Cookilio vs Tarteaucitron: Which Cookie Manager to Choose?
Cookilio vs Tarteaucitron: Should You Choose Free or Proof?
When looking for a GDPR-compliant cookie manager, two approaches compete. On one side, open source: free, transparent, community-driven. On the other, a software editor’s solution: paid, supported, with solid legal guarantees. Cookilio and Tarteaucitron embody these two approaches.
Tarteaucitron has existed since 2013. It’s a French open source project created by Amauri Champeaux, available on GitHub with nearly a thousand stars and an active community. It powers thousands of sites, particularly in the public sector.
Cookilio, published by DPLIANCE, is a sovereign CMP with server-side consent proof, a lightweight script (about 20 KB compressed), and assisted setup. Two French tools, two visions of consent.
In a context where EU-wide GDPR fines totalled 1.2 billion euros in 2024 (DLA Piper study) — with cookie and consent violations among the top enforcement priorities across Europe — your CMP choice deserves thorough analysis.
Consent: A Matter Beyond Technology
Before comparing features, let’s ask the essential question: what is a CMP for?
Not just to display a banner. A CMP must:
- Inform the user clearly and completely
- Collect consent that is freely given, specific, and informed
- Block all third-party scripts before explicit consent
- Prove that consent was obtained in accordance with the law
The CNIL states that “each entity relying on consent must be able to provide proof of it” (source: CNIL - Cookie FAQ). It’s on this fourth point that Tarteaucitron and Cookilio fundamentally diverge.
Tarteaucitron: The Community’s Choice
Tarteaucitron’s Strengths
Tarteaucitron is a remarkable project. It democratised cookie management in France well before the CNIL tightened its guidelines. Its strengths are real:
- Free and open source: the code is on GitHub, auditable by anyone
- Large service catalog: 100+ preconfigured services in the open source version, up to 225 in the Pro version (source: tarteaucitron.io)
- Active community: regular contributions, community-provided documentation
- Lightweight: the client-side script is performant and fast to load
- No third-party dependency: the code runs directly on your site
- Pro version available: at EUR 190 excl. tax/year, it adds a WordPress plugin, statistics, and support (source: tarteaucitron.io/pricing)
Tarteaucitron’s Limitations
But Tarteaucitron has structural limitations that are important to understand:
- No server-side consent proof: consent is stored in a cookie or localStorage in the user’s browser. If the user clears their cookies, the proof disappears. During a DPA audit, you have no server-side record.
- 100% client-side: all logic runs in the browser. No backend, no database, no centralised registry.
- No analytics dashboard: no visibility on consent rates, user choices, or trends over time.
- Technical integration: setup requires web development skills. You need to modify your site’s source code and configure each service in JavaScript.
- No commercial support (open source version): in case of problems, you depend on the GitHub community and forums.
Cookilio: Proof First
The Cookilio Approach
Cookilio starts from a conviction: privacy is a right, and consent is a commitment to uphold. This translates into specific technical choices:
- Server-side consent proof: each consent is recorded server-side with a unique receipt code, a timestamp, and detailed choices per vendor. The visitor can reopen their receipt from the banner.
- Lightweight script: about 20 KB compressed, styles included; service logos are proxied through Cookilio, so the visitor’s browser contacts no third party before choosing.
- Multi-step banner (wizard): the user is guided step by step through their choices, not confronted with a wall of text.
- Granular script blocking: each vendor has specific approval and rejection scripts. No third-party script executes before explicit consent.
- Hosted in Switzerland: the application and consent records are hosted by Infomaniak; the visitor’s IP address is never stored in clear.
- Full customisation: 8 colours, banner position, logo, display delays.
- Assisted setup and support: Cookilio detects the cookies on your home page, suggests the matching services and picks up your site’s colours; DPLIANCE provides ongoing support. The supported plan (EUR 59 excl. tax/month) adds an annual compliance audit and a review by an outsourced DPO.
Detailed Comparison Table
| Criterion | Cookilio | Tarteaucitron (open source) | Tarteaucitron Pro |
|---|---|---|---|
| Price | EUR 19 excl. tax/month (Essential) or EUR 59 (supported), 12-month commitment | Free | EUR 190 excl. tax/year |
| Consent proof | Server-side, unique receipt code per choice | Client-side only (cookie/localStorage) | Client-side only |
| Consent storage | Cookilio servers, hosted by Infomaniak (Switzerland) | User’s browser | User’s browser |
| Banner | Multi-step wizard | Classic banner | Classic banner |
| Preconfigured services | Suggested from cookies detected on your home page | 100+ services | 225+ services |
| Script blocking | Per vendor, approval/rejection scripts | Per service, client-side blocking | Per service, client-side blocking |
| Analytics dashboard | Consent log + acceptance and completion statistics | No | Activation statistics |
| WordPress plugin | No plugin needed (one script tag) | No (manual integration) | Yes |
| Multi-language | French UI, customisable text | Yes (community) | Yes |
| Support | Included (DPLIANCE) | GitHub community | Commercial support |
| Skills required | Low (one script tag, assisted setup) | High (JavaScript integration) | Moderate |
| Data sovereignty | Swiss hosting (Infomaniak), IP never stored in clear | Total (client-side) | Total (client-side) |
| Tech stack | Script of about 20 KB + hosted service | Vanilla JavaScript | Vanilla JavaScript |
| Open source | No | Yes | No |
Server-Side Proof: Why It’s Decisive
This is the core issue. Let’s break it down.
