ConsentManager
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
EU-hosted CMP on Plusserver (DE) and UpCloud (FI) with no US processor in its published chain; IAB TCF v2.3 ID 31, 100K+ websites, from €23/mo; now a subsidiary of iubenda.
ConsentManager is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under Cookie consent.
Assessment notes
consentmanager — now branded consentmanager by iubenda after becoming a subsidiary of iubenda Srl (Milan IT), itself part of the Belgian team.blue group — is contracted through consentmanager GmbH (Hamburg DE), consentmanager SAS (Paris FR) and consentmanager AB (Västerås SE), and remains the cleanest processor chain in this category. Its DPA is public and readable without a login, and it is the only vendor here that names its full chain in that document: Plusserver GmbH (DE) and UpCloud Oy (FI) for data centres and DataCamp Ltd (UK) for the CDN. Not one US-owned processor appears, and DNS bears the document out — cdn.consentmanager.net resolves to CDN77 Frankfurt and delivery.consentmanager.net to UpCloud's Frankfurt load balancers — so the consent script every visitor loads never leaves EU-operated infrastructure. IAB TCF v2.3 CMP ID 31, Google Consent Mode v2 certified, IAB GPP, 100K+ websites. cloud_act_exposure: none is now evidenced rather than assumed.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About ConsentManager
ConsentManager.net is the cleanest cookie-consent pick in this catalogue from a sovereignty perspective, though for a narrower reason than this listing previously gave. It does not run its own data centres: the public DPA names Plusserver GmbH (Germany) and UpCloud Oy (Finland) for hosting and DataCamp Ltd (United Kingdom, trading as CDN77) for the CDN, so the infrastructure is third-party European rather than first-party, and the UK leg is a third-country transfer under the adequacy decision. What does hold up is that not one US-owned processor appears anywhere in that chain, and DNS bears the document out: the delivery hosts resolve into UpCloud Frankfurt and the CDN into CDN77 Frankfurt, so the consent script every visitor loads never leaves EU-operated infrastructure. The ISO 27001 certification recorded here in May is no longer claimed anywhere on the vendor's site and has been withdrawn from the listing; the live claims are IAB TCF v2.3 (CMP ID 31), Google Consent Mode v2 and IAB GPP. Usage-based pricing scales from Free (3,000 views/mo) to Starter €23/mo (100K views, €0.11 per extra 1,000) to Essential €59/mo (1M views) to Enterprise, billed monthly; accessibility is now a separate product line and does not include the CMP. 30+ UI languages, support for 2,500+ tools (analytics, ads, social), a built-in cookie crawler, 100K+ customer sites, and A/B-tested designs aimed at higher acceptance rates and lower bounce. One group fact to carry into any comparison: consentmanager is now a subsidiary of iubenda Srl (Milan), itself part of team.blue (Ghent), so it and Iubenda are not independent options within this category.
Sub-processor map · none disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of ConsentManager
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Denmark · €7/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
FranceEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
Italy · €5.99/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Cookiebot
Denmark
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€7/mo |
Didomi
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
— |
Iubenda
Italy
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€5.99/mo |