CMP Free Plans: What the Free Tier Quietly Leaves Out
A free consent platform is easy to install and easy to outgrow. The install takes ten minutes and the bill arrives months later, disguised as a feature wall: the consent log that does not export, the second domain that costs as much as the first, the data request workflow that does not exist at any price.
The public prices, collected in October 2026, make the comparison concrete. Several CMPs are free for small sites and cost between 7 and 50 euros a month for a typical small business. The gap between them is not the monthly number. It is what the free tier refuses to do.
The price list, as published
FlowConsent is free up to 25,000 sessions a month, then 14.99 euros a month up to 100,000 sessions, covering three domains. Usercentrics runs from a free tier at 1,000 sessions to 50 euros a month for 50,000 sessions, with IAB TCF and cross-domain consent from the 30 euro plan. Cookiebot is free up to 50 subpages, then 7 to 90 euros a month, priced per domain by subpage count.
CookieYes is free up to 5,000 page views a month, then from about 9 euros a month for 100,000 page views. Osano is free up to 5,000 visitors on one domain, with Plus at 199 dollars a month for 30,000 visitors and three domains. Ketch has a free plan up to 5,000 unique users, with Starter at 150 dollars a month. Enzuzo starts at 9 dollars a month with flat pricing across 10 domains on the Pro tier. OneTrust, the platform most of these replace, does not publish prices at all: the median annual contract across 309 recorded purchases is about 12,000 dollars, with a range of 1,620 to 48,215 dollars a year.
What free never includes
Data subject access requests are the sharpest cut. Cookiebot does not support DSAR workflows on any plan, which means a team that outgrows its banner has to buy a second tool for the requests. FlowConsent has no IAB TCF support today and no DSAR or data mapping modules. Ketch gates its integration library to the 499 dollar Plus tier, and its DSR handling is a separate add-on.
Multi-domain pricing is the second cut. Cookiebot bills every domain at a tier set by its page count, and every subdomain counts as a domain. Since August 18, 2025, the cheaper 15 euro tier has been closed to accounts with fewer than four domains, which leaves a two- or three-site account paying 30 euros for each mid-sized domain. A platform that looks cheap for one site can cost more than OneTrust's entry tier once the third domain arrives.
The switch test before you commit
Three checks decide whether a free tier is a real starting point or a trap. First, does the consent log export, with the timestamp, the choices, and the banner version for each record. Second, does it send Google Consent Mode v2 signals and block scripts before consent, not after. Third, what happens at the next traffic tier, and does the price multiply per domain or stay flat.
Run those checks against the published prices before the install, not after the first invoice. The cheapest CMP is the one whose free tier covers your actual traffic and whose paid tier you can afford when the traffic doubles.
Keep reading: Consent Mode v2 Defaults: The Four Signals and What Breaks When They Fire Late, The Meta Pixel After Third-Party Cookies: Consent Gating That Has to Be Manual, Push Notifications Are Not Cookies: The Permission Prompt That Still Needs a Consent Decision cover the nearby cases in this series.
Frequently asked questions
What is the cheapest CMP for a single small site?
CookieYes and FlowConsent both have free tiers for low traffic, and Cookiebot is free up to 50 subpages. The cheapest paid entry is usually CookieYes at about 9 euros a month or Enzuzo at 9 dollars a month. Compare the visitor cap, not just the headline price.
Why does Cookiebot cost more for multiple domains?
Cookiebot bills every domain at a tier set by its subpage count, and every subdomain counts as a domain. Since August 2025 the cheaper 15 euro tier is closed to accounts with fewer than four domains, so a two- or three-site account pays 30 euros per mid-sized domain.
Do free CMPs handle data subject requests?
Most do not. Cookiebot has no DSAR workflow on any plan, and FlowConsent has no DSAR or data mapping modules. Enzuzo and Ketch include DSAR handling, with Ketch gating parts of it to higher tiers.
What should I check before switching CMPs?
Whether the consent log exports with timestamps and banner versions, whether Consent Mode v2 signals are sent, whether scripts are blocked before consent, and how the price changes when you add a domain. Switching also means collecting fresh consent from every visitor.