Consent management platforms for a small US site
For a small business site with visitors in both the EU and the US that wants one banner to handle both. 7 consent management platforms, measured against what the GDPR, the ePrivacy Directive and the California rules ask of a cookie banner, from each vendor’s own documentation. read 2026-10-22
Best overall
Osano
The only one whose own pages say yes on every row; confirm which plan carries each feature before you buy.
Best for a one-site shop
CookieHub
Blocking, proof of consent and Global Privacy Control on every plan, the free one included, for a site under 1,000 sessions a month.
Best for an agency managing many sites
Complianz
A multisite edition for WordPress agencies, and the plugin keeps its data on each site's own server.
The requirements, platform by platform
Each row is something the rules ask of a banner, with the article or section it comes from. Read across for one requirement; read down for one platform. Before you pick, run your current banner through the cookie banner checklist to see which rows you already meet.
| Requirement | CookieYes | Cookiebot | iubenda | Termly | Osano | Complianz | CookieHub |
|---|---|---|---|---|---|---|---|
| Blocks non-essential cookies until consentePrivacy Art. 5(3); GDPR Art. 6(1)(a) | yes | yesmanual on the free plan | yes | yes | yes | yesknown services | yes |
| Keeps a consent record you can exportGDPR Art. 7(1) | yesCSV; 1 year on free | paid planCSV export | not statedlog on every plan; export not stated | paid plan | yes | paid planrecords; export not stated | not statedproof of consent kept |
| Honors Global Privacy Control signalsCCPA regs § 7025 | paid plan | yes | yes | yesper its release notes | yes | paid plan | yes |
| Shows a “Do Not Sell or Share” linkCal. Civ. Code § 1798.135(a)(1) | yes | yesfor California visitors | yes“Your Privacy Choices” link | yes | yes | yesopt-out page | yes |
| Offers a data processing agreementGDPR Art. 28(3) | yes | yes | yes | yes | yes | not stateddata stays on your server | yes |
| Serves a different banner by regionopt-in (ePrivacy Art. 5(3)) vs opt-out (§ 1798.135) | paid plan | paid plan | paid plan | paid plan | yes | paid plan | paid plan |
| Supports the IAB Transparency and Consent FrameworkIAB Europe TCF (ad-funded sites) | paid plan | paid planPremium | paid plan | paid plan | yes | paid plan | paid plan |
| Finds and blocks scripts automatically (scanner)what ePrivacy Art. 5(3) covers on your site | yes5 scans a month on free | paid planfree: one initial scan | partialauto-blocking labelled experimental | yesscan frequency by plan | yes | yesfull site scan premium | yesone-time scan on free |
| On Google’s certified CMP listGoogle ads in the EEA, UK and Switzerland | yes | yes | yes | yes | yes | yes | yes |
Source: vendor documentation, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | |||||||
What the rules ask of a banner
Two different models meet on one banner. In the EU, the ePrivacy Directive lets a site store or read cookies only after the visitor agrees, unless the cookie is strictly necessary for the service they asked for (Art. 5(3)). Under the California law, most cookies can run until the visitor opts out, but a business that sells or shares personal information must give them the way to do it. Our GDPR and CCPA side-by-side covers the rest of the difference, and the which-laws tool tells you whether both reach you.
“Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.”
That sentence is why the consent record matters: a banner that cannot show who agreed to what, and when, leaves you with nothing to demonstrate. On the US side, the opt-out has two doors. One is the link: what it must say and where it goes is in our guide to the “Do Not Sell or Share” link. The other is a signal the visitor’s browser sends without a click.
“A business that sells or shares personal information shall process any opt-out preference signal that meets the following requirements as a valid request to opt-out of sale/sharing”
Global Privacy Control is one such signal, sent by some browsers and by browser extensions. Our GPC checker shows whether your own browser is sending it, which is the quickest way to test a banner after you set it up.
If you run Google ads to visitors in the EEA, the UK or Switzerland, Google requires a CMP it has certified. All 7 platforms here are on Google’s list today; our copy of the certified list explains what the listing does and does not prove.
Each platform in short
What each one is, who it fits, how it meets the rows, and what to confirm with the vendor. If you already run one of the two most common banners, our CookieYes alternatives and Cookiebot alternatives pages compare the switch on the same rows.
CookieYes
What it is
A cookie banner with auto-blocking, a cookie scanner and a consent log, run from a hosted dashboard.
Who it fits
A single small site that wants blocking and an exportable consent log before paying anything.
What the rule requires and whether it meets it
Auto-blocking and the consent log are on every plan, and the log exports as CSV (one year back on the free plan, five on paid ones). Global Privacy Control, region-based banners and the IAB framework start at the Pro plan.
Check with the vendor
Its US banner is sold as a “US State Laws template (opt-out)”. Confirm the link text matches the wording California requires.
Cookiebot
What it is
The consent platform of Usercentrics, sold as a free plan and a ladder of Premium plans.
