Privacy
Consent management tools that record the choice before the tag fires (2026)
A 2026 shortlist of CMPs. Public docs, not legal advice. DSAR overlap declared.
Expertise: Privacy · Level: Intermediate · 12 min read
A cookie banner that lies is worse than no banner.
DSAR is find and delete a person. Consent is whether the tag was allowed to run. Overlap declared. This is not legal advice. I will not teach a dark pattern.
Six CMPs. One open banner. Three mid-market SaaS. One suite. One Choice shelf. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Klaro | Open consent manager you can host | BSD-3-Clause |
| Osano | Mid-market CMP plus consent record | Commercial |
| Cookiebot | Scan-and-banner CMP people already know | Commercial (free tier) |
| OneTrust CMP | CMP on the suite you may already own | Commercial |
| Quantcast Choice | IAB-shaped Choice CMP | Commercial (free tier stories) |
| Termly | Policy pages plus a consent widget for a small site | Commercial (free tier) |
Klaro
Best for open consent manager you can host
Klaro is an open cookie and consent manager. Config in your repo. You host the script.
Key features
- You host it
- Category config
- BSD-3-Clause
- No vendor tag required
Why we like it
This is the hidden gem. A banner you can grep beats a CMP you cannot debug on a Friday.
Limits
You staff translations and legal copy. Not a DSAR desk. Counsel still owns the statute.
Osano
Best for mid-market CMP plus consent record
Osano sells consent, cookie blocking, and a record. Common next step after a handmade banner.
Key features
- Consent record they sell
- Script blocking
- SaaS
- Commercial
Why we like it
When you need a record for counsel, a hosted CMP is the job.
Limits
Commercial. You still classify tags honestly. We did not run a tenant.
Cookiebot
Best for scan-and-banner CMP people already know
Cookiebot scans the site you own and builds a banner. Now under Usercentrics. Free tier exists.
Key features
- Cookie scan
- Banner
- Free and paid
- Usercentrics estate
Why we like it
Known mid-market button. Scan quality is the product.
Limits
Scan lag. You still fix tags the scan misses.
OneTrust CMP
Best for cMP on the suite you may already own
OneTrust cookie consent sits next to the TPRM module on the vendor-risk list. Overlap declared. Do not buy two suites.
Key features
- Cookie consent they sell
- Same OneTrust tenant
- Records
- Commercial
Why we like it
If the suite is already there, start with the CMP module.
Limits
Suite gravity. Cost. Implementation time.
Quantcast Choice
Best for iAB-shaped Choice CMP
Quantcast Choice is a CMP aimed at IAB TCF-shaped ads. Honest when the site is ad-funded.
Key features
- TCF-shaped flows they document
- Choice CMP
- Publisher-shaped
- Commercial / free stories
Why we like it
A blog CMP and an ad CMP are different products. Say which you are.
Limits
Ad-ecosystem gravity. Not a DSAR product. Counsel still owns the basis.
Termly
Best for policy pages plus a consent widget for a small site
Termly sells policy generators and a consent manager. Common on small marketing sites.
Key features
- Policy generator
- Consent widget
- Free and paid
- Small-site shaped
Why we like it
Honesty. A lot of marketing sites already live here. Generated policy is not counsel.
Limits
Generator quality. Not an enterprise CMP. Not legal advice.
What the internet thinks about consent management
Consent threads treat a lying banner as contempt. We keep that line. This is not legal advice and not a dark-pattern kit.
hypertele-Xii on Hacker News, Dec 2022: “I use Consent-O-Matic browser addon which automatically hides cookie banners and rejects them in the background.”
Prove Klaro still publishes
Confirm Klaro still publishes. Wire it only on a site you operate. Reject must mean reject.
curl -fsSIL https://klaro.org/ | head -n 8FAQs
Does a CMP replace a DSAR tool?
No. Consent is the tag. DSAR is the person. Link both.
Is this legal advice?
No. Counsel owns the statute. We compare collectors.
Where is the company privacy policy?
/privacy-policy/ is the legal page. /privacy/ is this pillar.
Is this a scored bake-off?
No.
