Usercentrics
Usercentrics is a German Consent Management Platform headquartered in Munich and a leading enterprise CMP in the DACH region. ISO 27001 certified, hosted in Germany and Belgium, certified IAB TCF v2.2, with Google Consent Mode v2 support and a privacy proxy for server side consent enforcement. Usercentrics acquired Cookiebot in 2021.
What does Usercentrics do?
What is Usercentrics?
Usercentrics is a German Consent Management Platform founded in 2017 and headquartered in Munich. It is one of the leading enterprise CMPs in the DACH region (Germany, Austria, Switzerland) and acquired its main European competitor Cookiebot in 2021, making the combined group the largest EU based consent vendor. Usercentrics is ISO 27001 certified, supports the IAB TCF v2.2 framework and Google Consent Mode v2, and offers a privacy proxy for server side consent enforcement.
Cookies and data collected
Usercentrics stores the consent record in the localStorage entry usercentrics under your domain. A small set of first party cookies (uc_settings, uc_session) is optionally used to track the consent state across subdomains and to retain UI preferences. When the IAB TCF integration is active, the euconsent v2 string is also stored. The full consent proof is sent to the Usercentrics servers in Germany and Belgium and is accessible from the dashboard for audit. No browsing behaviour, IP address or device fingerprint is collected.
GDPR and ePrivacy compliance
Usercentrics is designed for privacy by design under Article 25 GDPR. The CMP blocks non essential scripts before the accept click, offers granular category and per service controls (necessary, functional, analytics, marketing), provides a reject button with equal visual weight, and is certified for IAB TCF v2.2. The Smart Data Protector technology pre blocks vendor scripts based on a database of more than 2000 known trackers, which is particularly important for compliance with the German TDDDG and the CNIL guidelines.
Data transfers and hosting
Usercentrics processes data exclusively in the European Union on servers located in Germany and Belgium, operated by Usercentrics GmbH (Munich). There is no transfer to the United States or other third countries, which removes the need for SCCs and Schrems II analysis. The ISO 27001 certification provides additional guarantees for organisations subject to BSI Grundschutz, ANSSI SecNumCloud or the EU NIS2 directive.
How to implement Usercentrics correctly
Load the Usercentrics CMP script in the head before any other tag, enable Smart Data Protector so non essential scripts are blocked before the user clicks accept, activate granular category and per service controls and the equal weight reject button. Enable Google Consent Mode v2 in the integrations tab, configure the consent log retention to 12 to 24 months, and pair the CMP with the Usercentrics policy generator. For TCF v2.2 sites, activate the TCF add on.
Usercentrics and the GDPR
- Legal basis
- Legitimate interest of the controller under Article 6(1)(f) GDPR combined with the legal obligation to demonstrate consent under Article 7(1) GDPR.
- Risk level
- low
- Applicable regulations
- GDPR, ePrivacy Directive 2002/58/EC, German TDDDG, French CNIL guidelines, Spanish LSSI, Italian Codice Privacy, IAB TCF v2.2, ISO 27001
Impact assessment (DPIA)
Usercentrics is a low risk processor and an ISO 27001 certified enterprise CMP. A full DPIA is generally not required, but document the legal basis (Article 6(1)(f) and 7(1) GDPR), the EU only data flow (Germany and Belgium) and the 12 to 24 month retention of the consent record in the record of processing activities.
Sample text for your banner
This website uses Usercentrics, a German Consent Management Platform certified IAB TCF v2.2. Usercentrics processes your data exclusively in the European Union (Germany and Belgium, ISO 27001) and stores your consent record for 12 to 24 months as proof under Article 7(1) GDPR.
What Usercentrics sets and contacts
- Tracking method
- JavaScript Consent Management Platform loaded from app.usercentrics.eu. First party cookies and localStorage record the consent decision. IAB TCF v2.2 certified and TCF v2.2 vendor list integration. Optional Privacy Proxy for server side consent enforcement. Google Consent Mode v2 supported.
- Server location
- European Union (servers in Germany and Belgium, ISO 27001 certified). Usercentrics GmbH is headquartered in Munich, Germany.
