Didomi

Didomi, built in Paris with a strong publisher and adtech heritage, treats consent as a data layer of its own. Choices collected by its banners and SDKs — web, iOS/tvOS, Android/Android TV, with React Native among the vendor’s sample implementations — are stored centrally and exposed through APIs and webhooks, so server-side systems, CDPs, and downstream vendors can query or subscribe to a user’s current consent state instead of inferring it from a cookie. The data model splits cleanly: administrators define purposes and vendors per notice in the Didomi Console, while your code consumes that configuration at runtime through SDK methods like getRequiredPurposeIds() and getRequiredVendors() — meaning legal and privacy teams can adjust vendor lists without a code deploy.

Implementation on the web is a loader script from sdk.privacy-center.org plus a window.didomiConfig object; anything touching the SDK after load goes through window.didomiOnReady callbacks. Consent state lands in first-party cookies (didomi_token, plus euconsent-v2 for IAB TCF), and is exposed three ways: a JavaScript API (getCurrentUserStatus() returns per-purpose and per-vendor status), event listeners (consent.changed via window.didomiEventListeners), and Google Tag Manager pushes (didomi-ready, didomi-consent-changed) for gating tags. TCF support implements the IAB CMP API v2 (__tcfapi), and the Consents API can generate TCF strings server-side from recorded events.

The server-side story is what separates it from banner-only CMPs. The Consents API records consent as events — each a partial update per regulation, merged into the user’s stored status with full event history — and HTTP webhooks (configured via Didomi’s Marketplace, with automatic retries) push event.created/updated/deleted to your systems. Cross-device sync hangs on an organization user ID you supply; Didomi recommends passing a hashed identifier with server-computed auth digests (organizationUserIdAuthDigest and friends) so clients can’t spoof another user’s consent record. Budget real engineering time for that identity plumbing — it’s where multi-platform deployments earn their keep or stall.

Beyond the CMP, the platform bundles a preference-management module (marketing channels and product-level preferences past cookies), automated privacy-request (DSAR) handling, and Advanced Compliance Monitoring that scans what actually fires on your pages against what consent permits. Pricing is quote-based across Essential, Advanced, and Premium tiers, keyed to monthly unique visitors with unlimited domains; white-labeling, analytics exports, and API access sit in the top tier.

Use it when consent must be queryable infrastructure — multiple platforms, downstream systems, TCF obligations — rather than a banner. Look past it when a self-serve CMP at published prices covers your single-site, web-only reality, or when you have no engineering capacity for the identity and webhook integration that justifies the platform.