GDPR checklist for consent management tools.
Consent tools record what each visitor agreed to. That record is itself personal data, and it must stay accurate. Compare 2 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 iubenda | Usually a processor | Set per account or project | Obtained through the vendor |
 Usercentrics | Usually a processor | Set per account or project | Obtained through the vendor |
What to check for consent management tools
- Check that the banner blocks non-essential tags until the visitor agrees.
- Keep consent records for as long as you may need to prove them, and no longer.
- Link your privacy policy and cookie list from the banner.
- Test the banner after any change to your site or tools.
All consent management tools
Questions, answered.
What should I check before using a consent management tool under the GDPR?
Check that the banner blocks non-essential tags until the visitor agrees. Keep consent records for as long as you may need to prove them, and no longer. Link your privacy policy and cookie list from the banner. Test the banner after any change to your site or tools.
Do I need a data processing agreement with a consent management provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which consent management tools does Privacyboard cover?
iubenda, Usercentrics. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.