Usercentrics
Usercentrics GmbH, Munich, Germany ·usercentrics.com· As of: 2026-09-02
Work through this tool with an AI
Our verdict
A consent platform wins no customers. Its absence costs some. Anyone wanting to serve personalised ads through Google's advertising products to users in the European Economic Area and the United Kingdom has needed a Google-certified platform connected to the Transparency and Consent Framework since 16 January 2024; without one, only non-personalised delivery remains. Alongside that sit section 25 of the German TDDDG for access to end devices and Article 7(1) GDPR for the record of consent. The benefit therefore stays one-sided. It prevents falling behind and creates no lead, because competitors buy the same banner from the same vendor. What separates Usercentrics from the rest is the place of jurisdiction. The company sits in Munich, the data processing agreement follows German law, and the servers are in EU member states according to the vendor. For a tool whose only purpose is proof towards a European supervisory authority, that weighs more than any feature list.
Evidence:Legal entity, registered office, register number, VAT identification number and managementOpen sourceData processing agreement version 3.1 of February 2026: sub-processors with place and purpose in Annex 2, standard contractual clauses for Google Cloud, a thirty-day objection period, deletion within thirty days and backups within six monthsOpen sourceClause 6.4 on the analysis of anonymised and aggregated customer data, and clause 7.1 on the separate data processing agreement taking precedence in case of conflictOpen sourcePrices per plan, session limits, automatic plan upgrade once limits are exceeded, the twelve-month consent log in every tier, and the second factor and directory sign-in in the Corporate plan aloneOpen sourceAttestations with standard, version and scope, server locations in EU member states mainly in Germany and Belgium, and the second sub-processor list of six entriesOpen sourceAcquisition of MCP Manager of New York, announced on 14 January 2026, with no purchase price statedOpen sourceGoogle's requirement of a certified consent platform connected to the Transparency and Consent Framework for personalised ads in the European Economic Area and the United Kingdom since 16 January 2024Open sourceThe Wiesbaden administrative court order of 1 December 2021 concerning Cookiebot and its reversal by the Hessian higher administrative court on 17 January 2022 for lack of urgencyOpen sourceCommercial register data on registration date, development of share capital and shareholding positionOpen sourcePublished plans and user volumes of the AI-native counterpart KetchOpen source
Who it fits
Solo
suitable
Getting started is cheap and the price is public. Below 1,000 sessions a month on one domain the platform costs nothing; above that the Essential plan starts at 7 euros a month for 1,500 sessions and a single legal regime. Anyone running a site with a contact form and one analytics tool is covered. The limit sits at the session count, because the pricing page states that the plan rises by itself under the terms once the number is exceeded.
Mid-market
suitable
Here the number of domains decides. The Pro plan covers three domains and 15,000 sessions for 30 euros a month, Business ten domains and 50,000 sessions for 50 euros, each excluding VAT. A company with a main site, a careers site and two landing pages therefore sits in the middle of the price list. Two things are missing entirely up to this point: sign-in through the company's own directory service, and a second factor for access to the administration account. The comparison table of 2 September 2026 places both in the Corporate plan only, which is notable for an account holding the records of every consent the company has collected.
Enterprise
suitable
The procurement checklist is largely served. A data processing agreement as an open document with standard contractual clauses and a named sub-processor list, storage in EU member states, plus ISO 27001:2022, ISO 27701:2019, SOC 2 Type 2 and TISAX level 3. The price for it appears nowhere. The Corporate plan starts at one million sessions a month and carries, instead of an amount, the instruction to approach sales. The same tier holds the approval chain before going live, bulk editing across configurations, the second factor and sign-in through the company's own directory service. Those are exactly the points without which a corporate group may not run such a platform at all, and every one of them hangs on the negotiated price.
Buy, switch or build
Off-the-shelf
OneTrust, one module inside the privacy programme
OneTrust of Atlanta is the established counterpart, and Usercentrics sets itself against it on a dedicated comparison page. Corporates stay with it because consent is one module among many there. The record of processing activities, handling of data subject requests, vendor risk assessment and the whistleblowing channel sit in the same interface and under the same contract. Anyone whose legal department already works there buys no second vendor relationship with the banner and runs no second audit. The price is lock-in, because switching consent alone means breaking a piece out of a running programme.
