% (52 of 912) came through clean under both an EU and a US test. Not one of the four, as deployed in the wild, consistently produced a compliant site.
Key Takeaways
- 01There is no single best consent management platform, but there is a modern one. Budget tools (CookieYes, Termly) put a cheap banner on a small site, enterprise suites (OneTrust, Ketch) serve procurement-driven privacy programs, Complianz covers WordPress, and ConsentStack gives small and large businesses gating on by default, deep customization, and published pricing.
- 02Installing a consent tool is not the same as being compliant. In our July 2026 scan of 900+ small and mid-sized sites on the four leading tools, 91% (829 of 912) fired a tracker before consent. A scan cannot show why, so we do not assume the site owner misplaced a tag: a gap in the tool's blocking list looks exactly the same.
- 03Much of the consent industry runs on outdated tools. Watch for ones that only signal consent to ad platforms without physically blocking trackers: a banner can look compliant while data still leaves before consent.
- 04Watch the metering and the free-tier catches: per-subpage billing (Cookiebot), per-domain pricing (CookieYes), per-session counts (Usercentrics), and hard view caps that disable the banner (Termly) all cost more than the sticker price.
- 05Parse-time script blocking stops trackers before they execute; runtime blocking leaves a gap. Whatever tool you pick, scan your own site to confirm trackers are actually held until consent.
So this guide starts from a different question: not which vendor has the best marketing, but which tool actually blocks trackers before consent, what it really costs at published prices, and who each one genuinely fits. The short version: CookieYes and Termly are the cheapest way to put a banner on a small site, OneTrust and Ketch are for enterprises buying a whole privacy suite, Complianz is the WordPress pick, and ConsentStack, our own product, is the modern one: gating on by default, deeply customizable so the banner looks built into your site, published pricing, and built for small and large businesses alike.
Before you trust any list, check your own site first. Our scanner shows exactly which trackers fire before anyone clicks Accept, and which keep firing after Reject, from both an EU and a US vantage. No signup, no email.
See where your own site stands first
Run a free compliance scan and watch which trackers fire before consent, and which ignore Reject, checked from both the EU and the US. About a minute, no signup.
What actually separates a good CMP from a decorative one
A consent banner has one job: hold non-essential tracking until the visitor chooses, and honor the choice. A surprising number of them do not, and the failure is usually invisible because the banner still appears. So the criteria below are about outcomes you can measure, not features on a pricing page.
1. Does it actually stop trackers before consent? This is the one that matters most and the one most deployments get wrong. There are two ways to block: at parse time (the tool intercepts each script as the page is built, before the browser runs it) and at runtime (the tool tries to catch scripts after the page has started executing, which leaves a gap). Some tools do not physically block at all, they only signal your consent choice to ad platforms, which is not the same thing. We put real numbers behind this below, from our own scan of live sites.
2. What does it really cost, with no sales call? Every tool here is judged at 30,000 monthly visitors and 2 domains. If a CMP hides its price behind "contact sales," that is itself an answer: expect four to five figures a year. Watch the metering too. Some tools bill by scanner-counted subpages or by sessions (where a returning visitor counts again), which is not the same as the visitor count you already track.
3. How many regulations does it cover, and does it detect them automatically? GDPR and CCPA are table stakes. If your visitors come from the EU, the UK, Brazil, Canada, or the growing list of US states with privacy laws, you want a tool that detects the visitor's location and applies the right rules, rather than one you have to configure region by region.
4. Does it look like part of your site, or a widget taped on top? Customizable banners that inherit your styling read as trustworthy. Generic overlays with a vendor logo read as bolted-on, and some tools charge extra to remove their branding.
5. How much does it slow the page and how long is setup? A heavy consent script can become the slowest thing on the page. And if a tool needs a multi-week onboarding or a dozen configuration steps before a visitor sees a banner, the implementation cost can dwarf the subscription.
We did not rank these from their marketing pages. We scanned them.
Here is what makes this list different from every other "best CMP" roundup in the search results: none of them cite a single original measurement. They rank tools from vendor claims and review-site star ratings. We publish a research study instead.