The Client-Side Problem
With Tarteaucitron, consent is stored in a cookie or localStorage in the browser. In practice, this means:
- If the user clears their cookies (which privacy-conscious users regularly do), the proof disappears
- If the user switches browsers, the proof doesn’t exist in the new browser
- In private browsing, the proof is lost when the window closes
- You have no centralised registry of collected consents
- During a DPA audit, you cannot produce formal proof
Cookilio’s Server-Side Solution
With Cookilio, each consent interaction is recorded server-side:
- A unique receipt code identifies each choice, and the visitor can view it from the banner
- The record is kept server-side, hosted by Infomaniak in Switzerland
- You have a timestamped log of consents, filterable by period, choice type and service
- During an audit or a right-of-access request, you can retrieve the receipts from the log, including from the visitor’s IP address
This difference is not theoretical. DPAs across Europe are increasingly sanctioning consent violations — in 2024, EU-wide GDPR fines totalled 1.2 billion euros (DLA Piper study). Being able to produce solid proof is your best protection.
Integration and Setup
Tarteaucitron: For Developers
Installing Tarteaucitron’s open source version requires:
- Adding the script to your site
- Configuring each service in JavaScript
- Modifying source code to replace third-party script tags with Tarteaucitron calls
- Manual testing to verify each service is correctly blocked/unblocked
It’s doable, but it requires a developer comfortable with JavaScript and a good understanding of how trackers work.
Cookilio: Assisted Setup
Cookilio’s setup is assisted:
- Adding your site: Cookilio detects the cookies set on your home page and suggests the matching services
- Adding one script tag just before the closing
</body>tag of your site - Configuring approval and rejection scripts for each vendor
- Testing and validation
Setup takes about five minutes, with no setup fee. You don’t need to be a developer to manage your vendors day-to-day.
The Real Cost: Free Isn’t Always Free
Tarteaucitron is free. But the real cost includes:
- Developer time for initial integration (count several hours to several days depending on site complexity)
- Maintenance: updates, adding new services, bug resolution
- Legal risk: no server-side proof during an audit
- No support: in case of a critical issue, you’re on your own
Cookilio costs EUR 19 excl. tax/month on the Essential plan, i.e. EUR 228 excl. tax a year, with no setup fee. In return, you get solid consent proof, support, and guided setup.
Tarteaucitron Pro at EUR 190 excl. tax/year fills some gaps (WordPress plugin, statistics, support) but doesn’t solve the fundamental problem: the absence of server-side proof.
Who Is Each Solution For?
Choose Tarteaucitron if:
- You have a developer capable of handling integration and maintenance
- You have no strong constraint on consent proof
- Budget is your primary criterion
- You value open source and total technical independence
- Your site is simple with few third-party services
Choose Cookilio if:
- Server-side consent proof is a priority (DPA audits, regulated sector)
- You prefer supported setup and responsive support
- You want your consent records hosted in Europe, by Infomaniak in Switzerland
- You want a multi-step wizard banner, not a simple bar
- You don’t have a dedicated developer for cookie management
FAQ
Is Tarteaucitron sufficient for GDPR compliance?
Tarteaucitron blocks scripts before consent and informs the user, which covers part of the obligations. However, the lack of server-side consent proof is a weakness. The GDPR requires that each entity be able to prove the consent obtained (Article 7). A client-side cookie, deletable by the user, may not constitute sufficient proof during an audit.
Is Cookilio open source?
No. Cookilio is software published by DPLIANCE and provided as a SaaS, hosted by Infomaniak in Switzerland. There is nothing to deploy: one script tag on your site, and consent records are kept server-side rather than in the visitor’s browser.
Is the Cookilio widget as lightweight as Tarteaucitron?
The Cookilio script weighs about 20 KB compressed, styles included, and service logos are proxied through Cookilio, so the visitor’s browser contacts no third party before choosing. Tarteaucitron is also lightweight. Both solutions have a limited impact on performance and Core Web Vitals.
Can I use Tarteaucitron and add my own server-side proof?
Technically, it’s possible: you could develop a system that records consent choices server-side alongside Tarteaucitron. But this represents significant development (API, database, session correlation). Cookilio includes this functionality natively.
How many services does Tarteaucitron support natively?
The open source version supports 100+ preconfigured services (Google Analytics, YouTube, Facebook, Twitter, etc.). The Pro version offers 225+. Cookilio works differently: when you add your site, it detects the cookies set on your home page and suggests the matching services; each one is then declared with its approval and rejection scripts, which offers more control.
GDPR compliance isn’t limited to displaying a banner. It requires being able to prove that consent was collected correctly. That’s where Cookilio makes the difference.
Discover Cookilio — the sovereign CMP with built-in consent proof.