Cookies set (3)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| usercentrics | first_party | localStorage | Stores the consent record for the Usercentrics CMP: categories and per service decisions, timestamp, consent version, controller ID. Required to apply the user choice on every page load. |
| uc_settings | first_party | 12 months | Stores UI preferences and the consent state shared across subdomains. Optional, used only on multi domain deployments. |
| euconsent-v2 | first_party | 12 months | Standard IAB TCF v2.2 consent string, set when the TCF integration is active for programmatic advertising interoperability. |
Third-party domains contacted (3)
app.usercentrics.euapi.usercentrics.euprivacy-proxy.usercentrics.eu
Frequently asked questions about Usercentrics
Can't find your question? Write to us, we answer fast.
Which cookies does Usercentrics set?
Usercentrics primarily uses the localStorage entry usercentrics to store the consent record. Optional first party cookies uc_settings and uc_session may be set for cross subdomain state and UI preferences. When the IAB TCF integration is active, the euconsent v2 string is also stored. No browsing or fingerprint data is collected.
Do users have to consent to Usercentrics itself?
No. The Usercentrics consent storage is strictly necessary under Article 5(3) ePrivacy: it is required to record and prove the consent choice. The CMP loads before the user clicks accept, in line with German DSK, CNIL, AEPD and TTDSG guidance.
What is the legal basis for using Usercentrics?
Usercentrics relies on the legitimate interest of the controller under Article 6(1)(f) GDPR combined with the legal obligation to demonstrate consent under Article 7(1) GDPR. The website operator is the controller, Usercentrics GmbH the processor.
Does Usercentrics transfer data to the United States?
No. Usercentrics processes data exclusively in the European Union on servers in Germany and Belgium. There is no transfer to the United States or other third countries, which removes the need for SCCs and Schrems II analysis. Usercentrics is one of the strongest options for German enterprises subject to the BSI Grundschutz.
Is a DPIA required for Usercentrics?
No. Usercentrics is a low risk processor and is ISO 27001 certified. A full DPIA is not required; document the legal basis, the EU only data flow (Germany and Belgium) and the 12 to 24 month retention of the consent record in the record of processing activities.
How do I implement Usercentrics correctly?
Load the Usercentrics CMP script in the head before any other tag, enable Smart Data Protector, activate granular category and per service controls and the equal weight reject button, enable Google Consent Mode v2 and pair the CMP with the Usercentrics policy generator. Activate the TCF v2.2 add on if required.
What are the alternatives to Usercentrics?
EU based alternatives include Cookiebot (also owned by Usercentrics), Iubenda (Italy), Didomi (France), Axeptio (France), CookieFirst (Netherlands), CookieYes (UE) and Klaro (open source). For French public sector sites the CNIL recommends Tarteaucitron or Axeptio.
How do I keep my cookie policy up to date with Usercentrics?
Usercentrics includes an automatic vendor database with more than 2000 known trackers and an integrated scanner that updates the cookie policy. Enable the email notification, review the categorisation and reflect changes in the privacy notice whenever a new processor or purpose is added.
Cybot
Cybot is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Cybot supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Cybot ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Securiti
Securiti is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Securiti integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Securiti makes advanced AI accessible to all teams.
Byscuit
Byscuit is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Byscuit supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Byscuit ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
HubSpot Cookie Policy Banner
HubSpot Cookie Policy Banner is a consent management platform (CMP) that helps websites comply with GDPR, CCPA, and global privacy regulations. It provides customizable cookie consent banners, preference centers, and automated compliance scanning. HubSpot Cookie Policy Banner manages user consent across tracking technologies, generates compliance reports, and integrates with tag management systems. With geo-targeted policies and TCF 2.0 support, HubSpot Cookie Policy Banner ensures worldwide privacy compliance.
Cookie Information plugin
Cookie Information plugin is a consent management platform (CMP) that helps websites comply with GDPR, CCPA, and global privacy regulations. It provides customizable cookie consent banners, preference centers, and automated compliance scanning. Cookie Information plugin manages user consent across tracking technologies, generates compliance reports, and integrates with tag management systems. With geo-targeted policies and TCF 2.0 support, Cookie Information plugin ensures worldwide privacy compliance.
Monsido
Monsido is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Monsido integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Monsido helps organizations maintain robust websites that meet user expectations and technical requirements.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.