We took 912 live sites that we had already confirmed were running one of the four most common consent tools (Cookiebot, OneTrust, Ketch, and CookieYes) and ran each one through our scanner the way an EU visitor experiences it. The result, across all four tools and reported as a group rather than a per-tool scoreboard:
Across roughly 900 small and mid-sized sites running the four leading consent tools, as they were configured in July 2026, 91% (829 of 912) fired a third-party tracker before the visitor answered the banner, even after setting aside each tool's own scripts. On the sites where our scanner independently re-confirmed the tool was running, that figure was 93% to 97%. Only 6% (52 of 912) were clean under both an EU and a US visitor test. Installing a consent tool is not the same as being compliant.
Two framing notes, because they shape how we talk about every vendor below. First, this was a study of deployments, not products. The single largest group of failing sites, on every one of the four tools, was the same: a working banner is present, nothing fires after Reject, and a tracker fires anyway before the visitor answers. A scan from the outside cannot tell you why it fired. It records requests and their timing, not page source, so a tag placed above the consent gate, a tracker the tool's blocking list does not recognize, and automatic blocking left switched off all look identical. We name none of them, and we do not default to blaming the site owner. The verdict is the same either way: data left before the visitor chose, and that is a failure. The four tools also landed close enough together that we do not, and cannot honestly, crown a "worst" one, so we never rank the tools on those compliance numbers. Second, these lists exclude large enterprise deployments by design, which skews the rates higher than any single vendor's full customer base, OneTrust most of all. What we do rank the tools on below is price, features, and fit, which is fair game. The full methodology, denominators, and limitations live in the two studies: Cookie Compliance by Consent Tool and the broader State of Cookie Compliance.
The best consent management platforms in 2026
Twelve tools, grouped by who they are actually for. ConsentStack is first: it is our product, and on the criteria that matter (gating on by default, a banner that looks built in, deep customization, published pricing) we built it to win. Where another tool is genuinely the better call, we say so. Every other entry is an honest read of what the tool is good and bad at.
1. ConsentStack
A truly modern CMP in an industry full of outdated tools: full compliance, no compromise.
| Field | Value |
|---|---|
| Entry price | Free Basic, then $29/mo Pro (30k visitors, 2 domains), $79/mo Business |
| Free tier | Yes, free forever (1k visitors, 1 domain) |
| Script blocking | Parse-time, blocks scripts before they execute; gates by default |
| Best for | Small and large businesses that want a modern, deeply customizable CMP with gating on by default, minus the enterprise bloat |
Full disclosure: ConsentStack publishes this article.
Where it wins: A banner that is deeply customizable and inherits your site's styling, so it reads as part of your site instead of a widget taped on top. Script blocking that fires at parse time, through a lightweight stub that enforces before the main bundle even loads, so trackers are held before they run rather than chased after the fact, and gating that is on by default rather than a setting you have to find. Region and regulation detection runs on every tier, including free, and it scales from a single small site to high-traffic, multi-domain businesses without an enterprise contract. Flat, public pricing ($0 / $29 / $79) with no sales call. Self-serve from sign-up to live, or a Concierge install (included on paid plans) if you would rather we move you off your current tool. And for healthcare-adjacent teams, it offers a self-serve HIPAA BAA, which most CMPs gate behind an enterprise contract.
Where it is not the pick: Publishers that need the IAB Transparency and Consent Framework (TCF) for programmatic ad bidding, since ConsentStack does not support TCF. And teams that want data-subject-request workflows and vendor-risk modules bundled into the same contract: ConsentStack is deliberately a consent layer that does its job extremely well, not a sprawling privacy suite.
Best for: small and large businesses that want compliance that actually works, a banner that looks built in, and no procurement process. Try ConsentStack free or see how the compliance engine works.
2. Cookiebot (by Usercentrics)
The scan-first EU standard, now owned by Usercentrics, with a price that doubled in 2025.
| Field | Value |
|---|---|
| Entry price | ~$34/mo (Premium, up to 3,500 subpages), per domain |
| Free tier | Yes, one domain with a small subpage cap and Cookiebot branding |
| Script blocking | Automatic prior blocking, but you have to turn it on |
| Best for | GDPR-first sites that want strong automatic cookie scanning |
Where it wins: Fast setup, especially on WordPress. Strong automatic cookie scanning that keeps your declaration current. Google-certified for Consent Mode v2 (Google's system for passing the visitor's consent choice to Google Ads and Analytics), and a well-known brand behind it now that Usercentrics owns it.
