“Robust” is a marketing word, so this comparison sticks to what you can check. For nine widely used CMPs we looked up each one’s IAB TCF ID, its place on Google’s certified list for publishers, its tier in Google’s CMP Partner Program, what its free plan actually limits, and where TCF sits in its price list. All nine are registered with IAB and certified by Google for publishers. The differences are in the plans. “Free” means fewer than 1,000 sessions at Usercentrics, up to 50 subpages at Cookiebot, 5,000 pageviews at CookieYes and 10,000 banner views at Termly. Several vendors keep TCF off their cheapest plans. OneTrust and Didomi publish no prices. Complianz is the only one with an open-source free edition. Checked 29 September 2026.
Updated 29 September 2026: rewritten. The February version quoted typical prices for OneTrust ($50,000+ a year), Didomi ($1,000+ a month) and Axeptio ($15–30 a month). We could not find a source for any of them, so they are gone. Everything below links to the page it came from.
What you can actually check
A CMP’s own feature list will say it is robust. Four things have an independent, public answer:
- IAB Europe TCF registration. Every registered CMP has a numeric ID on IAB Europe’s CMP list, published as JSON. The copy we read was updated on 24 September 2026 and holds 269 CMPs. The current framework version is 2.3. IAB Europe says “TCF participants have until 28 February 2026 to adopt TCF v2.3” (source). That is a rule of the framework, not a law. The February version of this post called it “mandatory in Europe”, which overstated it.
- Google’s certified CMPs for publishers. If you run AdSense, Ad Manager or AdMob, Google requires “a certified CMP integrated with the TCF” to serve personalised ads in the EEA and UK (since 16 January 2024) and in Switzerland (since 31 July 2024). Google’s list shows each CMP’s TCF ID and the platforms it covers.
- Google’s CMP Partner Program, for advertisers. The Partner Program lists CMPs “integrated with Consent Mode and Google Tag Manager”. Google sorts them into Gold, Silver and Bronze using “objective criteria including customer support and ease of technical integration”.
- The price list itself. What the free plan counts, and which plan the TCF integration starts on.
How to find a site’s CMP ID and look it up on each list is covered step by step in how to check whether a CMP is Google-certified. Why the publisher list matters for ad revenue is in the certified CMP requirement.
Nine CMPs, compared on the record
| CMP | IAB TCF ID | Google publisher list | Google Partner Program | Free plan (vendor’s pricing page) | Price scales with |
|---|---|---|---|---|---|
| Usercentrics | 5 | Yes · web, app, CTV | Gold | Yes: under 1,000 sessions a month, 1 domain | Sessions · pricing |
| Cookiebot | 134 | Yes · web | Gold | Yes: up to 50 subpages, 1 domain | Subpages, not traffic · pricing |
| OneTrust | 28 | Yes · web, app, CTV (as “Onetrust / Cookiepro CMP”) | Gold | No published prices | Traffic, websites and apps in scope · pricing |
| Didomi | 7 | Yes · web, app, CTV | Gold | No published prices | Monthly unique visitors · offers |
| Axeptio | 260 | Yes · web and app | Gold | None listed | Pageviews · pricing |
| CookieYes | 401 | Yes · web and app | Gold | Yes: 5,000 pageviews a month, 100 pages per scan | Pageviews, per domain · pricing |
| iubenda | 123 | Yes · web and app | Gold | Yes (Google’s partner listing: up to 5,000 pageviews a month) | Pageviews, per site · pricing |
| Termly | 412 | Yes · web | Gold | Yes: 10,000 banner views a month | Banner views, per website · pricing |
| Complianz | 332 | Yes · web | Silver | Yes: the WordPress plugin, GPLv2 | Websites, per year · pricing |
Sources, all read on 29 September 2026: IAB Europe’s CMP list, Google’s certified CMP list, the CMP Partner Program and each vendor’s pricing page, linked in the last column. Two cells come from Google’s Partner Program listings because the vendor’s own page does not say: OneTrust’s pricing basis, and the size of iubenda’s free plan. Prices change often, so we name what each vendor charges by rather than the numbers.
