If you build or maintain client sites, pick ConsentLayer, because one Studio plan at $29 per month covers 10 sites with 500,000 pooled pageviews, 5 team members, and a 1-year consent log, so the next client adds no new subscription. When one site must send IAB TCF strings to its ad partners, pick iubenda, which includes TCF 2.2 on every Core plan, or CookieYes on its Pro or Ultimate plan, because ConsentLayer has no TCF support.
What a consent management platform does
A consent management platform is the software that shows a visitor the choice about cookies and trackers, holds those trackers until the visitor decides, records the decision, and lets the visitor change it later from a link on the page.
Two states look like compliance from the dashboard and leave the client exposed on the live site. The first is a site that’s fully configured in a vendor dashboard while the tag never reached the client’s real domain, because the install sat in a staging branch or a theme the client later swapped out. In the second, the banner shows while analytics and ad pixels already fired on page load, so the visitor is asked a question the site has already answered.
For a builder with a roster of client sites, a platform turns consent into one routine you repeat on the next site: add the domain, scan it, place the tag, confirm it’s live, and hand the client a record.
What to look for in a consent management platform
How the price scales across your sites
At ten client sites on per-domain subscriptions you carry ten plans, ten renewal dates, and ten invoices to pass through. On one pooled plan, like ConsentLayer’s, the organization holds a single pageview allowance that every site draws from, so a quiet brochure site leaves room for a busy shop.
Client number eleven is where the models separate, because per domain you open another subscription, while pooled you add the site and confirm the combined pageviews still fit. Find the unit of pricing (domain, pageview, or organization) on a vendor’s plan page before you compare prices, because that unit is what you’ll be billed on when your roster doubles.
Trackers held until the visitor chooses
Open a client site in a private window with the network panel recording, and before you click anything you’ll see which third-party hosts already received a request. Each of those requests went out without a decision from the visitor, and the client carries the exposure for each one. The banner with its two buttons is the visible part, and the blocking is the part that protects the client.
- Open a private window so no earlier consent cookie is in play, with the network panel open before you type the address.
- Load the page, filter to third-party domains, and note every request that fires before the banner shows.
- Click reject, reload, and confirm the list stays empty, then accept, reload, and confirm the held scripts run.
A platform must also catch scripts injected after page load, because a tag manager can add a tracker a second after the banner appears. ConsentLayer holds known trackers until the visitor consents, then runs the held scripts, and how to check which pixels fire on a site covers the same check in detail.
Laws and regions it can tell apart
One client site serves a visitor in Berlin and one in Los Angeles, and the law asks different things of each. The Berlin visitor needs an opt-in with nothing non-essential running until they accept, while the Los Angeles visitor needs a notice and a working “Do Not Sell or Share” link, with trackers allowed until they opt out.
Serve the EU banner to both and the California visitor meets a wall where the law asked for a link, while the US notice served to both lets the Berlin visitor’s trackers fire before consent.
The check is whether one site can show a different banner and default by region, and on which plan. Cookiebot’s Free plan leaves geotargeting out, along with implicit consent and auto-translation, so a free setup there serves one banner to every visitor. Region targeting is a plan feature, so check the plan before you promise a client that EU and US visitors each get the right banner.
Consent Mode v2 and Global Privacy Control signals
When consent signals are missing for EEA visitors, the client’s Google Ads account shows a warning on its consent setup, and conversions from those visitors stop feeding bidding and audiences, so the client sees a measurement drop before any regulator sees anything. A banner alone sends no signal, because Google reads a consent state set in the page’s tag code, so the platform has to update that state when the visitor decides.
Global Privacy Control is the other signal, a header the visitor’s browser sends to say “don’t sell or share my data”, and California treats it as a valid opt-out.
- Turn on the GPC setting in Firefox or Brave, load the client site, and open that visit in the consent log to confirm the record shows the signal was honored and which categories it switched off.
- Load the site through an EEA VPN exit, open Google Tag Assistant, and read the consent state on the first hit, which should show denied defaults before any click.