Where it costs you: In August 2025 the base Premium price roughly doubled (from about 15 to 30 euros a month), and accounts with fewer than four domains were moved onto a pricier tier. Billing is per domain with no multi-domain discount, and it counts scanner-crawled subpages rather than visitors, so a large site can outgrow a tier without more real traffic. Auto-blocking works well but is opt-in, so a default install can still leak. We break the tiers down in the Cookiebot pricing teardown.
Best for: WordPress and EU-focused sites that want automatic scanning and Google certification, and will turn auto-blocking on deliberately. See ConsentStack vs Cookiebot.
3. OneTrust
The enterprise market leader. A full privacy operations suite, priced and weighted like one.
| Field | Value |
|---|---|
| Entry price | Custom quote only; ~$10,000+/yr platform minimum (Vendr median ~$10,500) |
| Free tier | No (the self-serve CookiePro entry point was retired) |
| Script blocking | Available via auto-blocking, but must be configured |
| Best for | Large enterprises running multi-regulation privacy programs |
Where it wins: The widest platform in the category. Consent is one module alongside data mapping, DSAR automation, vendor risk, and AI governance, with the largest integration ecosystem and market share in the space. If you need a single system of record for a whole privacy program, this is the default.
Where it costs you: There is no cheap or free way to try it. The self-serve product was discontinued, so evaluation means entering the sales process, and the platform minimum sits around $10,000 a year (the Vendr median lands near $10,500). It is heavy for a site that just needs a banner. We walk through the numbers in the OneTrust pricing teardown.
Best for: enterprises with a privacy team and a procurement budget that need the whole governance suite, not just consent. See ConsentStack vs OneTrust.
4. CookieYes
A budget favorite with a genuinely useful free tier and per-domain pricing that adds up.
| Field | Value |
|---|---|
| Entry price | $10/mo Basic, $25/mo per domain Pro, $55/mo Ultimate |
| Free tier | Yes, 5,000 pageviews/mo, includes automatic blocking |
| Script blocking | Automatic prior blocking, on by default (even free) |
| Best for | Budget owners of a single small site |
Where it wins: One of the cheaper ways to get a compliant-looking banner, and unusually for the budget tier, its automatic script blocking is on by default, including on the free plan. Works on any stack, quick to install.
Where it costs you: Pricing is per domain, so several sites add up fast. The free tier has been thinned out over time (custom colors were removed from free in early 2026), and geo-targeting, multilingual, IAB TCF, Global Privacy Control (the browser signal that tells a site not to sell or share a visitor's data), and branding removal all sit behind paid tiers, with branding removal only on the top $55 plan. It is one of the four tools in our scan study, where the group of sites running it fired trackers before consent at the same high rate as the others (reported as a group, not singled out).
Best for: a single low-traffic site where a cheap entry price matters more than TCF or multi-site pricing. See ConsentStack vs CookieYes.
5. Termly
A banner bundled with legal-document generators, at a budget price, with a hard free-tier ceiling.
| Field | Value |
|---|---|
| Entry price | Free, then ~$10-20/mo (Pro+ removes branding, unlimited views) |
| Free tier | Yes, 10,000 monthly banner views, one legal policy |
| Script blocking | Auto-blocker, categorizes and blocks by consent choice |
| Best for | US small businesses that want banner plus policy generators |
Where it wins: You get a cookie banner plus privacy-policy and terms generators in one low-cost tool, which is convenient for a solo operator or a small US business. It is a Google-certified CMP.
Where it costs you: The free tier's 10,000-banner-view ceiling is a hard cutoff: pass it and the banner deactivates for the rest of the month, which is a bad failure mode for compliance. Google Consent Mode v2 and branding removal are Pro+ only. And as with any consent tool, if you run tags through Google Tag Manager, confirm they are actually blocked before you rely on it. See ConsentStack vs Termly.
