Best Cookie Consent Tools for SaaS Founders (2026 Prices)

Short answer: If your marketing site and app set no non-essential cookies (cookie-free analytics, no ad pixels, no retargeting), you may not need a cookie banner at all. If you do run Google Ads, GA4 or other trackers for EU or UK visitors, the best default for a small SaaS is CookieYes ($10/mo per domain for 100,000 pageviews, free under 5,000), with CookieScript, Cookiebot and the free vanilla-cookieconsent library as strong alternatives depending on your budget and stack.

Every price, limit and quote below comes from the vendor's or regulator's own page, checked on 10 Nov 2026. Picks and arithmetic are ours and are labelled.

TL;DR#

• Cheapest compliance is no banner. Strictly necessary storage (login sessions, CSRF tokens) does not need consent. Ad tags and identifying third-party analytics do.
• Best default: CookieYes Free to 5,000 pageviews, Basic $10/mo to 100,000, with "Google Consent Mode v2" and "Cookie auto-blocking" on every plan.
• Unlimited traffic on a budget: CookieScript Lite at €9/mo with "Unlimited monthly pageviews".
• Priced by site size, not traffic: Cookiebot Premium Lite €7/mo for up to 50 subpages.
• Free and open source: vanilla-cookieconsent (MIT) or Klaro (BSD-3). WordPress sites: Complianz free.
• Running AdSense? You need a Google-certified CMP integrated with the TCF for personalised ads in the EEA, UK and Switzerland.

Disclosure: ZeroRaised publishes this guide and is a launch site for bootstrapped products. We have no commercial or affiliate relationship with any vendor named here and earn nothing if you sign up. This is not legal advice. Facts come from the linked sources as checked on 10 Nov 2026.

First: do you need a cookie banner at all?#

Our GDPR checklist for solo SaaS founders covers the legal background, including Article 5(3) of the ePrivacy Directive, so we will not repeat it. The short version that matters for tool choice:

• EU: The EDPB's Cookie Banner Taskforce recalled that "by default, no cookies which require consent can be set without a consent and that consent must be expressed by a positive action on the part of the user" (EDPB report, Jan 2023). Strictly necessary storage is exempt.
• France (and a useful benchmark): CNIL exempts audience measurement cookies from consent when their purpose is "strictement limitée à la seule mesure de l'audience du site" (strictly limited to measuring the site's audience), they produce "données statistiques anonymes uniquement" (anonymous statistics only), and they do not track browsing across sites or get combined with other processing (CNIL).
• UK: The Data (Use and Access) Act 2025 added an exemption to PECR for storage used "to collect information for statistical purposes about how the service is used" with a view to improving it, provided the information "is not shared with any other person", users get "clear and comprehensive information about the purpose", and they are given "a simple means of objecting, free of charge" (DUAA Schedule 12). legislation.gov.uk records it in force from 5 February 2026.

Our read: for a typical SaaS, the banner exists because of three things: Google Ads conversion tags, GA4, and social ad pixels (Meta, LinkedIn, X). If you measure your marketing site with cookie-free analytics (we compare options in our free website analytics guide) and you do not run paid ads, audit your cookies first. You may be able to skip this whole category of software. Inside a logged-in app, session and security cookies are usually strictly necessary.

Google's rules that shape your choice#

Consent Mode v2 (Google Ads and GA4). "Consent mode lets you communicate your users' cookie or app identifier consent status to Google", but it "doesn't provide a consent banner or widget" (Google Ads Help). Version 2 "was updated in November, 2023 and now contains two additional parameters": ad_user_data and ad_personalization (Google developers). For EEA traffic, to keep measurement, ad personalisation and remarketing, Google says you "must collect consent for use of personal data from end users based in the EEA and share consent signals with Google" (Google Tag Manager Help). Basic mode blocks Google tags "until a user interacts with a consent banner"; our read is that it is the simpler default for a small site.

Certified CMP (AdSense, Ad Manager, AdMob). To serve personalised Google ads, publishers "are required to use a consent management platform (CMP) that has been certified by Google". "As of 16 January 2024, a certified CMP integrated with the TCF is required" for the EEA and UK, and from 31 July 2024 for Switzerland (AdSense Help).

