Cookie consent platforms compared: Cookiebot, OneTrust, Osano, Klaro
The CMP you choose decides how painful Consent Mode v2 is to wire up. A practical comparison for teams that just need consent done right without enterprise overhead.
Every consent-management platform can show a banner. What separates them is whether they correctly translate the visitor's choice into Google Consent Mode v2 signals, whether they block non-Google vendors reliably, and whether they produce an audit trail you could actually defend. Choose on those three, not on the banner designer — because the failure mode that costs you money is a banner that looks perfect and never tells Google anything.
What a CMP has to do
- Collect a choice, granularly enough for your jurisdictions.
- Store it durably and restore it on return visits, before tags act.
- Translate it into Consent Mode v2 signals — all four, including ad_user_data and ad_personalization.
- Block non-Google vendors that do not participate in Consent Mode at all.
- Keep records of what was consented to, when, and under which policy version.
Points 3 and 4 are where implementations fail, and neither is visible in the banner's own dashboard — which will happily report healthy accept rates while Google receives nothing.
The main options
Cookiebot — mature, strong automatic scanning of what your site loads, good Consent Mode v2 support, straightforward for small and mid-sized sites. Scanning is its distinguishing feature: it tells you what you are actually loading, which is usually more than you thought.
OneTrust — the enterprise default. Deep configuration, jurisdiction handling, and audit capability, at the cost of real complexity. Overkill for a small site; often the only option that satisfies a large organisation's legal team.
Osano — simpler and more approachable, with a focus on being quick to deploy and understand. Good middle ground when OneTrust is too much and you want more than a script snippet.
Klaro — open source and self-hosted. Full control, no vendor cost, and you own the maintenance and the compliance responsibility. Sensible for teams with engineering capacity and a preference for not adding a third-party script.
Platform-native banners — Shopify, Wix, and Squarespace all ship something. Convenient and usually the weakest on point 3: they store consent in the platform's own system without bridging it to Google. Consent Mode v2 on Shopify covers that specific gap.
| Best for | Watch out for | |
|---|---|---|
| Cookiebot | SMB to mid-market | Per-domain pricing at scale |
| OneTrust | Enterprise, multi-jurisdiction | Complexity and implementation effort |
| Osano | Teams wanting simplicity | Fewer advanced controls |
| Klaro | Self-hosting, full control | You own maintenance and compliance |
| Platform-native | Getting started | Often no real Consent Mode v2 bridge |
The questions that actually differentiate them
Does it emit all four Consent Mode v2 signals? Ask specifically about ad_user_data and ad_personalization. Many implementations built before 2024 still send only the original two, which passes casual inspection and degrades EEA advertising.
Does the default run before any tag? The denied default must execute in the head, ahead of the container. If the CMP loads asynchronously after your tags, there is a window where everything fires unrestricted.
How does it block non-Google vendors? Consent Mode is a Google mechanism. A chat widget, a heatmap tool, or an affiliate pixel needs actual blocking — usually by script-type rewriting or by category-based gating.
Does it restore consent before tags act on return visits? A returning acceptor who briefly gets the denied default loses data on that page load.
What does the audit trail look like? Consent records with timestamps and policy versions, exportable. If you ever need it, you need it in a hurry.
Can you handle multiple jurisdictions? Opt-in for the EEA and UK, opt-out for some US states, no banner elsewhere. Blanket global opt-in is a self-inflicted revenue cost.
Implementation matters more than the choice
A well-implemented cheap CMP beats a badly implemented expensive one. The reliable verification does not involve the vendor's dashboard at all:
- Load with a fresh profile from an EEA IP. Check the gcs parameter on Google requests — G100 before any choice.
- Accept. gcs should become G111.
- Reject and navigate. The denied state must persist.
- Return as a repeat visitor. The stored choice should apply before tags fire.
- Check that non-Google vendors are genuinely blocked, not merely uninformed.
Verifying Consent Mode covers each of these in detail. Any CMP that passes all five is fine; any that fails one is a problem regardless of price.
The commercial consequence of getting it wrong
Both failure directions cost money, in different currencies.
Tags firing before consent is a regulatory exposure, and the data looks perfect right up until it becomes a problem.
Consent never reaching Google silently removes your EEA conversion data, degrades Smart Bidding in those markets, and gets misread as "Europe doesn't convert". This one is far more common and, in pure revenue terms, usually more expensive.
FAQ
Do I need a consent management platform?
If you serve EEA or UK traffic and run advertising or analytics tags, effectively yes. Google also requires a Consent Mode v2 integration to keep serving personalised advertising to those users.
Is a free or open-source CMP good enough?
It can be. What matters is correct Consent Mode v2 signalling, reliable blocking of non-Google vendors, and a defensible record — not the price. Self-hosting means you own the maintenance.
Will Shopify's or Wix's built-in banner satisfy Google?
Sometimes for the platform's own tracking, often not for tags you add yourself. Verify the four Consent Mode signals actually reach Google before assuming it is handled.
How do I know my CMP is actually working?
Check the gcs parameter on Google requests in the network panel: G100 before consent, G111 after. The CMP's own dashboard can show healthy accept rates while Google receives nothing.
Does a CMP hurt my conversion rates?
A banner reduces measured conversions by suppressing tracking for those who decline. Advanced Consent Mode plus modelling recovers a meaningful portion — which is why implementation quality matters more than banner design.
Check whether a consent platform and Consent Mode v2 signals are present on your site: the free tracking audit inspects both on any URL.
See where your tracking stands
Run the same 13-check audit referenced in this post against any URL. No signup, results in seconds.