Termly vs iubenda
For a small site choosing one account for its privacy policy and its cookie banner. The two bundles, head to head, measured on what the GDPR, the ePrivacy rule and the California rules ask of each half, and on which plan carries each piece, from each vendor’s own pages. read 2026-10-22
Best for a single policy that serves EU and US readers
iubenda
Its GDPR policy takes the US state sections when you switch on one setting, and every plan, free included, keeps the text updated as laws change.
Best for proving consent on a small budget
iubenda
Its consent log is on every plan, the free one included; Termly keeps logs from Pro+.
Best for a California site that takes requests
Termly
A request form on every plan, and a notice that tells a visitor their GPC opt-out was honored; iubenda's form needs Ultimate.
The requirements, side by side
The first table is the policy, the second the banner and the requests that come through it. Each row is something a rule asks for, with the article or section beside it. Where a feature sits on a paid plan, the note names the plan. If you are still choosing between more than these two, the privacy policy generators compare measures six.
The privacy policy
| Requirement | Termly | iubenda |
|---|---|---|
| Covers the GDPR notice itemsGDPR Art. 13(1)–(2) | yes | yesfree plan: no retention input |
| Covers the CCPA privacy policy itemsCiv. Code § 1798.130(a)(5); regs § 7011 | yes | yesone US toggle |
| Covers the other US state lawse.g. Va. Code § 59.1-578(C) | paid plan16 more state laws | yesthe states it supports |
| Updates the text when the law changes§ 1798.130(a)(5): at least every 12 months | paid planStarter updates; Pro+ auto-updates | yesfree plan too |
| Publishes a policy that changes in placeregs § 7011(d): posted online, conspicuous link | paid planPro+; free is static HTML | yes“self-updating” policy |
| Writes the policy in the reader’s languageGDPR Art. 12(1): intelligible form | paid planPro+ | paid planall languages from Advanced |
| Links a notice at collectionCCPA regs § 7012(c) | not stated | yesvia its privacy widget |
Source: vendor documentation, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | ||
The banner, the requests and the contract
| Requirement | Termly | iubenda |
|---|---|---|
| Blocks non-essential cookies until consentePrivacy Art. 5(3) | yesauto-blocker on every plan | yes |
| Keeps a consent recordGDPR Art. 7(1) | paid planlogs and export on Pro+ | yesfree plan too; export not stated |
| Honors Global Privacy ControlCCPA regs § 7025(b)–(c) | yesper its release notes | yesdetected automatically |
| Shows the visitor the signal was honoredCCPA regs § 7025(c)(6) | yesa toast notice | not stated |
| Gives the opt-out link§ 1798.135(a)(1); regs § 7015 | yes“Do Not Sell or Share” link | yes“Your Privacy Choices” link |
| Serves a different banner by regionopt-in (Art. 5(3)) vs opt-out (§ 1798.135) | paid planPro+ | paid planAdvanced and Ultimate |
| Takes rights requests through a web formGDPR Art. 12(3); § 1798.130(a)(1) | yesform on every plan | paid planUltimate |
| Offers a data processing agreementGDPR Art. 28(3) | yespart of its terms | yespart of its terms |
Source: vendor documentation, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | ||
Which plan carries what
Both vendors sell a free plan and three paid ones, and both put the features the rules ask for on different rungs. Termly’s ladder is Free, Starter, Pro+ and Agency; iubenda’s is Free, Essentials, Advanced and Ultimate. The table names the first plan that carries each item, as each vendor’s own plan page shows it. Prices change and are on those pages; we do not print them.
