Privacy
6 Consent Management Platforms for Cookie and Privacy Compliance in 2026
Wait before the tag fires, and keep a record you can export. A screenshot of the banner is not that record.
Expertise: Privacy · Level: Intermediate · 6 min read
GDPR Article 7 says the controller shall be able to demonstrate that the person consented to processing. The pixel can fire before the banner waits. A screenshot of that modal is not an exportable record of the choice.
The workflow is wait, then fire, then keep a log counsel can open. A TCF-speaking CMP does that for ad-funded inventory. A lighter banner can still log a choice if reject actually blocks the script. A tag manager that never waited only proves the pixel ran.
Exporting a person is a different ticket and already lives on DSAR tools. This is not legal advice. Counsel owns the statute.
How we evaluated
We read first-party docs, source, licenses, and release notes, and we treat a marketing page as a claim, not as proof that two products do the same work.
We cared about whether the tag can wait, whether the record is exportable, whether TCF is real or a logo, and whether the docs treat this as a choice signal rather than a privacy policy.
We read first-party docs, licenses, and release notes. Unless a write-up says otherwise, we did not run a paid tenant.
| Tool | Best for | What to check |
|---|---|---|
| Klaro | Open consent manager you can host | Open CMP · BSD-3-Clause · you host it |
| Osano | Mid-market CMP plus consent record | Consent record · commercial · script blocking they sell |
| Cookiebot | Scan-and-banner CMP people already know | Scan-and-banner · free / paid · Usercentrics estate |
| OneTrust CMP | CMP on the suite you may already own | Suite CMP · commercial · same OneTrust tenant |
| Quantcast Choice | IAB-shaped Choice CMP | TCF-shaped Choice · commercial / free stories · publisher-shaped |
| Termly | Policy pages plus a consent widget for a small site | Policy pages plus widget · free / paid · small-site shaped |
Klaro
Best for open consent manager you can host
Klaro is an open cookie and consent manager. Config in your repo. You host the script.
A banner you can grep beats a CMP you cannot debug on a Friday. You staff translations and legal copy. Not a DSAR desk. Counsel still owns the statute.
Key features
- You host it
- Category config
- BSD-3-Clause
- No vendor tag required
Why we like it
Config in git is how you prove reject still works on a Friday.
Limits
You staff translations and legal copy. Not a DSAR desk. Counsel still owns the statute.
Osano
Best for mid-market CMP plus consent record
Osano sells consent, cookie blocking, and a record. Common next step after a handmade banner.
When you need a record for counsel, a hosted CMP is the job. You still classify tags.
Key features
- Consent record they sell
- Script blocking
- SaaS
- Commercial
Why we like it
A record counsel can open is the reason to leave a handmade banner.
Limits
Commercial. You still classify tags.
Cookiebot
Best for scan-and-banner CMP people already know
Cookiebot scans the site you own and builds a banner. Now under Usercentrics. A free tier exists.
Known mid-market button. Scan quality is the product. Scan lag is the catch. You still fix tags the scan misses.
Key features
- Cookie scan
- Banner
- Free and paid
- Usercentrics estate
Why we like it
A scan that builds the banner is useful when nobody wants to maintain a category file.
Limits
Scan lag. You still fix tags the scan misses.
OneTrust CMP
Best for CMP on the suite you may already own
OneTrust cookie consent sits next to the TPRM module on the vendor-risk list. Overlap declared. Do not buy two suites.
If the suite is already there, start with the CMP module. Suite gravity and implementation time are the catch.
Key features
- Cookie consent they sell
- Same OneTrust tenant
- Records
- Commercial
Why we like it
Honesty. The tenant you already pay for is the first enterprise banner.
Limits
Suite gravity. Commercial. Implementation time.
Quantcast Choice
Best for IAB-shaped Choice CMP
Quantcast Choice is a CMP aimed at IAB TCF-shaped ads. Honest when the site is ad-funded.
A blog CMP and an ad CMP are different products. Say which you are. Not a DSAR product. Counsel still owns the basis.
Key features
- TCF-shaped flows on the public docs
- Choice CMP
- Publisher-shaped
- Commercial / free stories
Why we like it
Ad-funded inventory needs an IAB-shaped flow. A blog widget is the wrong door.
Limits
Ad-ecosystem gravity. Not a DSAR product. Counsel still owns the basis.
Termly
Best for policy pages plus a consent widget for a small site
Termly sells policy generators and a consent manager. Common on small marketing sites.
A lot of marketing sites already live here. Generated policy is not counsel. Not an enterprise CMP. Not legal advice.
Key features
- Policy generator
- Consent widget
- Free and paid
- Small-site shaped
Why we like it
Honesty. Small marketing sites already bought this. Treat the generator as a draft.
Limits
Generator quality. Not an enterprise CMP. Not legal advice.
What we left out
- TrustArc. People want the privacy suite they already bought for assessments. Consent is the banner and the record, not a privacy-program bake-off.
- Didomi. Publishers want another IAB TCF CMP. Quantcast Choice already covers the TCF-shaped job on this page.
Consent threads treat a lying banner as contempt. This is not legal advice and not a dark-pattern kit.
Questions before you buy
A quote that cannot answer these is selling a different product.
- Does a rejected category on a site we own never load that script?
- Do we need a record for counsel, or only a banner we can grep?
- Is this site ad-funded TCF, a marketing page, or an enterprise suite we already pay for?
Wait, then fire. Keep a record. Counsel owns the statute.
FAQs
Does a CMP replace a DSAR tool?
No. Consent is the tag. DSAR is the person. Those are different jobs. Open the matching list for the other one.
Is this legal advice?
No. Counsel owns the statute. We compare collectors.
Where is the company privacy policy?
/privacy-policy/ is the legal page. /privacy/ is this pillar.
Is this a scored bake-off?
No.
