The Consent-Tool Vendor Whose Own Policy You Can Check
iubenda's core pitch competes directly with OneTrust, especially for the SME end of the market OneTrust's enterprise pricing and complexity tend to underserve: a cookie consent banner, an auto-updating privacy and cookie policy, and terms and conditions, backed by a library of over 2,400 done-for-you legal clauses covering third-party services.
What It Does
- Cookie Consent Banner: geo-targeted consent, IAB TCF support
- Privacy and Cookie Policy generator: built from a clause library, updated automatically when a monthly site scan detects new third-party services
- Terms and Conditions generator
- Website Accessibility tooling, sold as a separate line since the team.blue era
- Solutions tailored to agencies, enterprise, e-commerce, publishers, advertisers and app developers, plus an "iubenda for Claude and ChatGPT" integration
Pricing
Three core tiers, per site, per month, billed yearly for the lower rate shown: Essentials at €4.99/month (up to 25K pageviews, 20 third-party service clauses, one language), Advanced at €19.99/month (up to 50K pageviews, complete legal documents including Terms & Conditions, all languages, geo-targeting), and Ultimate at €79.99/month (up to 150K pageviews, enterprise-grade). A free tier ("Start for free") is also offered. Overage on pageviews is billed at €0.05 per 1,000.
The Milan Entity, Now Inside a Belgian Group
iubenda s.r.l., Via San Raffaele 1, 20121 Milan, Italy. EU VAT IT07347120961, UK VAT GB370904694, registered with the Milan Chamber of Commerce, legal representative Manuel Heilmann, with a named Data Protection Officer. Since 2022, iubenda has been, in its own words, "subject to the direction and coordination of team.blue NV", the Belgian hosting and digital-services group headquartered in Gent that also owns Combell, TransIP and Register.
That parent relationship matters for how to read the ownership field here: iubenda's operating entity is Italian, its ultimate parent is Belgian, and both are inside the EU. That is different from an EU subsidiary of a US or UK group, so this listing records ownershipOrigin as EU_OWNED rather than a foreign-parent designation, control has moved from one EU country to another, not left the EU. team.blue itself appears as a named data recipient in iubenda's own privacy policy (its compliance team handles iubenda's whistleblowing channel), which is a useful, concrete sign that the group relationship is operationally real rather than a shell.
Where the Data Sits
iubenda's own website privacy policy, generated with its own tool, names its hosting directly:
Amazon Web Services (AWS) ... Place of processing: Ireland
Other named service providers and contractors include DigitalOcean, New Relic, PayPal, Chargebee, Google Ireland Limited, HubSpot (Ireland and Germany entities), and team.blue NV itself. As with every AWS-hosted EU company in this directory, hosting in Ireland does not remove US_CLOUD_ACT exposure: AWS is a US company and the CLOUD Act reaches data it physically holds regardless of region.
What's Missing
Despite being a compliance-tooling vendor itself, no customer-facing Data Processing Agreement document was located at a public URL during this review. Given the category iubenda operates in, that is a more notable gap than it would be for an unrelated SaaS vendor.
Where It Fits
Against OneTrust, iubenda is the lighter-weight, dramatically cheaper option that fits an SME or agency budget rather than an enterprise privacy-ops team. See also consent management.