| What you need | Termly | iubenda |
|---|---|---|
| A privacy policy | Free: one basic policy, static HTML | Free: up to 3 services or clauses |
| Policy text kept current as laws change | Starter (updates); Pro+ (auto-updated) | Free |
| Retention and security wording in the policy | not stated | a paid plan (not on Free) |
| The policy in other languages | Pro+ | Advanced (all languages) |
| Cookie banner that blocks scripts before consent | Free | Free |
| Monthly banner allowance on the entry plans | Free 10,000 banner views; Starter 50,000 | Free 5,000 pageviews; Essentials 25,000 |
| A consent log | Pro+ (with export) | Free |
| A banner that changes by region | Pro+ | Advanced |
| IAB TCF, for sites running ad networks | Pro+ (TCF 2.3) | Essentials |
| A rights request form | Free | Ultimate |
| A register of processing activities | not on the plan page | Ultimate |
Source: the Termly and iubenda plan pages and iubenda’s free plan guide, read 2026-10-22. Termly counts banner views; iubenda counts pageviews, so the two allowances are not the same unit. | ||
One site, priced in plan names
Take an online shop with visitors in the EU and California, about 30,000 pageviews a month, which shares data with an ad network. It wants a policy for both laws that stays current, a banner that blocks before consent in the EU and offers the opt-out in California, a consent log, and Global Privacy Control honored.
- On Termly the consent log and the region-based banner both start at Pro+, so Pro+ is the floor, whatever the banner view count.
- On iubenda the region-based banner starts at Advanced, and 30,000 pageviews is past the Essentials allowance anyway, so Advanced is the floor.
If the same shop also wants visitors to file access and deletion requests through a form on the site, Termly already has it at Pro+; iubenda needs Ultimate. Drop the EU visitors and neither floor moves: Termly still needs Pro+ for the consent log, and 30,000 pageviews still puts iubenda on Advanced.
Count pageviews, not visitors: iubenda’s free banner switches off for the rest of the month when it passes its allowance. Then check which laws reach you with the which-laws tool; the region-based banner is only worth paying for if both the EU and a US state law apply.
What each half of the bundle answers to
Both products are two tools sold in one account: a policy generator and a cookie banner. The policy is judged on what it says and whether it stays true. The banner is judged on what it does before and after a visitor chooses. The two halves answer to different rules, which is why the table splits them.
The policy: complete, current, readable
California asks for the policy items to be updated at least once every 12 months (Civ. Code § 1798.130(a)(5)). That is where the two vendors split most clearly. iubenda says its policy text updates when laws change on every plan, the free one included. Termly’s free policy is static HTML with no regulation updates; updates start at Starter and the hosted, auto-updated policy at Pro+. On a free Termly policy, the yearly review is yours.
The GDPR asks for the information in a “concise, transparent, intelligible and easily accessible form, using clear and plain language” (Art. 12(1)). For a site whose readers are not English speakers, that is the case for the language row. One more gap sits in iubenda’s free plan: its own guide says the retention and security inputs are not included, and the retention period is one of the items the GDPR lists in Art. 13(2)(a). Run any draft through our privacy policy checklist before it goes live.
The banner: block first, then honor the signal
“the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent”
Both banners block scripts before consent on every plan, so for an EU visitor the first-load behavior is a tie. The California side is where they differ. A business that sells or shares personal information treats a Global Privacy Control signal as an opt-out (regs § 7025), and the same section adds a step most banners skip:
“A business must display whether it has processed the consumer’s opt-out preference signal as a valid request to opt-out of sale/sharing on its website.”
Termly’s release notes describe exactly that: a small notice that confirms the signal was honored. iubenda’s pages say it detects and respects the signal, and do not say it shows one. Test either with our GPC checker switched on. The opt-out link itself comes in two forms the rules allow: the “Do Not Sell or Share” link, or the single “Your Privacy Choices” link with its icon (regs § 7015). Termly’s pages name the first and iubenda’s the second; our guide to the “Do Not Sell or Share” link covers both.
A request form is only the door. Under the GDPR you answer within one month, extendable by two further months (Art. 12(3)). Under the CCPA you confirm receipt within 10 business days and answer within 45 days, with one 45-day extension, 90 days at most. Our DSAR deadline calculator works out the dates.