Who it fits
A small site that must honor Global Privacy Control from day one. The free plan covers one domain and up to 50 subpages.
What the rule requires and whether it meets it
GPC is listed on the free plan, and it shows the “Do Not Sell Or Share” link to visitors it detects as Californian. Automatic blocking, monthly scans, region-based banners, the IAB framework and CSV export of consent records are Premium.
Check with the vendor
The data processing agreement is published as an unsigned template. Ask how it is executed for your account.
iubenda
What it is
A cookie banner (its “Privacy Controls and Cookie Solution”) sold alongside privacy and cookie policy generators.
Who it fits
A site that would rather buy the cookie banner and the policy documents from the same company.
What the rule requires and whether it meets it
Scripts wait for consent, a GPC signal is detected automatically, and a “Your Privacy Choices” link covers the US laws. The data processing agreement sits inside its terms. A banner that changes by region needs the Advanced or Ultimate plan.
Check with the vendor
Its own help article calls auto-blocking experimental and points to other prior-blocking methods. Every plan keeps a consent log, free included; how you would export it is not covered on the pages we read.
Termly
What it is
Policy generators and a consent platform under one account, with a free plan and an Agency plan.
Who it fits
A small site starting on a free plan, or an agency that wants one account for client sites.
What the rule requires and whether it meets it
Its Script Auto Blocker and site scans are on every plan, with scans more frequent on higher plans. It supports a “Do not sell or share” link. Pro+ and Agency are where the exportable consent log, regional consent rules and the IAB framework sit.
Check with the vendor
A notice confirming an honored GPC signal arrived in its 1 January 2026 release notes, with no plan named. Before California visitors depend on it, check that your plan has it.
Osano
What it is
A privacy platform whose cookie consent product sits beside request handling and vendor checks. Its self-service plans start with a free plan for one domain and 5,000 monthly visitors.
Who it fits
A firm that expects to add privacy requests and vendor reviews to the same platform later.
What the rule requires and whether it meets it
Its product page lists every row in the table: tag and cookie blocking, exportable consent logs, GPC, “Do Not Sell/Share” management, localized banners, IAB strings and scheduled scans. Its processing addendum is on its trust hub.
Check with the vendor
The pages we read do not say which plan includes which of these features. Get that in writing before you choose a plan.
Complianz
What it is
A WordPress plugin. Its site says the plugin and its stored data stay on your own server.
Who it fits
WordPress sites, and agencies running many of them: the Agency edition adds a multisite plugin.
What the rule requires and whether it meets it
The free plugin blocks known third-party services, adds an opt-out page for California and offers region-specific banner templates. GPC, banners chosen by visitor location, the IAB framework and records of consent are premium.
Check with the vendor
Exporting consent records is not described. If you use any Complianz service that handles visitor data off your server, ask for its processing terms.
CookieHub
What it is
A hosted consent platform with five plans, from Free to Enterprise.
Who it fits
A one-site shop that needs GPC and blocking on the free plan.
What the rule requires and whether it meets it
Every plan carries blocking, proof of consent and GPC, under a data processing agreement made under GDPR Art. 28. Consent settings by location begin at Basic, and the IAB framework at Business.
Check with the vendor
The free plan is for sites under 1,000 sessions a month; past that, CookieHub says the banner stops showing until you upgrade. Free keeps consent records for one month and the pricing page does not describe exporting them. Ask how you would produce a record a year later.
How we compared them
We started from the platforms a small US or EU business site is most likely to shortlist: hosted banners with a free or entry plan, one WordPress plugin, and one broader privacy platform. Each is on Google’s certified CMP list. Enterprise suites built for large privacy teams are compared on our OneTrust alternatives page instead.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-22; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
Does a site with only US visitors need a cookie banner?
The California law does not ask for consent before most cookies run. It asks for a way to opt out of selling or sharing, through the “Do Not Sell or Share” link and by honoring opt-out signals such as GPC. A banner is often the easiest place to put both. Once visitors from the EU arrive, the ePrivacy consent rule applies to them.
Is a consent management platform enough to comply?
No tool makes a site compliant on its own. The rules apply to what your site actually does: which scripts load before a choice is made, what the banner says, and whether the record holds up. Run our cookie banner checklist, linked above, once the platform is live.
What does honoring Global Privacy Control mean for a California business?
Under § 7025 of the CCPA regulations, a business that sells or shares personal information treats a valid opt-out preference signal as a request to opt out of sale and sharing. The platform has to detect the signal and switch off the scripts that sell or share for that visitor.
Why does “paid plan” appear so often in the table?
Most of these platforms put region-based banners, the IAB framework and longer consent records on paid tiers. The table names the feature, not the price. Check the vendor’s own plan page, linked on each card, for the tier that carries what you need.
Do I still need a cookie policy if the platform lists my cookies?
The banner tells visitors what you ask; the cookie policy is where you explain each cookie in full. Our cookie policy template builds one from the same categories your banner uses.