Article · June 17, 2026
Free cookie banner limits: when to upgrade for PDPL compliance
Free cookie banners often limit traffic, evidence logging, and features. See when to upgrade to meet PDPL.
Quick answer
What are the limits of free cookie banners?
Free cookie banners typically only address “showing a notice,” which is not enough for long-term compliant operations. Common limits include: number of domains, pageviews, consent events, inability to export detailed logs, lack of management by cookie category, and missing mechanisms to store consent evidence for audits or complaints.
For Vietnamese businesses, the focus is not just “having a banner” but whether the banner helps you prove users were informed, what they chose, when they chose it, on which website/app, and how they can withdraw consent. This is where many free versions are very weak.
Where are the common limits?
- Impressions/traffic: free tiers usually allow low volumes; exceeding the threshold stops the banner or disables features.
- Number of domains/subdomains: may work for only 1 website; if you have landing pages, blogs, or other web apps, you must buy more.
- UI customization: hard to adjust language, button placement, colors to match your brand, or optimize for mobile.
- Cookie categorization: free versions often cannot clearly separate necessary, analytics, advertising, and remarketing cookies.
- Evidence logging: many tools do not store sufficient consent logs, timestamps, banner content versions, or cannot export reports for demonstrating compliance.
- Technical integrations: missing API, webhook, GTM, CMP integration, making it hard for developers to implement proper “prior blocking—enable after consent.”
Do free banners meet PDPL?
They may cover a very small part, but are usually insufficient if you process real personal data in operations. According to the Personal Data Protection Law (Law 91/2025/QH15), effective 01/01/2026, businesses must manage the processing of personal data under principles of transparency, purpose limitation, and an appropriate legal basis. A banner is just a surface layer; what you need is the entire consent flow and the accompanying evidence.
Practically speaking: if a website is just a low-traffic blog using minimal analytics, a free banner can be a starting point. But if you have lead forms, ad pixels, retargeting, chatbots, a CRM, web apps, or share data with third parties, you need to check whether the free tool records each consent type and allows users to change their minds.
When should you upgrade to comply with PDPL?
Consider upgrading as soon as any of the following apply:
- You have multiple real traffic sources: Meta/Google ads, SEO, affiliates, landing pages.
- You have many data recipients: analytics, CRM, email marketing, call centers, chatbots, ad networks.
- You must prove consent: store logs to reconcile by each consent event.
- Cookie usage is complex: categorize by purposes and enable/disable by groups.
- You must support withdrawal of consent: users need to easily change their choices, not just a one-off setting.
- You have multiple websites or languages: free banners typically can’t manage this setup.
| Criteria | Free banner/CMP | Paid banner/CMP | |
|---|---|---|---|
| Impressions | Usually limited | Higher or scalable by plan | |
| Number of domains | Often limited | Manage multiple domains/subdomains | |
| Consent evidence logging | Very basic or insufficient | Logs, timestamps, banner versions | |
| Cookie categorization | Little customization | Purpose-based groups, precise block/enable | |
| Reporting/export | Limited | Dashboards, exports for audits | |
| Technical integrations | Few APIs/webhooks | Easy to plug into GTM, apps, backend | |
| Change mind/withdraw consent | Hard to make smooth | Consent management center |
What should SMEs check before using a free banner?
Don’t just look at “free.” Check the following 5 points:
- Does it block cookies before the user chooses? If it can’t block, the banner is just decoration.
- Does it store consent evidence? You need to know who chose what, when, and on which version.
- Are cookie groups clearly defined? At minimum, separate necessary, analytics, and advertising.
- Is it easy to withdraw consent? Users must be able to change their choices.
- Does it cover all domains/subdomains/apps? If not, your compliance data will be fragmented.
If you run campaigns in Vietnam, note: cookies/SDKs/advertising IDs on web and app may trigger obligations to notify, obtain appropriate consent, and manage third-party providers under the regulations. For complex cases, involve legal counsel or your legal team before “just turning it on.”
Inventory all cookies/trackers:
audit the website/app, document each cookie’s purpose, provider, and retention period.
Group by purpose:
at minimum separate necessary, analytics, marketing, functional.
Verify prior blocking:
ensure tags don’t fire before an appropriate choice.
Enable evidence logging:
store timestamps, consent status, content version, domain, and user agent if needed.
Design the withdrawal flow:
add a “Cookie settings” link in the footer or app settings.
Monitor usage thresholds:
if you’re nearing free limits, plan an upgrade before things break.
Real-world examples: when is free enough, when is it not?
A Shopify store with one website uses GA4, Facebook Pixel, and a sign-up form for promotions. If the free banner can’t log consent evidence and doesn’t block pixels before a choice, it will be very hard to prove compliance in a dispute.
Conversely, a company brochure site that runs no ads and uses only technical cookies and minimal analytics can use a free version in the early testing phase. But when you expand to retargeting, remarketing, or add multiple landing pages, upgrade promptly.
FAQ about free cookie banners
- The biggest concern is not being able to store consent evidence and not blocking cookies before the user chooses. These two points directly impact your ability to prove compliance.
- It may be enough for testing or a very simple site. But if you have ads, a CRM, multiple domains, or need consent logs, you should upgrade.
- There is no rule that forces you to use a paid tool. However, if the free version doesn’t meet regulatory obligations, the business should switch tools or upgrade.
- As soon as your website/app starts processing personal data via cookies, pixels, SDKs, or third-party tools. The earlier you log, the easier it is to audit and reconcile.
If you’re reviewing banners, consent logs, or DSAR flows on your website/app, consent.vn can help you design consent evidence logging and streamline cookie management for your dev team.
Source: the Personal Data Protection Law (Law 91/2025/QH15); Decree 13/2023/ND-CP; Ministry of Public Security (A05) — thuvienphapluat.vn, bocongan.gov.vn
Get started — set up in 5 minutes.
Deploy PDPL solutions for your business?