Each bundle in short
What each one is, who it fits, how it meets the rows, and what to confirm before you buy. A policy from either one still needs a California notice where data is collected; our notice at collection template builds one.
Termly
What it is
A policy generator and consent platform in one account, with generators for other documents (terms, cookie policy, disclaimers) beside the privacy policy. Its pricing page says its products cover 28 privacy laws, the GDPR, the CCPA and 16 other US state laws among them.
Who it fits
A small US firm that takes access and deletion requests and wants the request form, the opt-out link and the banner in one place, and is ready to pay for Pro+ once it needs a consent log or a region-based banner.
What the rule requires and whether it meets it
Every plan, the free one included, carries the banner with its script auto-blocker, an embeddable request form and visitor data stored on EU servers. Starter adds 10 policy edits and regulation updates; Pro+ adds hosted policies that update in place, consent logs with export, region-based banners, other languages and IAB TCF 2.3. Its release notes add a notice that tells a visitor their GPC signal was honored.
Check with the vendor
Its own pages give different law counts (28 on the pricing page, 26 on its CCPA page, “25+” in its menu); ask which laws your plan’s policy covers. The release note on GPC names no plan, so confirm the notice runs on yours.
iubenda
What it is
An Italian policy generator and cookie banner, built from a library its site puts at more than 2,400 clauses, one per service your site uses. The generator page says policies are available in 27 languages.
Who it fits
A site with visitors in both the EU and the US that wants one policy to carry both and the wording kept current for it, from the free plan up.
What the rule requires and whether it meets it
The policy updates when laws change on every plan, and one setting adds the US state sections. The consent log is on every plan, the free one included. The free plan stops at 5,000 pageviews a month, three services in the policy, one language and no retention wording. Region-based banners start at Advanced; the request tool and the register of processing activities are on Ultimate.
Check with the vendor
The pages we read do not say whether the consent log exports, which US states the toggle covers today, or whether the banner shows a visitor that their GPC signal was honored. Ask for all three in writing.
How we compared them
Termly and iubenda are the two policy-and-banner bundles a small site meets most often when it searches for a free privacy policy and cookie banner, and both sell the two halves in one account. We read each one’s plan table, generator, banner, help and release pages on the read date.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-22; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
iubenda’s pricing page does not list what its free plan includes, so for that plan we used its own free plan guide; for Termly we used the Free column of its plan table. On this page “paid plan” can also mean a vendor’s entry paid tier; the note under the word names the first plan that carries the feature.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
How are Termly and iubenda plans tiered?
Both have a free plan and three paid ones. Termly: Free, Starter, Pro+ and a custom Agency plan, priced per website. iubenda: Free, Essentials, Advanced and Ultimate, priced per site with a monthly pageview allowance and a charge for pageviews past it. The plan table above names the first plan that carries each feature; the current prices are on each vendor’s own pricing page, linked on its card.
Which free plan is more usable?
It depends on which half matters more. iubenda’s free policy updates when laws change and its free banner keeps a consent log, but it lists only three services, leaves out retention wording and switches off after 5,000 pageviews a month. Termly’s free plan gives a 10,000-view banner and a request form, but its one basic policy is static HTML that never updates itself.
Do I need both the policy and the banner from the same vendor?
No. Each half works alone, and either policy can sit beside another vendor’s banner. Keeping both in one account lets the vendor’s site scan feed both, so the services named in the policy line up with what the banner blocks. If you are weighing banners on their own, see our consent management platforms compare.
Does a site with only US visitors need the banner at all?
The California law does not ask for consent before most cookies run; it asks for an opt-out of selling or sharing, through a link and by honoring signals such as Global Privacy Control. Either bundle’s banner can carry both. Once EU visitors arrive, the ePrivacy consent rule applies to them.
Will either one make my site compliant?
No tool does that on its own. A policy describes what you do and a banner enforces the choices you set up; both are only as right as your answers and your setup. Once either is live, run the result through our cookie banner checklist.