How to choose privacy software for a small business: 9 questions to ask

Most privacy software demos look good. The differences show up later: when the banner loads a tracker anyway, when you need to leave, or when the bill arrives. These nine questions are meant to surface those differences before you commit.

They work for a small business choosing a first tool and for a team replacing one. If you are still deciding which kind of product you need, start with our overview of the privacy software categories.

#1. Which laws and regions does it cover?

Start from your audience, not the vendor's feature list. List the countries where your visitors and customers live, then ask which laws the tool handles for each: the GDPR and ePrivacy rules in Europe, state laws in the United States, and others such as Canada, Brazil or Australia. Our overview of privacy laws around the world shows how much they differ.

Two things to check:

• Opt-in versus opt-out. The EU and UK ask for consent before non-essential cookies. Most US state laws rely on opt-out rights and signals such as Global Privacy Control. A tool should be able to behave differently by region.
• Documents, not only the banner. Ask whether the policies and request deadlines follow the countries you choose, or only the banner does.

#2. One source of truth, or several separate tools?

A privacy policy, a cookie policy, a vendor list and a processing register all describe the same facts: which tools you use and what data they handle. If each lives in a different product, they drift apart. A new analytics tool gets added to the website, but not to the policy.

Ask how a change travels. In a single workspace, you add a vendor once and every document reflects it. With separate tools, you copy the change by hand each time. Separate tools can still be the right choice if one of them is far better at its job, as long as you accept the upkeep.

#3. How does the cookie banner block before consent, and how does it prove consent?

This is the question where marketing and reality differ most. The ePrivacy Directive, Article 5(3), requires consent before storing or reading non-essential data on a device, and the GDPR, Article 7(1), requires you to be able to demonstrate consent. Our guide to GDPR cookie consent covers the rules.

Test it yourself during the trial:

1. Open your site in a private window and keep the banner untouched.
2. In your browser's developer tools, open the Network tab and look for analytics and advertising requests. There should be none.
3. Click reject, reload, and check again.
4. Look for a consent log: date, banner version and the choices made.
5. If you use Google tags, check that Consent Mode values change with the choice.
6. Send a request with the Global Privacy Control signal and see whether the tool honours it where the law expects it.

Also ask about limits. Some tools cannot intercept scripts loaded in certain ways, and some do not support the IAB Transparency and Consent Framework or are not on Google's list of certified CMP partners. Whether that matters depends on your advertising setup, but the vendor should say it plainly.

#4. Where is data hosted, and does the vendor have its own DPA?

A privacy tool is itself a vendor that handles personal data: banner choices, request details, your team's accounts. Apply the same checks you would apply to any tool. Ask where the data is stored, which sub-processors the vendor uses, whether it offers a data processing agreement, and what protects any transfer outside the EEA.

Our vendor privacy due diligence checklist walks through twelve points, and the guide to international data transfers explains the transfer tools. A vendor of privacy software that cannot answer these questions about itself is telling you something.

#5. Can you export your data and leave?

Your policies, vendor records, request history and consent logs are records you may need years later. Before you commit, ask:

• Can I export each document and register in a usable format?
• Can I export the consent log and the request history?
• What happens to my data, and my banner, if I cancel or a payment fails?
• How long does the vendor keep data after I leave, and can I ask for deletion?

On a free plan, check that the export is not locked behind a paid tier.

#6. How is it priced?

Price models differ more than price levels, and the model decides how the bill grows. As of November 2026, the public pricing pages we read use these bases:

• Per domain, by pageviews. CookieYes lists tiers by monthly pageviews, with a rate of $0.30 per 1,000 extra pageviews on two plans.
• Per domain, by subpages. Cookiebot states that its plans depend on the number of subpages, and that traffic and page views are not billed.
• Per site, by pageviews. iubenda lists pageview bands per site, with extra pageviews at €0.05 per 1,000 on its cookie plans.
• Per website, by banner views and seats. Termly lists banner views and included users per plan.
• Per workspace. Privacyboard charges per workspace, whatever the number of visitors or vendors.

Ask what happens when you exceed a limit: an automatic upgrade, a per-unit fee, or a blocked banner. Our guide to what privacy software costs compares published prices.