- Check GPC on the plan you’d buy, because a vendor can put it on upper plans only.
Proof you can hand the client
When a client’s lawyer asks for one visitor’s consent record, you hand over a line with the date and time, the categories the visitor allowed or refused, the version of the consent text they saw, and the banner they were shown, and that line settles the dispute. Without it you have only a screenshot of the banner, which proves the dialog existed and not that this visitor answered it.
So check what the free and entry plans record and export. ConsentLayer records every decision on every plan, including Free, and from the Studio plan up the consent log with CSV export gives you a file to send the lawyer the same day. Cookiebot’s Free plan leaves out CSV export, so a client on that plan has no export to hand over.
Self-serve or sales-led
Before a banner is live on a self-serve platform you sign up, pick a plan, and paste a tag, so a client site can be protected the same afternoon you take the brief. On a sales-led platform you book a demo, wait for a quote, and sign a contract before you see a tag, which fits an enterprise with a procurement process.
Cookiebot’s free 14-day trial gives one domain every Premium feature, and when it ends the banner stops displaying and consent collection stops with it, so put that date in the client’s calendar as well as yours, because the client is the one who’ll get the complaint.
OneTrust is the sales-led option for that enterprise. Its CMP Base and CMP Suite price on average daily visitors aggregated across all channels and properties with no listed price. It names GDPR, CCPA, and CPRA, and syncs consent across websites, mobile apps, and OTT and CTV platforms, so a company whose streaming app and website must share one consent state has reason to take the demo call.
The options
ConsentLayer
Ten client sites on ConsentLayer draw from one pageview allowance, because pageviews are pooled across every site in the organization on the Studio and Agency plans, so the next client is a new site rather than a new subscription. Coverage is GDPR, CCPA/CPRA, and LGPD, and Google Consent Mode v2 is on every plan, including Free. Plan limits are on the ConsentLayer pricing page.
Cookiebot
Cookiebot prices per domain and by the number of subpages inside it, so when a client’s site grows past its band that domain’s plan steps up. The bands run from Premium Lite for one domain to Premium XLarge for more than 7,000 subpages, and Cookiebot states that it does not charge on pageviews or usage.
- Banner templates cover GDPR, CCPA/CPRA, VCDPA, LGPD, and POPIA.
- Google Consent Mode integration and the Global Privacy Control signal are in both Free and Premium.
- IAB TCF 2.3 is Premium only, so a client with programmatic ad partners needs the paid plan.
CookieYes
A California visitor who arrives at a CookieYes site on the Basic plan with Global Privacy Control switched on gets the banner’s default treatment, because CookieYes honors the GPC signal on Pro and Ultimate only. Move that site to Pro and the same header is read as an opt-out. Google Consent Mode v2 is on all CookieYes plans.
Pricing is per domain across Free, Basic, Pro, Ultimate, and a custom Enterprise tier, billed monthly or annually, and Basic and Pro add an overage charge per 1,000 pageviews beyond the plan limit.
iubenda
A client with Swiss or Brazilian visitors gets a vendor that names Switzerland’s nFADP and Brazil’s LGPD alongside Europe and UK GDPR, ePrivacy, and the US state laws under CCPA/CPRA, so iubenda is the pick when a client’s traffic comes from Zurich.
