Article · June 17, 2026
Free vs paid CMP: what's different, and when is free enough?
Free vs paid CMPs: features, consent evidence, DSAR, logs, and when each is enough for PDPL compliance.
Quick answer
How do free and paid CMPs differ?
How do free and paid CMPs differ? Mainly in the level of control, evidence retention, and the ability to operate compliance at real-world scale. Under the PDPL, businesses must do more than “show a banner”—they must be able to demonstrate that consent was collected, managed, and can be retrieved as required.
What do free CMPs typically include?
Free plans usually cover basic needs such as:
- displaying a cookie/consent banner;
- allowing acceptance or rejection of cookie categories;
- storing consent status at a basic level;
- quick configuration for small websites.
Strengths include low cost, fast deployment, and suitability for SMEs just starting to digitize. But the limitations often lie in shallow log data, limited customization, difficulty integrating with internal systems, and difficulty proving details in disputes or regulatory inspections.
What do paid CMPs typically add?
Paid plans often include features worth considering when you need more serious compliance management:
- store consent evidence by user, timestamp, and banner/policy version;
- detailed audit logs;
- support for multiple websites, domains, and languages;
- manage consent changes after a user withdraws consent;
- integrations with tag managers, SDKs, and mobile apps;
- DSAR workflows, internal role-based access control, and reporting/export.
For businesses with high traffic, multiple marketing channels, or engineering teams that need precise tracking of data-collection flows, paid plans usually reduce operational risk.
When is the free version enough?
A free plan can be enough if you are an SME or run a simple content website, for example:
- only a basic contact form;
- not running many pixels/remarketing tags;
- no mobile app;
- not storing sensitive data;
- not involving many third parties in data processing.
In this situation, the key is not “free or paid” but whether the CMP at least provides clear notice, valid consent, the ability to refuse, and stores consent status. If you cannot store evidence, it will be hard to demonstrate compliance during internal reviews or when working with partners.
When should you use a paid version?
Consider a paid plan if one or more of the following apply:
- multiple data-collection sources: website, app, CRM, chatbot, landing pages;
- using many advertising/analytics tools that must be controlled by region/country;
- need to retain consent evidence for historical reconciliation;
- need role-based access for marketing, legal, and IT;
- have DSAR requirements: lookup, rectify, delete, withdraw consent;
- enterprise customers require a clear compliance dossier.
According to the Personal Data Protection Law (Law 91/2025/QH15, expected to take effect 01/01/2026), businesses must be ready to demonstrate data-processing activities as required. If a data breach occurs, notification must be made within 72 hours of discovery. Therefore, a CMP is not just a banner—it is part of your evidence dossier.
| Criteria | Free CMP | Paid CMP | |
|---|---|---|---|
| Consent banner | Yes | Yes | |
| Consent evidence retention | Often limited | Often more complete | |
| Audit logs | Few or none | More detailed | |
| DSAR/withdraw consent | Basic | Clearer workflows | |
| Multi-site/multi-language | Limited | Usually better | |
| System integrations | Basic | More flexible | |
| Best for | Simple websites, small SMEs | Businesses with many channels, need evidence |
What criteria should Vietnamese businesses use to choose?
Decide based on data and processes, not just price.
1) Can you retain evidence?
Minimum evidence should include:
- the time the user gave/withdrew consent;
- the banner/policy content at that time;
- the status of cookie categories or processing purposes;
- a session identifier or pseudonymous ID;
- a changelog of policy versions.
If a free CMP cannot reliably export these data, you will struggle to justify your position.
2) Do you have an engineering team to fill the gaps?
Many businesses use free plans but build their own backend logging, internal dashboards, or periodic exports to a data store. This can work, but you must ensure logs are tamper-evident, access-controlled, and have clear retention procedures.
3) Do you have many third parties?
The more pixels, SDKs, embedded forms, chatbots, and measurement partners you have, the more you need granular consent control. In that case, a paid plan often saves more time than patching each part yourself.
A process for choosing a CMP without "losing evidence"
Map your data flows:
Document what your website/app collects, from whom, via which tools, and for what purposes.
Define the consent records you need:
At minimum, store the timestamp, notice version, user choices, and withdrawal status.
Validate log exportability:
Try exporting consent data to CSV/JSON or via API to see if it’s usable for audits.
Assess technical integrations:
Check whether the CMP connects to your tag manager, CRM, mobile app, email tool, or chatbot.
Match to operational scale:
If you have few sites/channels, free may suffice; if you have many flows and reporting needs, switch to paid.
Maintain internal documentation:
Capture configurations, keep policy versions, and assign clear consent-ops ownership.
Real-world example: what should an online shop choose?
A shop on Shopify/WordPress often starts with a free plan to display a banner and block marketing cookies until consent. If there is only one site, few tracking tools, and no complex dossier requirements, the free plan may be enough initially.
But once the shop runs multi-platform ads, has many landing pages, needs consent reconciliation per campaign, or must provide evidence to overseas partners, a paid plan is more practical because it reduces the risk of “having a banner but being unable to prove consent was stored.”
If you need a checklist to implement a cookie banner, store consent evidence, and set up DSAR processes for your dev/marketing team, consent.vn can help you design for easier operations.
- The biggest difference is the ability to store and retrieve consent evidence, manage consent changes, enforce role-based access, and maintain logs. A free plan can be enough for simple needs, but paid plans are typically stronger on evidence and day-to-day operations under the regulations.
- You cannot conclude based solely on whether it’s free or paid. Under the regulations, the important thing is whether the CMP enables clear notice, valid consent, and evidence retention.
- When you have multiple websites/apps, many marketing tools, need audit logs and DSAR handling, require detailed consent evidence, or must work with customers/partners who demand a compliance dossier.
- Under the regulations, assess the incident, isolate affected systems, preserve logs, and notify the data breach within 72 hours of discovery. You should also consult legal counsel if the incident is complex.
Source: the Personal Data Protection Law (Law 91/2025/QH15); Decree 13/2023/ND-CP; Ministry of Public Security (A05): https://thuvienphapluat.vn, https://bocongan.gov.vn
Get started — set up in 5 minutes.
Deploy PDPL solutions for your business?