AI-native
Ketch, consent steered by agents
No distinct class of AI-native consent management has formed yet. The furthest along is Ketch of San Francisco, founded in 2020, where by the company's own account agents inventory the connected systems, classify personal data down to individual fields, and read terms out of vendor contracts where questionnaires would otherwise be sent. The price gap is clear. Ketch charges 150 US dollars a month for up to 30,000 unique users and from 499 US dollars for up to 100,000, while Usercentrics covers 50,000 sessions for 50 euros. The units counted differ, so the amounts are not comparable one to one, though the order of magnitude is. What has to be given up is the German place of jurisdiction, the contract under German law and the attestations a European procurement department asks for.
Build it yourself
Build the banner yourself, but not the certification
The dialogue itself is little work. A script that loads tools only after agreement, a cookie for the decision and a table for the log come together with Claude Code or Cursor from this catalogue in one to two days; Supabase for the log and Cloudflare Pages for delivery are enough as building blocks. Reckoned at a 1,200 euro day rate that is 1,200 to 2,400 euros once and under 50 euros of infrastructure a month (estimate). Three points make the self-build fail anyway. Since 16 January 2024 Google has required a Google-certified platform connected to the Transparency and Consent Framework for personalised ads to users in the European Economic Area and the United Kingdom, and a self-built banner does not get that certification. The vendor maintains more than 2,200 service descriptions with purpose and legal basis and keeps them current, while a self-build adds every new service by hand. And the record has to carry the version of the banner under which consent was given; self-built logs regularly omit exactly that versioning, and it only shows up once a supervisory authority asks.
Our advice
- Solo: Take it: below 1,000 sessions a month the platform costs nothing.
- Mid-market: Buy it, and pick the session tier with headroom, or the plan rises by itself.
- Enterprise: Negotiate Corporate, and reconcile the two divergent sub-processor lists into one.
Who is behind it
Staying power: Established
Registered in the commercial register (Handelsregister) of the Munich local court (Amtsgericht) since 30 May 2018, and therefore eight years in market. In August 2021 Cybot ApS, the parent of Cookiebot, joined as a voting shareholder; in September 2021 the share capital rose from 65,408 to 152,112 euros. January 2026 brought an acquisition in New York. The contract documents are maintained: the data processing agreement carries version 3.1 of February 2026, and the attestations in the trust centre were renewed on 6 August 2026.
- Legal entity, registered office and representation: Usercentrics GmbH, Sendlinger Strasse 7, 80331 Munich, HRB 241272 at the Munich local court (Amtsgericht), VAT identification number DE318857096, represented by Donna Dror and Ea Luise AndersenLegal entity, registered office, register number, VAT identification number and managementOpen source · As of 2026-09-02
- Registration and shareholding position in the register: registered on 30 May 2018; share capital raised from 25,000 euros at founding to 164,960 euros most recently in December 2022; Cybot ApS a voting shareholder since August 2021, with Usercentrics A/S listed as parentCommercial register data on registration date, development of share capital and shareholding positionOpen source · As of 2026-09-02
- Most recent acquisition: MCP Manager of New York, announced on 14 January 2026; no purchase price was disclosedAcquisition of MCP Manager of New York, announced on 14 January 2026, with no purchase price statedOpen source · As of 2026-01-14
- Renewal of attestations: SOC 2 Type II and HIPAA re-attested on 6 August 2026, ISO 27701:2019 since 27 October 2025, NIST CSF 2.0 since 10 February 2026; the vendor releases the reports only after a request formAttestations with standard, version and scope, server locations in EU member states mainly in Germany and Belgium, and the second sub-processor list of six entriesOpen source · As of 2026-08-06
- Maintenance state of the legal documents: data processing agreement in version 3.1 of February 2026, 24 pages, with technical and organisational measures, the sub-processor list and the service description as annexes; the terms and conditions have applied since 21 August 2025 according to the site index, with earlier versions still retrievableData processing agreement version 3.1 of February 2026: sub-processors with place and purpose in Annex 2, standard contractual clauses for Google Cloud, a thirty-day objection period, deletion within thirty days and backups within six monthsOpen source · As of 2026-09-02
- Documented court proceedings: On 1 December 2021 the Wiesbaden administrative court prohibited a university from embedding Cookiebot, because IP addresses were transmitted to Akamai servers in the United States (case 6 L 738/21.WI). The Hessian higher administrative court set the order aside on 17 January 2022, resting on the absence of urgency (case 10 B 2486/21). Cookiebot has belonged to the group since September 2021.The Wiesbaden administrative court order of 1 December 2021 concerning Cookiebot and its reversal by the Hessian higher administrative court on 17 January 2022 for lack of urgencyOpen source · As of 2022-01-17
Cost of leaving: Moderate
The data comes out. The consent log can be downloaded, and the switch itself is an exchange of the script in the page head. Two things the export does not carry. The first is the configuration: which of the more than 2,200 service descriptions were active, in which category, on which legal basis, under which version of the banner. A list of decisions without the text that was on screen when the decision was made carries little weight as a record under Article 7(1) GDPR. The second is whether the consents themselves carry over. Whether a consent given under the old banner still holds under the new one depends on purposes, service list and text staying unchanged. Where they differ, the question has to be put again, and the opt-in rate starts from scratch. Anyone anchoring their reach measurement to that rate loses comparability across the switch.
