A self-serve privacy platform — CMP with published pricing plus subject-rights and data-mapping modules — aimed at teams without dedicated privacy engineers.

INTEGRATES: google-tag-manager · google-analytics-4 · google-ads · adobe-launch

Osano occupies the mid-market slot: a Google-certified CMP with scanning, tracker blocking, geolocation rules, Global Privacy Control support, and consent records, sold at published prices you can start on without a sales call. The Austin-based company grew out of the widely used open-source cookieconsent banner library, and the platform keeps that pragmatic bent — alongside the CMP sit subject-rights request intake and workflow, data mapping, and vendor privacy monitoring, so a small team can run a defensible program from one dashboard.

How it works. You install a single osano.js snippet, and it must go first in the <head> and load synchronously — no async or defer — so it can intercept scripts that fire after it. The blocker runs in one of three modes: Listener (discovery only — it inventories scripts and cookies but shows no dialog and blocks nothing), Permissive (dialog shown; categorized scripts honor consent, uncategorized ones are allowed through), and Strict (uncategorized scripts are blocked until you classify them). The intended rollout is Listener first, then classify everything the scans surface, then flip to Strict — skipping the classification step in Strict mode is how sites break their own tag stack. Each consent action and revocation is recorded in Osano’s database; the vendor states records are encrypted and immutable, with IP addresses and user identifiers hashed one-way.

Google and adtech. Osano supports Google Consent Mode v2 and, for Google Tag Manager, documents two install paths: direct install of osano.js ahead of GTM (recommended), or loading it through GTM itself. Note the fine print — Osano’s “No Fines, No Penalties” guarantee only applies if you use the direct install. IAB TCF 2.2 and GPP support exist but are an opt-in toggle in the configuration settings, after which you select the IAB vendors you work with; it is not the default posture, which tells you Osano’s center of gravity is ordinary marketing sites rather than programmatic publishers. Microsoft UET consent mode and Adobe Launch installs are also documented.

Implementation notes. Geolocation drives which banner variant a visitor sees, so the strictest applicable rule for their location applies without per-region configuration on your side. Global Privacy Control signals are honored when the setting is enabled and ignored when it is off — check that toggle, because a CPRA-scope site with GPC off is a real exposure. A JavaScript API exposes consent state, properties, and events so your own code can react to a visitor’s choices. AMP pages and HTTP-only cookies have their own documented handling and caveats worth reading before you commit.

Migration and fit. The design trades depth for approachability. Configuration is simpler than OneTrust or Didomi, which is the point, but publishers with TCF-heavy adtech stacks, multi-app estates, or bespoke consent architectures will hit the edges of what the self-serve model expresses. Moving off another CMP is mostly re-classification work: your script inventory carries over conceptually but not mechanically, so budget time in Listener mode before enforcing.

Use it when you want a credible, Google-certified CMP plus basic privacy operations quickly, at list price, without an implementation project. Look past it when you need enterprise-grade consent APIs, CTV and native-app coverage, or deep TCF publisher tooling as the default rather than an add-on.