Consent management platforms (CMP)

Usercentrics

Consent management platform from Germany

GermanyEUFree plan Ownership reviewed, controller unresolvedHigh non-EU dependency

Scope verdict

Ownership reviewed, controller unresolved

This service remains visible for context, but it is not counted or recommended as a European-controlled option.

How we classify services

Operational dependency warning

Relies heavily on non-European providers

Current public evidence shows 6 non-European infrastructure or email dependencies across 5 providers: Cloudflare, Google, Mailgun, Salesforce Pardot, Zendesk. The reviewed operational path is therefore not entirely European.

Review dependencies ↓

Usercentrics is a consent management platform from Germany. It offers separate products for different situations: Cookiebot CMP for ordinary websites, Web CMP for larger enterprise sites, and App and CTV CMP for devices such as phones and connected televisions.

The company is German, which makes it a European alternative to the American consent tools, although core parts of the service are hosted with American cloud providers including Google Cloud Platform. It fits website and app operators who need consent banners that hold up under EU rules.

Pricing

Cookiebot CMP has a free plan. The cheapest paid Cookiebot plan starts at 7 euros per domain per month.

Data and operations

Infrastructure and email path

Verified operational dependencies, shown separately from ownership and from the service's core data hosting.

Public website

Cloudflare

Non-European provider
Observed
A 141.193.213.21, 141.193.213.20 · AS209242

Why this matters

Public DNS routes website visits through Cloudflare. Visitor IP addresses and request metadata can reach this non-European provider; this does not identify the core service's data location.

Incoming business email

Google Workspace

Non-European provider
Observed
MX 1 aspmx.l.google.com · 5 alt1.aspmx.l.google.com · 5 alt2.aspmx.l.google.com · 10 alt3.aspmx.l.google.com · 10 alt4.aspmx.l.google.com

Why this matters

Published MX records route incoming business email through Google Workspace. Correspondent details and message content can therefore enter this non-European provider's systems; MX does not reveal the configured storage region.

Authorised outbound email

Google Workspace

Non-European provider
Observed
SPF _spf.google.com

Why this matters

This domain authorises Google Workspace to send email. If active, recipient details and message content can be processed by this non-European provider. SPF does not reveal its configured storage region.

Authorised outbound email

Mailgun

Non-European provider
Observed
SPF eu.mailgun.org

Why this matters

This domain authorises Mailgun to send email. If active, recipient details and message content can be processed by this non-European provider. SPF does not reveal its configured storage region.

Authorised outbound email

Salesforce Pardot

Non-European provider
Observed
SPF aspmx.pardot.com

Why this matters

This domain authorises Salesforce Pardot to send email. If active, recipient details and message content can be processed by this US-controlled provider. SPF does not reveal its configured storage region and does not prove that all customer data is stored in the United States.

Authorised outbound email

Zendesk

Non-European provider
Observed
SPF mail.zendesk.com

Why this matters

This domain authorises Zendesk to send email. If active, recipient details and message content can be processed by this non-European provider. SPF does not reveal its configured storage region.

Public DNS records identify visible providers and routes, not every backend location or private data-region setting.

Infrastructure checked:

More from Germany