| iubenda | Detail |
|---|---|
| Price model | Core plans Essentials, Advanced, and Ultimate, billed per site per month, each with a pageview allowance and an overage charge per 1,000 pageviews above it; yearly billing is discounted |
| Google Consent Mode v2 | Supported on the free plan too, in iubenda’s words “Yes, even on the free plan” |
Comparison table
| ConsentLayer | Cookiebot | CookieYes | iubenda | |
|---|---|---|---|---|
| Price model | Studio $29 per month, 10 sites, 500,000 pooled pageviews, 5 team members, 1-year consent log; pooled across the organization | Per domain by subpage band, Premium Lite (1 domain) to Premium XLarge (more than 7,000 subpages); no charge on pageviews | Per domain; Free, Basic, Pro, Ultimate, Enterprise (custom); overage per 1,000 extra pageviews on Basic and Pro | Per site per month on Essentials, Advanced, Ultimate; pageview allowance with overage per 1,000 above it; yearly discount |
| Laws named | GDPR, CCPA/CPRA, LGPD | GDPR, CCPA/CPRA, VCDPA, LGPD, POPIA templates; GDPR and ePrivacy (EU), US state regulations | GDPR template (opt-in), US State Laws template (opt-out) | Europe and UK GDPR and ePrivacy, CCPA/CPRA, LGPD, nFADP |
| Google Consent Mode | v2 on every plan, including Free | Included in Free and Premium | v2 on all plans | v2, including the free plan |
| IAB TCF | No TCF support | TCF 2.3 on Premium only | TCF Certified CMP on all plans; TCF v2.3 framework and pre-built TCF banner on Pro and Ultimate | TCF 2.2 in all Core plans |
Vendor plan terms are dated 12 October 2026, so read the plan again on the day you sign.
Questions builders ask before they pick
How long does it take to set up a consent management platform?
Under an hour for the first client site, and far less for each repeat. Cookiebot describes its install as register, choose a banner, copy its code, and paste it into the site header, and iubenda’s version is copy and paste one script to be live in minutes. Most of the hour goes to waiting for a deploy.
Is there a free consent management platform?
ConsentLayer’s Free tier costs nothing forever, needs no credit card, and gives 1 site, 10,000 pageviews a month, 1 team member, 1 banner language, and a 30-day consent log. Cookiebot’s Free tier is limited to 1 domain and 50 subpages, with manual blocking only. CookieYes allows 5,000 pageviews monthly and one Free tier per account.
How do you run the same consent setup on many client sites?
Export the first site’s full configuration as JSON, then import it into the next site. The export carries the design, behavior, categories, services, cookies, translations, and geo groups, so a template you tune once for a dental practice becomes the starting point for the next one.
Does a consent management platform work with Google Tag Manager?
Yes, through triggers that wait for consent. ConsentLayer pushes a consentlayer_consent_update event to the dataLayer so your GTM triggers can fire on it. Cookiebot includes GTM and a WordPress plugin in Free and Premium, CookieYes integrates with GTM and Microsoft UET for consent-gated triggers, and iubenda’s Core plans include GTM, WordPress, and Shopify integrations.
Set up ConsentLayer on a client site
1. Tell your agent to set up the site
Give the AI you already use one prompt with the client’s domain.
Set up ConsentLayer for harborlightdental.comBehind that prompt, setup_site is one tool call that creates the site in your organization, scans it for trackers, configures the consent categories from the scan, and returns the install snippet with a real project key. You sign in through your browser the first time, and the full agent setup flow covers the connection step.
Without an agent: sign in at app.consentlayer.com, create the site with the client’s domain, run the scan from its dashboard, and copy the snippet.
2. Put the tag in the head of every page
The snippet goes in the <head> of every page, before any analytics or ad script, loaded synchronously with no defer and no async, because a tag that loads after the pixels can’t hold them. You paste it into the theme header, your agent edits the layout file, or a hosted builder’s head-code setting takes it. Then deploy to the real domain, not staging, and clear the page cache, because a cached page keeps serving the old head until it expires.
3. Check that the site is protected
Ask the agent to run check_installation, which fetches the live homepage, confirms the tag is in <head> without defer or async, and reports a score out of 100, with the open items named.
Check the ConsentLayer installation on harborlightdental.comA protected site shows three signs at once: the tag is live in <head> on the real domain, blocking is on so trackers wait for the visitor’s decision, and decisions are recorded in the consent log.
Without an agent: open the site in the dashboard at app.consentlayer.com for the same score and open items.
Set up your first client site free, with no credit card, at app.consentlayer.com/register.