6. Osano
Consent wrapped inside a broader data-privacy platform, with a no-fines pledge and a steep jump to paid.
| Field | Value |
|---|---|
| Entry price | Free tier, then $199/mo Plus (30k visitors, 3 domains) |
| Free tier | Yes, 1 domain / ~5,000 visitors, basic banner |
| Script blocking | Automatic blocking is a paid feature, not part of free |
| Best for | Mid-market teams wanting consent inside a wider privacy suite |
Where it wins: Consent sits alongside vendor risk, data mapping, and DSAR tooling, and Osano markets a "no fines, no penalties" pledge (up to a capped amount) that some buyers value as insurance. Large customer base.
Where it costs you: The free tier is thin (automatic blocking and richer features are not part of it), and the jump to the $199 a month Plus tier is steep for a site that only needs a compliant banner. As with any consent script, test it on your own pages before committing, since a heavy banner can become the slowest thing on the page. See ConsentStack vs Osano.
7. Ketch
A consent and data-permissioning platform for teams that want to orchestrate consent across a whole stack.
| Field | Value |
|---|---|
| Entry price | Free (up to 5,000 users), then $150/mo, enterprise above |
| Free tier | Yes, up to 5,000 monthly users |
| Script blocking | Orchestration model: conditionally fires or blocks tags by consent |
| Best for | Data-driven mid-market and enterprise teams |
Where it wins: Ketch treats consent as orchestration, pushing the visitor's choice across tag managers, directly-placed tags, and downstream data and AI systems, not just the website banner. Strong support, real DSAR automation, and it has a free tier for small sites.
Where it costs you: It is more platform than a small site needs, with a learning curve (its own terminology and setup steps) and paid tiers that climb into enterprise territory. It is one of the four tools in our scan study; as with the others, the group of sites running it fired trackers before consent at the same high rate. A scan cannot separate the tool from the setup, so that is not a verdict on the orchestration engine, and it is not a clean bill of health either. See ConsentStack vs Ketch.
8. iubenda
Bundled legal documents plus consent, priced per site, popular with agencies.
| Field | Value |
|---|---|
| Entry price | Free (<1k pageviews), then ~$25-100/site/mo (billed annually) |
| Free tier | Yes, under 1,000 pageviews/mo, one-language policies |
| Script blocking | Prior blocking on higher-traffic plans |
| Best for | SMBs and agencies wanting bundled legal docs across many sites |
Where it wins: Like Termly, it bundles privacy and cookie policy generators with consent, and it supports Google Consent Mode even on the free tier. Priced per site, which agencies managing many small clients often find predictable.
Where it costs you: Per-site pricing adds up across a portfolio, and prior blocking (the part that actually gates trackers) is gated to the higher-traffic plans, so a cheap tier may signal consent without physically blocking. The free tier disables the banner once you pass 1,000 pageviews.
9. Complianz
A self-hosted WordPress and Shopify plugin with a strong free tier and no cloud dependency.
| Field | Value |
|---|---|
| Entry price | Free plugin, then $59-399/yr (1 to 25 sites) |
| Free tier | Yes, capable: banner, scan, on-site blocking, no pageview limit |
| Script blocking | On-site prior blocking, included in free |
| Best for | WordPress and Shopify owners who want blocking to stay on their own site |
Where it wins: For WordPress and Shopify, the free plugin is genuinely capable: a real consent banner, a cookie scan, on-site script and iframe blocking across hundreds of integrations, and a policy generator, with no pageview cap. Because it runs on your own site, your consent data and blocking stay first-party.
Where it costs you: It is WordPress and Shopify only, so there is no portability to another stack. Geo-targeting, Google Consent Mode v2, IAB TCF, and consent records are premium-only, and single-region on free. As a plugin it depends on your site being configured correctly, so verify the banner renders reliably.