Of the tools below, CookieYes, iubenda, CookieScript and CookieHub state on their pricing pages that they are Google-certified CMPs. The open source libraries are not.

The 10 tools compared#

Each vendor counts traffic differently (pageviews, sessions, banner views, visitors, subpages). We kept their own units.

Notes: Termly showed a 50% off Black Friday code until 28 Nov 2026; prices shown are list prices. Cookiebot's page is internally inconsistent about when its €15 and €30 tiers apply, so check your quote.

The tools, one by one#

CookieYes: the default for most SaaS sites#

CookieYes fits the usual indie setup: one marketing domain, modest traffic, GA4 or Google Ads tags. Free covers 5,000 pageviews a month with CookieYes branding. Basic is $10/mo (or $100/yr) per domain for 100,000 pageviews; Pro is $25/mo for 300,000 (CookieYes pricing). Our read: Consent Mode v2, auto-blocking and Google certification are on the free plan too, so you never upgrade just for the features that matter.

Cookiebot (Usercentrics): best if your site is small but busy#

Cookiebot charges by subpages, not traffic: "Pricing is based on the number of subpages, not on page views or usage." Free covers up to 50 subpages on one domain but blocking there is manual; Premium adds automatic blocking. Premium Lite is €7/mo for up to 50 subpages, excluding VAT (Cookiebot pricing).

Our read: a SaaS with a homepage, pricing page and a handful of docs pages fits under 50 subpages. Once you start a blog, you outgrow that fast.

CookieScript: flat price for spiky traffic#

Lite is "€9 / month, €108 billed yearly" with "Unlimited monthly pageviews" and no overage fees. Its FAQ says Standard (€19/mo) "blocks third-party scripts automatically" (CookieScript pricing). Our read: the right pick if a launch could spike your traffic and you hate metered bills.

The rest, briefly#

• Termly bundles policy generators. Starter is $10/website/month billed annually for 50,000 banner views, but Google Consent Mode v2 appears in the Pro+ feature list ($15/mo yearly) (Termly pricing).
• iubenda is cheapest to start (€4.99/mo yearly), but Essentials stops at 25K pageviews and Advanced (50K) is €19.99/mo (iubenda pricing).
• CookieHub prices by sessions: €6/mo for 5,000, €10/mo for 30,000 (CookieHub pricing).
• Osano has a free tier for "individuals & solo founders", but the next step is $199/mo (Osano plans). Our read: built for companies with a privacy team.
• Complianz is the WordPress answer: the free plugin "includes a fully functional cookie banner, automatic cookie scan, script blocking" (WordPress.org); Premium is $59 a year for one site (Complianz pricing).
• Klaro is "licensed under a BSD-3 license" (GitHub), with an optional hosted service from 19 € a month (Klaro pricing).

vanilla-cookieconsent: free, light, DIY#

Orest Bida's library is "Distributed under the MIT License" (GitHub). It does not scan or auto-block: you mark each script with type="text/plain" and data-category="your-category-name" so it only runs after consent (docs). Google Consent Mode is "an example implementation" in the docs that calls gtag('consent', 'update', ...) from the plugin's callbacks (docs).

Our read: ideal for a developer with a Next.js or Astro marketing site and three or four third-party scripts. You own the cookie list, so you must update it whenever you add a tag.

Banner design: put "Reject all" on the first layer#

Whatever tool you pick, configure it properly. The EDPB taskforce found that "a vast majority of authorities considered that the absence of refuse/reject/not consent options on any layer with a consent button" means the consent is invalid. It "confirmed that pre-ticked boxes to opt-in do not lead to valid consent", and flagged reject options hidden as a link in a paragraph of text, or a reject button whose contrast is so low the text is "unreadable" (EDPB report).

Our setup checklist for any of these tools:

1. List every script, pixel and embed, and remove the ones you do not use.
2. Install the banner before any other tag in your <head>, with Consent Mode v2 on if you use Google tags.
3. Accept all and Reject all as equal buttons on the first layer, non-essential categories unticked.
4. Test in an incognito window with the network tab open: no tag should fire before a choice.
5. Add a footer link to change consent, and re-scan whenever you add a script.

Add this to your product launch checklist: launch day is when a broken banner gets seen by the most people.

