Best Cookie Consent Management Platforms (CMPs), Compared

If you're reading this, you almost certainly need a cookie banner, not a lecture on the nuances of the CMP market — so let's deal with that first.

CookieChest CMP — £12/month

CookieChest CMP is powered by Cookie-Script under the hood, white-labelled — we're open about that, because building consent-banner technology from scratch would mean competing with every platform below at something they already do well. What we add is the part missing from every CMP on this list: independent, ongoing verification that the banner and your tags are still correctly wired together, not just on day one but every day after, through every CMP update and every GTM publish. A CMP tells you it's installed. It doesn't tell you six weeks later that a GTM change broke the trigger that was supposed to respect it.

£12/month, one site, one banner, no contract, Consent Mode V2 built in, geo-targeting included. Cancel anytime.

Installation is included at no extra cost. Every platform on this list is self-serve — you install it yourself. CookieChest is done-for-you: buy it, and we install it for you.

Buy CookieChest CMP — £12/month →

The Major Players

• Cookiebot (now part of Usercentrics) — widely used, straightforward setup. The free tier is capped at 50 pages per domain, single language, no customisation, and shows Cookiebot branding throughout. The cheapest paid step up (Premium Lite, €7/month) is still capped at 50 pages, but adds custom branding and multi-language support.
• OneTrust — the enterprise default, extensive configurability, correspondingly heavier to set up and maintain. No public self-service pricing at all.
• Cookie-Script — the engine CookieChest CMP is built on (see above) — lightweight, fast to deploy, popular with agencies.
• CookieYes — WordPress-friendly. The free tier is capped at 5,000 pageviews/month and 1 domain, with mandatory CookieYes branding and no custom colours or multi-language support.
• Osano — leans into broader privacy/data-subject-rights tooling beyond just the banner.
• Iubenda — pairs consent management with legal-document generation (privacy policy, terms), useful if you need both in one place.
• Termly — similar territory to Iubenda, policy generation plus a banner.
• TrustArc — enterprise-focused, deep configurability, similar positioning to OneTrust. No public pricing — demo/quote only.
• Usercentrics — strong Consent Mode v2 support out of the box, positioned as an all-in-one platform since absorbing Cookiebot. Priced separately from Cookiebot despite common ownership.
• Didomi — technically thorough, good documentation, popular with teams that want fine-grained control over consent categories. No public pricing for any tier — contact sales only.

What They Actually Cost for a Typical Site

Free tiers make for flattering headlines, but they're built for the smallest possible site — a handful of pages, a few thousand visitors a month. They're not what a normal, trading business actually runs on. Here's the realistic cost once you're past the free tier and running a single typical site, not an enterprise deployment:

Platform	Realistic tier for one typical site	Price
CookieChest	Flat, one site, done-for-you	£12/month
Cookiebot	Premium Small (single domain)	€30/month
CookieYes	Pro (still branded) / Ultimate (branding removed)	$25–55/month
Osano	Plus (caps at 30,000 visitors)	$199/month
Iubenda	Advanced (50,000 pageviews)	€21.99/month
Termly	Pro+ (unlimited views)	$15–20/month
Usercentrics	Business (50,000 sessions)	€50/month
OneTrust	no public pricing	~$10,000/year (reported, not officially published)
TrustArc	no public pricing	$15,000–$100,000/year (third-party estimate only)
Didomi	no public pricing	contact sales

On this basis, CookieChest undercuts every platform above except Cookie-Script itself — which isn't really a competitor to list separately, since it's the engine underneath CookieChest CMP.

Why the Choice Matters Less Than You'd Think

Every platform on this list, correctly configured, does the core job: shows a banner, records a choice, blocks non-essential cookies until consent is granted. The features that differentiate them — legal-document generation, data-subject-rights portals, enterprise SSO — are real, but they're not where tracking actually breaks.

What breaks is almost always the wiring between the CMP and Google Tag Manager: a trigger condition that doesn't match the CMP's actual consent event, a Consent Mode default that never got set, a tag that's supposed to wait for a category that was renamed in a CMP update six months ago and nobody noticed. The CMP itself passed every test it was designed for. The connection to your actual tags is the part nobody's watching.

What to Actually Check Before Committing to One

1. Consent Mode v2 support — confirm it sets ad_storage, analytics_storage, ad_user_data, and ad_personalization correctly, not just the older two-signal version.
2. How it signals consent to GTM — does it push to the dataLayer directly, fire native events, or both? This determines how your triggers need to be built.
3. Geo-targeting — if you serve visitors outside the UK, whether it can show different banners (or none) by region without needing a second platform.
4. How often it's updated — consent requirements shift, and a CMP that hasn't shipped an update in a while is a CMP whose Consent Mode implementation is quietly ageing.