10. Enzuzo
A low-cost, e-commerce-friendly bundle of consent, policy generation, and data-subject requests.
| Field | Value |
|---|---|
| Entry price | Free, then $9-79/mo (Starter to Pro), Enterprise custom |
| Free tier | Yes, 5,000 visitors, 1 domain, 3 DSARs/mo |
| Script blocking | Consent-mode signaling documented; physical blocking unclear |
| Best for | Shopify and e-commerce SMBs on a budget |
Where it wins: A cheap, tidy bundle for a small store: consent, a privacy-policy generator, and DSAR handling in one, with a free tier and no credit card to start. Documented support for Google Consent Mode v2 and Microsoft's consent signaling.
Where it costs you: Its public materials emphasize consent-mode signaling (telling ad platforms about consent state) rather than physically blocking trackers before they fire, so if before-consent blocking matters to you, confirm it does that and does not only signal. Visitor and domain caps on the lower tiers are modest (Growth covers 10k visitors; the 30k tier is Pro at $79 a month).
11. Freshpaint
Not a general CMP. A healthcare-specialist tracking platform built around server-side filtering.
| Field | Value |
|---|---|
| Entry price | Sales-quoted only (third-party estimates from ~$599/mo); no free tier |
| Free tier | No |
| Script blocking | Server-side: filters data flows and removes PHI-leaking pixels |
| Best for | Healthcare organizations that need HIPAA-safe marketing analytics |
Where it wins: For hospitals, health systems, and other covered entities, Freshpaint solves a specific hard problem: it removes third-party pixels that would leak protected health information and filters data server-side before it reaches ad and analytics tools, all under a signed BAA. Consent management is one component of a larger HIPAA-safe tracking layer.
Where it does not fit: It is not a self-serve general-purpose CMP. There is no published price and no free tier, and every plan runs through a healthcare sales process. If you are a general business that wants a compliant cookie banner, this is the wrong shape of tool. It is on this list as the healthcare specialist, for teams whose problem is HIPAA-safe tracking rather than a general banner.
Enterprise and legacy options worth knowing
Two more names show up in most CMP roundups. Transcend is an enterprise privacy platform that positions its blocking as network-level, aimed at large companies with dedicated privacy engineering and six-figure budgets. TrustArc is a long-established enterprise compliance vendor, also custom-quoted. Both are real options for large organizations, and both are overkill (and priced accordingly) for a site that just needs a working banner. If you are evaluating either, push for a hands-on test and clear performance and pricing terms before signing.
Pricing at a glance (30,000 visitors, 2 domains)
The tools that publish a price, at a comparable size. "Contact sales" means expect four to five figures a year.
| Tool | Entry price at ~30k visitors |
|---|---|
| ConsentStack | $29/mo (Pro) |
| CookieYes | ~$25/mo (per domain) |
| Termly | ~$15-20/mo (Pro+) |
| iubenda | ~$25/mo per site (Advanced) |
| Enzuzo | $79/mo (Pro, the 30k tier) |
| Cookiebot | ~$34/mo+ (per domain) |
| Complianz | ~$59-399/yr (WordPress/Shopify only) |
| Ketch | $150/mo |
| Osano | $199/mo (Plus) |
| OneTrust | ~$10,000+/yr (custom) |
| Transcend / TrustArc | Custom (enterprise) |
ConsentStack publishes every price, from free to $79 a month: full compliance without the enterprise price tag or the procurement process. Full multi-vendor pricing math is in the consent management platform pricing guide.
Special cases: healthcare, publishers, and WordPress
A few situations narrow the field fast, so if one of these is you, start here.
Healthcare. If your site touches health data, you need a signed Business Associate Agreement from anything that processes visitor data, and most CMPs will not sign one, or gate it behind an enterprise contract. Among the general-purpose tools here, ConsentStack offers a BAA on its standard $79 a month plan; the dedicated healthcare option is Freshpaint, a specialist sold through sales. A BAA covers the consent layer, not your whole site's HIPAA obligations. More in cookie consent and BAAs.
Publishers running programmatic ads. If you need the IAB Transparency and Consent Framework (TCF) for header bidding, you need a TCF-certified CMP. ConsentStack does not support TCF; Cookiebot/Usercentrics, OneTrust, and Didomi do.
WordPress-only sites. If you will never leave WordPress, a self-hosted plugin like Complianz keeps your consent data and blocking on your own site, and its free tier is genuinely capable.