Regulation and data
| Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann. | documented, no condition attachedpublic PDF, version 3.1 dated February 2026Data processing agreement version 3.1 of February 2026: sub-processors with place and purpose in Annex 2, standard contractual clauses for Google Cloud, a thirty-day objection period, deletion within thirty days and backups within six monthsOpen sourceThe agreement sits in the legal document library without any login and runs to 24 pages, with the technical and organisational measures as Annex 1, the sub-processor list as Annex 2 and the service description as Annex 3. Clause 7.1 of the terms and conditions provides for it as a separate document and gives it precedence in case of conflict. The published copy carries no signature; anyone needing a signed version for their files obtains it from the vendor. For Cookiebot the same vendor maintains a second, separate agreement.As of 2026-09-02 |
|---|---|
| Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt. | documented, no condition attachedEU member states, mainly Germany and BelgiumAttestations with standard, version and scope, server locations in EU member states mainly in Germany and Belgium, and the second sub-processor list of six entriesOpen sourceAnnex 2 of the data processing agreement lists Google Cloud EMEA Ltd. for the consent platform with the place of processing in the European Union. The trust centre is more precise and names statically hosted resources, application programming interfaces and databases in EU member states, mainly in Germany and Belgium. The storage location depends on no plan and costs nothing extra. For the server-side tracking add-on this does not hold in the same form; see the third-country point.As of 2026-09-02 |
| Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren. | documented, tied to a conditiontwo public lists with different contentsData processing agreement version 3.1 of February 2026: sub-processors with place and purpose in Annex 2, standard contractual clauses for Google Cloud, a thirty-day objection period, deletion within thirty days and backups within six monthsOpen sourceAnnex 2 of the data processing agreement lists four processors with company, address, place of processing and purpose: Google Cloud EMEA Ltd. of Dublin for operations, Bunny Way d.o.o. of Medvode for delivery, Hetzner Online GmbH of Gunzenhausen for operations, and Cloudflare, Inc. of San Francisco for delivery in server-side tracking. On the same day the trust centre carries a different list of six entries, namely Google Cloud Platform, Microsoft Azure, MongoDB Atlas, Salesforce, Zendesk and Vanta, without country and without place of processing. Neither list contains the other. Under clause 6.1.1 the annex is the binding one, and the thirty-day objection period runs against changes to it alone. This divergence belongs on the table in contract negotiation.As of 2026-09-02 |
| Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt. | documented, tied to a conditiontransfer only with the server-side tracking add-on, basis assigned per recipient only in partData processing agreement version 3.1 of February 2026: sub-processors with place and purpose in Annex 2, standard contractual clauses for Google Cloud, a thirty-day objection period, deletion within thirty days and backups within six monthsOpen sourceFor Google Cloud EMEA Ltd. Annex 2 names the standard contractual clauses between Usercentrics and Google explicitly, points to a retrievable address and grounds this in the European Court of Justice judgment of 16 July 2020 in case C-311/18. For Cloudflare, Inc. of San Francisco the same annex gives the word global as the place of processing and names no basis of its own. That entry concerns the server-side tracking add-on alone; by the same list the consent platform stays inside the Union. Anyone booking the add-on settles this point before signing.As of 2026-09-02 |
| Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt. | documented, but unfavourableno statement on model training, analysis of anonymised data permitted by contractClause 6.4 on the analysis of anonymised and aggregated customer data, and clause 7.1 on the separate data processing agreement taking precedence in case of conflictOpen sourceClause 6.4 of the terms and conditions grants the vendor the right to create analyses from aggregated and anonymised customer data and to use them for product improvement, for the development of new products, for industry analysis and for anonymous benchmarking. No right to object appears at that point. On training models with customer content, the terms and conditions and the data processing agreement are silent in both directions. What is rated here is that silence, not a documented training practice.As of 2026-09-02 |
| Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung. | documented, no condition attached30 days after the contract ends, backups up to 6 months, consent log 12 monthsData processing agreement version 3.1 of February 2026: sub-processors with place and purpose in Annex 2, standard contractual clauses for Google Cloud, a thirty-day objection period, deletion within thirty days and backups within six monthsOpen sourceClause 11.1 of the data processing agreement obliges the vendor to hand over or delete within thirty days of the contract ending, at the controller's choice, and to submit a deletion protocol on request. Backups carry their own limit of no more than six months. Inside the product a third figure applies: the pricing page states that the consent log is accessible and downloadable for twelve months. Anyone who has to keep the record beyond that period exports regularly and files it themselves.As of 2026-09-02 |
| Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden. | documented, no condition attachedISO 27001:2022, ISO 27701:2019, SOC 2 Type 2, TISAX level 3, HIPAAAttestations with standard, version and scope, server locations in EU member states mainly in Germany and Belgium, and the second sub-processor list of six entriesOpen sourceThe trust centre names the standard and its version and states the scope as Usercentrics GmbH together with Usercentrics A/S, Usercentrics s.r.o., Usercentrics Inc. and Usercentrics Unipessoal. The renewal for SOC 2 Type II and HIPAA carries 6 August 2026, the ISO 27701:2019 certification 27 October 2025, and the TISAX result the year 2025. The certificates and audit reports themselves sit behind a request form and become visible only once the vendor grants access. ISO 27001 is additionally named openly on the pricing page.As of 2026-09-02 |
| EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen. | documented, tied to a conditionno statement on its own classification; no AI system faces visitors in the bannerusercentrics.com/eu-ai-actOpen sourceThe vendor maintains its own pages on the regulation on artificial intelligence and lists roles for AI engineering and AI governance in the trust centre. On its own obligations it says nothing there, neither about a classification nor about its role as provider or deployer. For the consent platform this has no consequence. No labelling duty under Article 50 of Regulation 2024/1689 arises here, because that provision targets systems that interact with people or generate content, and the machine translation of a self-written banner text falls outside it. Anyone booking the AI agent governance component acquired in January 2026 from the same account carries the classification of that deployment themselves.As of 2026-09-02 |
| Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält. | documented, no condition attachedconsent log in all six plans, downloadable, twelve monthsPrices per plan, session limits, automatic plan upgrade once limits are exceeded, the twelve-month consent log in every tier, and the second factor and directory sign-in in the Corporate plan aloneOpen sourceThe comparison table on the pricing page places proof of consent in all six tiers, including free access. The log is held centrally, remains accessible for twelve months and can be downloaded as the history of individual users. Clause 10 of the data processing agreement adds the controller's rights to information and inspection, including on-site audits. Securing the administration account is a separate matter: by the same table, the second factor and sign-in through the company's own directory service appear in the Corporate plan alone.As of 2026-09-02 |
What it really costs
Entry price
Free below 1,000 sessions a month on one domain. Above that, 7 euros a month for 1,500 sessions, 15 euros for 3,000, 30 euros for 15,000 across three domains and 50 euros for 50,000 across ten domains, each excluding VAT. From one million sessions a month the Corporate plan applies, for which the pricing page names no amount.Prices per plan, session limits, automatic plan upgrade once limits are exceeded, the twelve-month consent log in every tier, and the second factor and directory sign-in in the Corporate plan aloneOpen source
As of 2026-09-02
What gets expensive
Sessions. The session is the unit counted, and a returning visitor produces several a month. The pricing page states that the plan rises by itself under the terms once the limit is exceeded, so a campaign with four weeks of raised traffic lifts the running cost. The second threshold is the jump to Corporate, because that is where sign-in through the company's own directory service, the second factor, the approval chain before going live and bulk editing sit. No amount can be named for it, because the vendor publishes none for that tier.