“Free” counts different things
The free plans are not comparable at face value, because each one counts a different thing:
- Usercentrics counts sessions. Free is “available for everyone with fewer than 1,000 monthly sessions and one domain”. Paid plans start at €7 a month for up to 1,500 sessions. The pricing page adds that plans “automatically upgrade when plan limits are exceeded”.
- Cookiebot counts pages, not visits. Free covers “up to 50 subpages”, where “a subpage is any unique URL on your domain”, and “there are no limits on traffic”. Paid plans start at €7 a month. A 40-page site with heavy traffic can stay free. A 500-page blog with little traffic cannot.
- CookieYes counts pageviews and scan size. Free is 5,000 pageviews a month and 100 pages per scan. Paid plans charge “$0.30 per 1,000 extra pageviews” above their quota.
- iubenda counts pageviews. Its pricing page offers a free plan without stating the limit; Google’s partner listing gives it as 5,000 pageviews a month. On the Essentials plan, “once your quota is reached, you will be charged €0.05 per 1,000 pageviews”.
- Termly counts banner views. Free covers 10,000 a month, Starter 50,000, and Pro+ is unlimited.
So before comparing prices, find your own numbers: monthly sessions and pageviews from your analytics, and the number of URLs from your sitemap. The cheapest vendor for one site can be the most expensive for another.
Read the plan, not the logo
The certifications in the table belong to the vendor. The integration you need has to be on the plan you buy, and several vendors keep TCF above their entry tier:
- Termly lists Google Consent Mode v2 and IAB TCF 2.3 under Pro+ ($15 per website a month billed annually, $20 monthly), not under Starter or Free.
- Usercentrics first lists “IAB TCF v2.3 support” on its Pro plan (€30 a month, up to 15,000 sessions).
- Axeptio‘s Extra Small plan lists Google Consent Mode v2 but not TCF. TCF appears from the Small plan up.
- Complianz: “Premium adds multi-site, A/B testing, TCF”. The free plugin does not include it.
Cookiebot, CookieYes, iubenda, Didomi and OneTrust do not say plan by plan on the pricing pages we read, so ask before you buy. This matters most for publishers: Google’s rule is about a certified CMP “integrated with the TCF”. Whether a plan without TCF meets it is a question for the vendor, and for Google’s policy, not for a logo on the vendor’s homepage.
Open source: one option, with limits
Of the nine, only Complianz has an open-source edition. Its WordPress plugin is licensed under the GNU GPL version 2, according to the licence header in the plugin’s public repository. It was updated to version 7.5.5 on 8 September 2026, and WordPress.org shows “1+ million” active installations. Two limits apply: it is WordPress-only, and TCF is a Premium feature. Premium licences are sold by number of websites with a year of support and updates; the Personal licence is listed at $59 for one site.
Stand-alone open-source CMPs are a different trade-off. We found no entry for tarteaucitron, c15t, CookieConsent or Klaro on IAB’s list, so none of them can appear on Google’s publisher list, which is keyed on TCF IDs. For a publisher, Google says “traffic from a non-certified CMP may be eligible for non-personalized ads or limited ads”. That may be an acceptable trade for a site without ads, and it is the one to understand before you choose. The options are compared in open-source and self-hosted CMPs compared, and the cost of going further in build your own CMP or pay for one.
What none of these lists tells you
Every list above certifies a product, not your installation. Google says so directly: it “does not check CMPs for full compliance with the TCF or applicable privacy laws.” A certified CMP can still load tags before the visitor answers, or leave cookies in place after a refusal. It can also send Consent Mode signals that the tags never read, as in the dataLayer push that gtag ignores. Those are configuration problems, and they appear on every vendor. You find them by testing your pages; the common case is described in rejecting cookies does not delete them. The dated table for all the tools we reference, including the open-source ones, is on our tools page. None of this is legal advice.
Whichever CMP you choose, verify it. Scan your site with CookieInspector to see what loads before and after the banner, on the plan and configuration you actually run.