Worked example: cost at 50,000 pageviews a month#

Example, our arithmetic. One marketing domain, 50,000 pageviews a month, about 40 subpages, GA4 plus Google Ads, EU and UK visitors. We assume about 25,000 sessions and 20,000 unique visitors, which you should replace with your own analytics numbers.

Our read: apart from Osano and iubenda Advanced, the hosted options sit between €6 and $15 a month for a small SaaS. The real cost differences are your time and whether auto-blocking catches the tags you forget about. If you add a blog and pass 50 subpages, Cookiebot's price moves up; if a launch triples your traffic, CookieYes stays on Basic until 100,000 pageviews and CookieScript does not change at all.

Our picks by situation#

Frequently asked questions#

Do I need a cookie banner for my SaaS?#

Only if you set or read non-essential cookies or similar storage. Login session cookies and other strictly necessary storage do not need consent. Ad pixels, retargeting and most third-party analytics do. If you use cookie-free analytics and no ad tags, you may not need a banner. In the UK, the Data (Use and Access) Act 2025 added an exemption for some first-party statistics cookies, in force from 5 February 2026, as long as users get clear information and a simple, free way to object.

What is the best free cookie consent tool?#

For a hosted tool, CookieYes Free covers 5,000 pageviews a month with Consent Mode v2 and auto-blocking, and CookieScript Free covers 10,000 pageviews on one domain. For no traffic limits at all, the open source vanilla-cookieconsent library (MIT licence) is free, but you must tag your scripts with type=text/plain and a data-category attribute and set up Google Consent Mode yourself.

Do I need Google Consent Mode v2?#

If you use Google Ads or GA4 tags with visitors in the EEA, Google says you must collect consent and share consent signals with Google to keep using its measurement, ad personalisation and remarketing features. Consent Mode v2 added two parameters, ad_user_data and ad_personalization, in November 2023. Consent Mode does not provide a banner, so you still need a consent tool that sends those signals.

Does a cookie banner need a reject all button?#

In the EDPB Cookie Banner Taskforce report of January 2023, a vast majority of EU authorities said a banner with an accept button but no refuse or reject option on any layer is not valid consent. The same report says pre-ticked boxes do not give valid consent. Our read: put Reject all next to Accept all on the first layer, styled the same.

How much does a cookie consent tool cost at 50,000 pageviews a month?#

On published prices for one domain: CookieYes Basic $10/mo, CookieScript Lite €9/mo, Termly Starter $10/mo billed annually (or Pro+ at $15/mo if you need Consent Mode v2), iubenda Advanced €19.99/mo billed yearly, and Cookiebot from €7/mo if your site has under 50 subpages. Open source options cost $0 plus your time.

Launch with a clean banner#

ZeroRaised is a launch directory for products built without institutional VC. Once your consent setup is sorted, submit your product for free. For more practical guides on running a SaaS without investors, join the ZeroRaised newsletter.

Sources#

• CookieYes pricing, last checked 10 Nov 2026
• Cookiebot pricing, last checked 10 Nov 2026
• Termly pricing, last checked 10 Nov 2026
• iubenda pricing, last checked 10 Nov 2026
• CookieScript pricing, last checked 10 Nov 2026
• CookieHub pricing, last checked 10 Nov 2026
• Osano pricing and Osano cookie consent plans, last checked 10 Nov 2026
• Complianz on WordPress.org and Complianz pricing, last checked 10 Nov 2026
• Klaro on GitHub and Klaro pricing, last checked 10 Nov 2026
• vanilla-cookieconsent on GitHub, managing scripts and Google Consent Mode example, last checked 10 Nov 2026
• Google Ads Help: About consent mode, last checked 10 Nov 2026
• Google for Developers: Set up consent mode, last checked 10 Nov 2026
• Google Tag Manager Help: consent for EEA traffic, last checked 10 Nov 2026
• AdSense Help: Google-certified CMP requirement, last checked 10 Nov 2026
• EDPB Cookie Banner Taskforce report (PDF), last checked 10 Nov 2026
• CNIL: cookies for audience measurement tools, last checked 10 Nov 2026
• Data (Use and Access) Act 2025, Schedule 12, last checked 10 Nov 2026