Set up consent and privacy policies

Tools that power the Set up consent and privacy policies stack

• Cookiebot — Cookie consent manager

  Scan site technologies and configure consent categories, blocking and withdrawal controls

  See all stacks using Cookiebot

• OneTrust — Enterprise privacy platform

  Privacy and consent-management tools that support an organization’s compliance work

  See all stacks using OneTrust

• Iubenda — Privacy policy generator

  Generate lawyer-crafted privacy policies and cookie notices for your site

  See all stacks using Iubenda

• Termly — Compliance for small businesses

  Policy-generation and consent tools configured around your actual data practices

  See all stacks using Termly

Setup guide

1. Cookiebot: For consent-banner setup, choose one consent-management platform rather than installing all four. With Cookiebot, scan the site, review detected technologies and configure categories and applicable consent rules. Test that nonessential technologies are held back where required and that withdrawal works. A banner alone does not establish GDPR compliance. (Read official instructions)
2. OneTrust: Choose OneTrust as an alternative when its features fit your organization. Document data flows, purposes, retention and responsibilities before configuring consent or rights-request workflows. Test how a request reaches the responsible team and is fulfilled; installing a platform does not transfer the controller’s compliance responsibility. (Open OneTrust instructions)
3. Iubenda: Choose iubenda as an alternative for policy and consent tooling. Describe your actual processing, providers and choices accurately, then review the generated policy and banner. Vendor template updates cannot keep your business-specific statements accurate automatically; assign an owner to review changes in your processing and applicable requirements. (Read official instructions)
4. Termly: Choose Termly as an alternative for policy and consent setup. Configure it for the site’s real data practices and test consent choices and any rights-request intake form. Intake is not automatic fulfillment: document how your team verifies, exports or deletes data across relevant systems. Complete the broader privacy work, including lawful basis, retention, security and rights handling, separately. (Read official instructions)

   Check: On the chosen consent platform, test acceptance, rejection and withdrawal, then verify the actual trackers and request-handling workflow. These checks do not certify legal compliance.