FAQ
Frequently Asked Questions
It depends on what you need. For the cheapest possible banner on a single small site, CookieYes or Termly. For an enterprise that wants a whole privacy suite with procurement to match, OneTrust or Ketch. For a WordPress-only site, Complianz. For small and large businesses that want a modern CMP with trackers gated by default, deep customization, and published pricing, ConsentStack.
For a real free tier that includes automatic script blocking, CookieYes (5,000 pageviews) and Complianz (WordPress and Shopify, no pageview limit) are the strongest. ConsentStack's Basic plan is free forever for a small single-domain site. Watch the catches: free tiers often exclude branding removal, geo-targeting, or Consent Mode, and some (like Termly) disable the banner once you pass a view cap.
For 30,000 monthly visitors and 2 domains, a working CMP with real script blocking runs roughly $29 to $150 a month. Below about $29 you are often getting a banner that looks the part but may not gate trackers by default. If a tool requires a sales call, expect $10,000 a year or more. Check the metering: per-subpage or per-session billing can cost far more than your real visitor count suggests.
No, and this is the most important thing on this page. In our July 2026 scan of over 900 small and mid-sized sites running the four leading consent tools, as they were configured, 91% (829 of 912) still fired a third-party tracker before the visitor answered the banner, usually because a tag was placed above the consent gate. A banner that appears is not the same as a banner that works. Whatever tool you pick, scan your own site to confirm trackers are actually held until consent.
Parse-time blocking means the tool intercepts each script as the page is being built, before the browser runs it, so a tracker never gets the chance to fire early. Runtime blocking tries to catch scripts after the page has started executing, which leaves a window where trackers can slip through. Some tools do not block at all, they only signal your consent choice to ad platforms. ConsentStack takes a parse-time approach, which is part of why gating is on by default.
You want a tool that signals your visitors' consent to your ad and analytics platforms (Google Consent Mode v2 is the common standard) as well as physically blocking trackers before consent. Signaling alone tells Google what the visitor chose but does not stop the request from firing early; blocking does. The strongest setup does both, which is why the "block versus signal" distinction is worth checking before you commit.
The bottom line
Consent management is an industry that has been neglected for years, and it shows. On one side sit enterprise suites: custom-quoted, weeks to implement, heavy with modules most sites never use. On the other, budget banners: cheap, but often signaling consent rather than truly blocking it, and sometimes disabling themselves at a view cap. Almost none of the popular roundups will tell you that, because they were written to sell one of those products.
Pick the tool that fits your situation. If you need a full governance suite and have procurement to run it through, the enterprise platforms earn their price. If you run one small site on a shoestring, the budget tools can work as long as you turn blocking on and verify it. For everyone else, small or large, ConsentStack is the modern rebuild: full compliance with no compromise, a banner that looks like part of your site, gating on by default, and pricing you can read without a sales call.
Whatever you choose, do not take our word or anyone else's. Every claim in this article is checked against published pricing, vendor documentation, and our own scan of live sites. Then check your own site the same way we checked theirs.
Find out where your site stands
Run the same scanner behind our research study against your own site. See which trackers fire before consent and which ignore Reject, in about a minute, with no signup.
Related Posts
How Much Does a Consent Management Platform Cost? (2026 Pricing Guide)
What consent management platforms actually cost in 2026: entry prices, billing units (per domain, pageview, session, or visitor), and hidden fees, compared across 10 CMPs from free to enterprise.
Cookiebot Pricing Explained (2026): What You Actually Pay
What Cookiebot really costs in 2026: the per-subpage tiers, the August 2025 price increase, and the per-domain math, with a flat-priced alternative from $29/mo.
Cookie Consent Requirements: What You Actually Need, by Region (2026)
Cookie consent requirements depend on where your visitors are. The EU and UK require opt-in before non-essential cookies load. California and other US states require notice and a working opt-out, not a banner. Here is what each demands, what they share, and where sites fail.
Which Cookie Consent Tools Sign a BAA? (2026)
Most cookie banners won't sign a BAA, and the ones that do usually gate it behind an enterprise contract. Here's who signs one, what it takes, and how ConsentStack does it on a published $79/mo plan.