Biscotti CMP for Small Businesses: Pricing and Limitations

Disclosure: We may earn a commission if you sign up through links on this page.

Biscotti CMP is a consent-management platform for small businesses and agencies that need to identify cookies, display a consent banner and pass consent signals to analytics or advertising services. It also offers generated legal documents. This guide is based on the vendor’s published product information and terms, not a legal review or a hands-on compliance certification.

The most important boundary comes first: buying a CMP does not automatically make a website compliant. Your obligations depend on the visitors you serve, the scripts you run, how data moves between systems and the legal basis for each use. Biscotti’s own materials say it is software rather than a law firm and that generated documents can contain errors. Use it to implement and document choices, then obtain qualified advice when the risk warrants it.

What Biscotti CMP does

Biscotti combines several jobs that small site owners often handle separately:

• scans a website for cookies and tracking technologies;
• creates a configurable consent banner;
• records and applies visitors’ choices;
• supports Google Consent Mode v2;
• supports IAB Transparency and Consent Framework 2.3;
• generates privacy, cookie and related legal documents;
• supports multiple languages and regional configurations;
• integrates with common website and commerce platforms.

The scanner is useful for finding scripts that were added through analytics, advertising, embeds or plugins. A scan is still a snapshot. New plugins, tag-manager releases and marketing campaigns can introduce new processing later, so rescanning and change review should be part of site maintenance.

Explore Biscotti CMP’s current product overview.

Current pricing

The public pricing checked in September 2026 listed Growth at €14.99 per month and Business at €19.99 per month, including German VAT on the displayed page. A 14-day trial was advertised. Agency packaging and allowances should be checked directly because domains, pageviews, scans, languages and client-management features can affect the correct plan.

Compare current Biscotti plans and included limits.

Do not compare CMPs only by monthly price. Record the number of domains, consent volume, scan frequency, supported frameworks, languages, retention controls, sub-account needs and what happens when a limit is reached. Also check whether taxes are included for your billing country.

Consent Mode and TCF support

Google Consent Mode v2 lets a site communicate a visitor’s consent state to supported Google tags. It does not create consent by itself and does not decide whether a particular implementation is lawful. The banner, tag configuration and default states still have to match the site’s actual setup.

IAB TCF support is mainly relevant to advertising and publishing ecosystems. A brochure site with basic analytics may not need the same framework as an ad-funded publisher. Enabling every available framework can add complexity without solving a real requirement. Start from the site’s processors and purposes, not a checklist of acronyms.

WordPress and Shopify fit

Biscotti documents WordPress and Shopify support. That is useful for small companies using a hosted theme or plugin ecosystem, where scripts can come from analytics, chat, reviews, pixels and checkout integrations.

For WordPress, verify how the CMP is installed, how it interacts with cache or optimization plugins and whether tags are blocked before consent. For Shopify, inspect both storefront and app-added scripts. Checkout behavior can differ by Shopify plan and platform restrictions.

Check current WordPress integration guidance and review the Shopify integration. If either route changes, use the tracked product site to locate the current integration documentation.

Legal-document generation

Generated privacy and cookie documents can accelerate a first draft by collecting information about the company, processors and website. They remain dependent on complete inputs and current law. A document generator cannot discover every offline process, contract or international transfer by scanning a public website.

Review names, contact details, purposes, retention periods, processors, international-transfer language and user-rights instructions. Update documents when the business changes its tools or practices. For regulated activities, sensitive data or higher-risk tracking, have qualified counsel review the result.

Agency and API considerations

Agencies should evaluate Biscotti as an operating system for multiple clients, not merely as another banner. Confirm domain allowances, client access, branding, permissions, change logs, exports and how ownership transfers when a client leaves. API availability is useful only if the documented endpoints cover the provisioning and reporting workflow the agency actually needs.

The vendor describes agency capabilities, but availability and limits can vary by plan. Request written confirmation before designing an automated onboarding process around them.

Important limitations

1. A scan cannot see every data flow, especially server-side processing and offline exports.
2. A banner cannot fix tracking that loads before the consent state is applied.
3. Generated documents are not legal advice.
4. Framework support does not guarantee that every third-party tag respects the signal.
5. Regional rules and guidance change, so setup needs ongoing review.
6. Automated classification can be wrong, particularly for custom scripts.

Who should consider Biscotti CMP?

Biscotti is most plausible for a small business or agency that needs more structure than a theme’s basic cookie popup and wants scanning, consent signals and document tooling in one product. It is less compelling for a static site with no non-essential tracking, or an enterprise that already has a legal, privacy-engineering and consent stack with specialized procurement requirements.

Before subscribing, inventory the site’s scripts, define regions, test accept/reject behavior, confirm that non-essential tags remain blocked, and save evidence of the configuration. Repeat the test after major plugin or marketing changes.

Related planning guides: best website builders for small businesses, Shopify pricing, Shopify vs WooCommerce vs Squarespace, Leadpages for small businesses and AI Made For’s affiliate disclosure.

FAQ

Does Biscotti CMP guarantee GDPR compliance?

No. It provides technical and document tools, but compliance depends on the website’s real processing and legal context.

Does Biscotti support Google Consent Mode v2?

The vendor documents Consent Mode v2 support. Test the deployed tags and default consent states on your own site.

Can agencies use Biscotti for several clients?

Agency capabilities are advertised, but confirm current domain limits, client permissions, branding and API access for the selected plan.

Are generated legal documents ready to publish unchanged?

Treat them as drafts. Check every processor, purpose, retention period and contact detail, and obtain legal review where appropriate.

Is the cheapest plan enough?

That depends on domains, traffic, scans, languages and operational needs. Compare limits rather than selecting only by the displayed monthly price.