CMP Pricing Per Domain vs Per Session: How the Bill Actually Grows
A visitor complains that your site tracked them without consent. The regulator asks for the record. You open the CMP dashboard and find a log entry that says a user accepted, with no timestamp, no record of what the banner showed, and no way to tie the entry to the complaint. That log entry is worthless, and the banner that produced it was theater. Consent records are the part of compliance that only matters when something goes wrong, which is exactly when they have to be complete.
The GDPR is blunt about this. Article 7 requires the controller to be able to demonstrate that consent was given, and Recital 42 ties valid consent to a record of what the person was told. A banner that collects consent and keeps no usable record has done half the job.
CMP pricing grows along three axes at once: the number of domains, the number of monthly sessions, and the number of subpages scanned. A plan that looks cheap for one small site gets expensive fast when the portfolio grows, because most vendors charge per domain and per session tier, and a few charge per subpage as well.
The three meters on the bill
The first meter is domains. Cookiebot starts around 7 to 9 euros a month per domain for a single small site, and the August 2025 price increase roughly doubled its previous rates. A portfolio of ten domains is ten subscriptions, not one. Enzuzo takes the opposite approach, with a Pro tier at 79 dollars a month covering 10 domains, and a free plan for one site under 5,000 monthly visitors. The same ten domains cost very different amounts depending on which meter the vendor uses.
The second meter is sessions. Osano consent starts at 199 dollars a month for a plan capped at 30,000 monthly visitors, and the advanced plan needs a sales call. A site that grows past the cap does not get a warning and a pat on the back, it gets a tier jump. The third meter is subpages. Cookiebot free tier covers one domain and 50 subpages, and CookieYes free tier covers up to 100 pages. A site with a large blog archive blows through a subpage cap without anyone noticing, because the scanner counts pages, not posts.
Why OneTrust looks expensive and sometimes is not
OneTrust raised its minimum annual contract to 10,000 dollars, and that number is the reason most mid-market teams look elsewhere. But the comparison is only fair if the team actually needs what OneTrust sells. OneTrust is a full privacy program: consent, data mapping, data subject requests, vendor risk, and AI governance in one suite. A team that only needs a cookie banner and Google Consent Mode v2 is paying for a governance platform to do a banner job.
That is why the alternatives split into two groups. Enzuzo, Osano and Cookiebot cover consent and Consent Mode v2 for mid-market teams. Didomi, TrustArc and BigID cover the broader enterprise program. Vanta and Drata replace the governance side and do no consent management at all. The wrong comparison is price against price. The right comparison is the job against the job, then the price.
Reading a quote like a buyer
Ask four questions before signing. How many domains does the price cover, and what does the eleventh cost. What is the session cap, and what happens when traffic spikes past it. How many subpages does the scanner cover, and does the blog archive count. And what is the cost of the features that are not in the base tier: A/B testing, geo rules, data subject request handling. Cookiebot charges extra for A/B testing, and several vendors charge for the DSAR workflow that looks included in the demo.
Then run the numbers for the portfolio you will have in a year, not the one you have today. A vendor that is cheapest for one domain and most expensive for ten is a trap for anyone growing. The CMP is infrastructure, and switching it later means re-collecting consent from the whole audience. Pick the pricing shape that fits the portfolio you are building, not the site you have.
Keep reading: TCF Vendor Lists: Why 900 Vendors on Your Banner Is a Liability, Consent Records: How Long to Keep Proof, and What to Keep, and The Best OneTrust Alternatives for 2026 cover the nearby cases in this series.
Frequently asked questions
Why did my CMP bill jump when nothing changed?
Usually a meter tripped: monthly sessions passed a tier cap, the scanner counted more subpages than the plan covers, or a new domain was added. Check all three meters before disputing the invoice.
Is per-domain or per-session pricing better?
Per-domain suits a few large sites. Per-session with a domain bundle suits a portfolio of small sites. Count your domains and your traffic first, then compare, because the answer flips with the shape of the portfolio.
What does the free tier of a CMP actually cover?
Cookiebot free covers one domain and 50 subpages. CookieYes free covers up to 100 pages. Both are fine for a single small site and both run out quickly once the site grows.
Can I switch CMPs without losing consent?
Not cleanly. Consent is tied to the CMP that collected it, and a switch usually means re-prompting the audience. That is why the pricing shape matters at the start, not at renewal.