iubenda

Overview

Founded in 2011 in Milan, Italy, iubenda was among the first in the Compliance & Legal space to treat policy generation and consent management as one product. You answer a questionnaire, the system drafts a privacy policy, cookie policy, and terms of service, and a consent banner carries those requirements onto the page.

The value is coverage. Templates cover GDPR, CCPA/CPRA, LGPD, PIPEDA, and other major regimes in 20+ languages, and the CMP is IAB TCF v2.2 certified so consent signals reach Google AdSense and Ad Manager directly. Without that handshake, personalised advertising on European traffic gets restricted.

The boundary matters: it produces a compliance starting point, not legal advice. For special categories such as health, finance, or children's data, generated text needs counsel review, because template clauses that do not match actual processing amplify risk.

Core Strengths

• One questionnaire produces privacy policy, cookie policy, and terms of service, avoiding conflicting wording across separate tools
• Templates for GDPR, CCPA/CPRA, LGPD, PIPEDA, and other major regimes across 20+ languages
• IAB TCF v2.2 certified CMP that hands consent signals to mainstream ad platforms
• Website, app, and SaaS integration paths with JS SDK and API for reusing one policy set across products

Product Ecosystem

Policy generator

Clauses are generated from a four-layer questionnaire covering what data is collected, for which purpose, shared with whom, and retained how long, then updated incrementally as the business changes. For teams running several sites and apps, one template set prevents contradictory privacy statements across a group.

CMP and consent signals

Banners switch mode by region, grant consent per category, and emit consent logs as evidence. The TCF v2.2 integration sets the monetization ceiling for European traffic, since a banner without signal passing is treated as no consent by most ad platforms.

Drawbacks

• Chinese UI and Chinese regulatory templates are weak, so mainland China entities must fill the gap themselves
• Enterprise capabilities such as internal compliance, DPA management, and audit trails sit in higher tiers, with cost rising per site
• Monthly pricing is steep relative to annual discounts, so short projects are better served by one-off generators
• Generated text still needs counsel review, and special categories or cross-border flows cannot simply reuse templates

Use Cases

• Sites serving European users (★★★★★) - GDPR and TCF v2.2 integration is a prerequisite for ad monetization, effectively mandatory
• Multi-site and multi-product teams (★★★★☆) - One policy set keeps statements consistent across properties
• SaaS and app developers (★★★★☆) - SDK and API reuse one policy across web and client apps
• Mainland-China-only small sites (★★) - Local regulatory templates are missing, so the return is low

Pricing

Pricing stacks the subscription term with the number of sites and apps, so confirm the current quote on the official site. Budget for update frequency too, since falling back to static templates after a regulatory change usually costs more than the subscription.

FAQ

• Are generated policies legally binding? They are compliance documents generated from regulatory templates and cover common cases, but they are not legal advice. Cross-border transfers, children's data, and health or finance scenarios require counsel review before use.

• What if the CMP is not TCF-connected? Personalised advertising on European traffic gets restricted and most platforms treat it as no consent, directly hitting eCPM. For AdSense or Ad Manager monetization, the CMP and TCF v2.2 handshake is a prerequisite.

• Can several sites share one policy? Templates can be shared, but each site needs its own instance with its own processing activities, otherwise the policy will not match what the site actually does. Multi-brand teams usually split instances by business line and maintain template versions centrally.