A consent management platform (CMP) is the tool behind the cookie banner on a website: it finds the cookies and trackers you use, blocks them until a visitor agrees, and keeps a record of each choice. If your site runs analytics, ads or marketing pixels, you almost certainly need one, and the wrong choice leaves you either non-compliant or paying for features you never use.
My short answer: for most small sites I would start with the free plan of CookieYes or Cookiebot, move to Termly or iubenda if I also needed legal documents like a privacy policy, and look at Osano only when several US state privacy laws start to apply.
Do You Actually Need One? A 60-Second Self-Test
I would answer these before comparing any tool:
- Do you use analytics, ads, retargeting pixels, embedded videos or social widgets?
- Do you have visitors from the EU, UK or Switzerland?
- Do you show ads, for example with Google AdSense?
- Do you have visitors from US states with their own privacy laws?
- Do you collect emails or form data?
If you answered yes to the first question and to any of the others, a CMP is worth setting up. This is general guidance, not legal advice, and the rules change by country and state.
The Three Jobs a CMP Has to Do
When I compare these tools, I check three things:
- Detect and block. A scanner finds your cookies and stops non-essential ones from loading before consent.
- Ask and record. A clear banner collects the choice, and a log stores proof of it.
- Pass the signal on. The CMP tells Google and other tools what the visitor chose, usually through Google Consent Mode.
Many cheap setups only do the second job, and that is the one that causes trouble, because trackers can fire before the banner loads.
Google, AdSense and Consent: The Part Many Guides Skip
If your site shows ads to visitors in the EEA, UK or Switzerland, Google requires a Google-certified CMP. Certification comes in tiers, and several of the tools below hold the Gold tier: Cookiebot, CookieYes, Termly and iubenda, while one comparison lists Osano at Silver. I would also check Google’s own options inside AdSense, under privacy and messaging, to see whether a free consent message is available for your account before paying for anything. Policies change, so confirm the current requirements on Google’s help pages.
The Five Tools, Grouped by the Problem They Solve
You just want a banner that works: CookieYes and Cookiebot
CookieYes is the one I would try first on a small site. It has a free plan covering up to about 100 pages, paid plans from roughly €9 to $10 a month or $89 a year, Google Gold certification, support for Consent Mode v2 and IAB TCF 2.3, and geo-targeted banners in 170+ languages. My take: the best value for a single small site. Watch out for: it prices per site, so it gets more expensive as you add domains.
Cookiebot, from Usercentrics, is the scanning specialist. It has a free plan limited to about 50 subpages on one domain, paid plans from around €7 to $14 a month depending on the source, Google Gold certification, and Consent Mode v2 enabled by default. My take: I would choose it if accurate cookie detection matters more than price. Watch out for: pricing depends on the number of pages scanned, and TCF 2.3 is on paid plans.
You also need the legal documents: Termly and iubenda
Termly bundles the banner with generators for the privacy policy and terms, which saves a separate tool. It has a free plan (about 10,000 banner views), paid plans from roughly $10 to $14 per site per month, and Google Gold certification. My take: the simplest path for a small site that has no policies yet.
iubenda has one of the lowest entry prices, from about €4.99 to $6.99 a month, or roughly €29 a year for the base plan, with Google Gold certification, TCF 2.3 on paid plans, and a built-in policy generator. Watch out for: cost grows as you activate more solutions, and there is no free plan in some listings.
You are juggling several US state laws: Osano
Osano is positioned as a broader privacy platform for businesses facing multiple US state laws, with a free tier for small sites (about 5,000 monthly visitors), mobile app support and paid plans from around $199 a month. One comparison lists its Google certification as Silver and TCF as 2.2. My take: it is overkill for a small blog and sensible once privacy becomes a real workload. Watch out for: the price jump from the free tier is steep.
| Tool | Free plan | Paid from (estimates) | Google tier | Best for |
|---|---|---|---|---|
| CookieYes | Yes (~100 pages) | ~€9-$10/month or $89/year | Gold | Best value, single site |
| Cookiebot | Yes (~50 subpages) | ~€7-$14/month | Gold | Scanning accuracy |
| Termly | Yes (~10K views) | ~$10-$14/site/month | Gold | Banner plus policies |
| iubenda | Limited | ~€4.99-$6.99/month | Gold | Low price plus policies |
| Osano | Yes (~5K visitors) | ~$199/month | Silver | Multi-state US coverage |
Prices come from 2026 comparisons that disagree in places, and several of those comparisons are written by vendors, so confirm them on each pricing page.
Setup Mistakes I Would Watch For
- Trackers firing before consent. Test in a private browser window and check that analytics and ad scripts wait for the click.
- A banner that does not match your policy. Make sure the cookies listed in the banner match your privacy policy.
- Skipping the consent log. If you cannot prove a choice, the choice is worth little.
- Hiding the reject button. Rejecting should be as easy as accepting.
- Forgetting new tools. Every new plugin or pixel can add cookies, so rescan regularly.
What It Really Costs
For a single small site, expect between free and about $15 a month for most of these tools, and roughly $199 a month for Osano’s paid tier. Per-domain pricing is common and gets expensive across several sites, so ask about multi-site pricing, page or visitor limits, and what happens to the price when your traffic grows.
Where OneTrust Fits
OneTrust is a large enterprise privacy platform with custom pricing, and it appears in our guide to AI governance software for its AI-risk features. I left it out of this list because it is built for larger organizations than most small sites.
Related Guides
- Consent affects what your analytics can see, so read our guide to marketing attribution software.
- If you email customers, see our guide to email marketing software for e-commerce.
- Enterprise customers often ask for proof of privacy controls, so see the best SOC 2 compliance software.
- Keep customer data out of public AI tools with AI security software.
How I Researched This
I compared public pricing pages, documentation and several independent 2026 comparisons, and I noted every price where sources disagreed. I have not installed every tool on a live site, so my opinions are an analysis of fit and pricing, not hands-on test results.
Frequently Asked Questions
What is the best consent management platform for small business?
CookieYes and Cookiebot are the usual starting points because both have free plans. Termly and iubenda suit sites that also need a privacy policy.
Do I need a Google-certified CMP for AdSense?
Google requires one for ads shown to visitors in the EEA, UK and Switzerland. Check Google’s current policy, and also see whether AdSense offers its own consent message.
Is a cookie banner enough for GDPR?
Not on its own. It has to block non-essential cookies before consent, log choices and let visitors withdraw them as easily as they gave them.
Does a CMP cover US privacy laws?
Many include US state banners and opt-out signals, but requirements differ by state, so check which laws apply to you and get legal advice for your situation.
My Verdict
My pick for most small sites is CookieYes for value, with Cookiebot as the alternative if scanning accuracy matters most, Termly if I needed the legal documents too, and Osano only when privacy compliance becomes a bigger job. Whatever you choose, test that nothing loads before consent.
Pricing note: figures are estimates from independent 2026 comparisons and differ between sources. Confirm current pricing with each vendor.
Disclaimer: This guide is informational and not legal advice.
Leave a Reply