What it displaces
- The banner from a plugin that nobody has touched since the law last changed
- The assurance in the privacy notice that only necessary cookies are set, without anyone having counted the scripts that load
- The record of consent that nobody can produce when it matters, because it was never kept
Interfaces
- Google Consent Mode v2, Microsoft UET Consent Mode and Amazon Consent Signal without in-house development
- IAB Transparency and Consent Framework version 2.3, from the Pro plan upwards
- GraphQL interface for setting up large numbers of configurations
- Download of individual users' consent history across twelve months
- Separate consent management for web, app and connected television under one account
Matching methods
- "Context: Moat or Wall?" TestThe test separates what creates an edge from what prevents falling behind, and a bought consent platform reliably lands on the second side when the question is played through honestly.
- Regulatory Density TestThe density of evidence duties decides whether the log, the second factor and the approval chain are add-ons or the condition of purchase, and that is exactly what the jump into the negotiated tier hangs on here.
- Geo Experiment / Matched-Market Incrementality TestAs soon as some visitors refuse consent, user-level attribution falls away, and the effect of advertising spend can only be measured through matched-market tests.
Alternatives
- Plausible Analytics
Sources
- 1.Legal entity, registered office, register number, VAT identification number and management (opens in a new tab)usercentrics.com/legal-notice · As of 2026-09-02
- 2.Data processing agreement version 3.1 of February 2026: sub-processors with place and purpose in Annex 2, standard contractual clauses for Google Cloud, a thirty-day objection period, deletion within thirty days and backups within six months (opens in a new tab)usercentrics.com/data-processing-agreement · As of 2026-09-02
- 3.Clause 6.4 on the analysis of anonymised and aggregated customer data, and clause 7.1 on the separate data processing agreement taking precedence in case of conflict (opens in a new tab)usercentrics.com/terms-and-conditions · As of 2026-09-02
- 4.Prices per plan, session limits, automatic plan upgrade once limits are exceeded, the twelve-month consent log in every tier, and the second factor and directory sign-in in the Corporate plan alone (opens in a new tab)usercentrics.com/pricing · As of 2026-09-02
- 5.Attestations with standard, version and scope, server locations in EU member states mainly in Germany and Belgium, and the second sub-processor list of six entries (opens in a new tab)trust.usercentrics.com · As of 2026-09-02
- 6.Acquisition of MCP Manager of New York, announced on 14 January 2026, with no purchase price stated (opens in a new tab)usercentrics.com/press/usercentrics-acquires-mcp-manager · As of 2026-01-14
- 7.Google's requirement of a certified consent platform connected to the Transparency and Consent Framework for personalised ads in the European Economic Area and the United Kingdom since 16 January 2024 (opens in a new tab)support.google.com/adsense/answer/13554116 · As of 2026-09-02
- 8.The Wiesbaden administrative court order of 1 December 2021 concerning Cookiebot and its reversal by the Hessian higher administrative court on 17 January 2022 for lack of urgency (opens in a new tab)heise.de/… · As of 2022-01-17
- 9.Commercial register data on registration date, development of share capital and shareholding position (opens in a new tab)northdata.de/Usercentrics+GmbH,+M%C3%BCnchen/HRB+241272 · As of 2026-09-02
- 10.Published plans and user volumes of the AI-native counterpart Ketch (opens in a new tab)ketch.com/pricing · As of 2026-09-02
- 11.usercentrics.com/eu-ai-act (opens in a new tab)As of 2026-09-02
Last reviewed: 2026-09-02 by Dr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.
From tool to decision
The offer that fits this tool
A tool profile tells you what the tool does and what it means for compliance. Whether it gets priority in your company is a management decision, and it takes one working day: the executive AI workshop ranks your initiatives by business value, risk, data readiness and ownership.