#7. Who can use it, and with what roles?

Privacy work involves more than one person: a founder, a developer who installs the banner, someone who answers requests, an outside adviser. Check whether the plan includes several users, whether roles separate what each can do, and whether there is an activity log showing who changed what. Two-step sign-in is a reasonable expectation for a tool that stores this kind of record.

#8. How do updates follow law changes?

Laws change, and so do vendors' terms. Ask specifically how the tool's texts and rules are updated, and who is responsible. Termly, for instance, lists regulation monitoring on its paid plans. Whatever the answer, a good vendor says what is updated for you and what you must re-check yourself. Beware of a vendor that implies you can stop paying attention.

#9. What is automated, and what stays manual?

"Automated" can mean a lot or very little. Ask for specifics:

• Does a scan find cookies and trackers by loading your pages in a real browser, or by reading source code?
• Does it detect changes after you publish, and does it alert you?
• Are request deadlines counted for you?
• Are documents generated from your answers, or are they a blank template?
• What does the tool never do, such as discovering personal data in your databases?

Automation you cannot inspect is hard to trust. Prefer tools that show you what they found and let you correct it.

#Red flags

• A promise of total compliance. No tool can promise that. Compliance depends on what you do.
• A "privacy score" with no explanation. A number that you cannot trace to specific findings gives false comfort.
• Pricing by pageviews with no stated overage rule. The bill can jump without warning.
• No public information on hosting, sub-processors or a DPA.
• No way to export, or deletion only on request after a long delay.
• A banner that looks right but cannot be tested. If the vendor discourages checking what loads, be cautious.
• Documents that are the same for every customer. They cannot describe your tools.

#A scoring table

Score each row from 0 (fails or unknown), 1 (partly) to 2 (clearly yes). A total of 14 or more out of 18 suggests a tool worth a longer trial. The threshold is a rule of thumb, not a standard.

#Where Privacyboard fits

Privacyboard is built around question 2. It is a workspace for small businesses where you record each vendor once, from a catalog of 550+ common tools, and that record feeds the privacy policy, cookie policy, vendor list, data processing agreement, processing register, request tracker, incident register, public privacy center and cookie banner. Data is hosted in the EU. The banner blocks scripts before consent, supports Google Consent Mode and Global Privacy Control, and keeps a consent log. Teams get roles, an activity log and optional two-step sign-in.

On the other side of the ledger: it is a guidance tool and not legal advice, it does not promise compliance, and it is not an enterprise GRC platform. There is no automated discovery of personal data across databases, no audit workflow or questionnaire suite and no certification reports. The banner does not implement IAB TCF and is not a Google-certified CMP. Pricing is per workspace: Free at $0 for one member, Pro at $29 a month or $288 a year. See pricing.

#FAQ

#What is the most important criterion when choosing privacy software?

For most websites it is whether the cookie banner really blocks trackers before consent and keeps proof of the choice, because visitors and regulators can observe that. After that, the next question is whether your documents stay consistent with what you actually use.

#Should a small business buy one all-in-one tool or several specialised ones?

One workspace reduces duplicated data entry and drift between documents. Specialised tools can go deeper in one area. Choose based on whether your bottleneck is upkeep or depth.

#How do I test a cookie banner before buying?

Open your site in a private window, leave the banner untouched and watch the Network tab in your browser's developer tools. Analytics and advertising requests should not appear until you accept.

#Is a free plan enough for a small business?

Sometimes. Check the limits on pageviews, domains, scans and exports, and whether the free plan includes the features you need, such as the consent log.

#Do I need a data processing agreement with my privacy software vendor?

If the tool processes personal data on your behalf, such as consent records or request details, yes. Look for a published DPA and a sub-processor list.

#How often should I review my privacy software?

At least once a year, and whenever you add a major tool, a new domain or a new market. Scan your site regularly, since a new script can undo your settings.

#Sources

• ePrivacy Directive 2002/58/EC, Article 5(3), EUR-Lex
• Regulation (EU) 2016/679 (GDPR), Articles 7 and 28, EUR-Lex
• Global Privacy Control specification
• CookieYes pricing, Cookiebot pricing, iubenda pricing, Termly pricing, read 4 November 2026