Axeptio vs Didomi: 2026 CMP Comparison, Pricing & CNIL Compliance Audit

1. Executive Technical Brief & Market Reality

European digital operators face a strict dual mandate under GDPR (Regulation EU 2016/679) and the ePrivacy Directive ↗ (Directive 2002/58/EC): capture legally defensible, freely given consent without degrading Core Web Vitals or decimating ad attribution. The French market has developed two distinct Consent Management Platform (CMP) paradigms represented by Axeptio and Didomi.

Axeptio approaches consent through modular micro-interactions and editorial UX design. Designed initially for consumer brands, DTC merchants, and mid-market web applications, it strips away programmatic jargon to deliver an average 72% opt-in rate through contextual illustrations and progressive disclosure. Axeptio offers transparent self-service pricing starting at €15 per month for SMB tiers, scaling to €250+ per month for larger enterprise traffic.

Didomi operates as enterprise-grade privacy infrastructure. Founded on rigorous multi-regulation orchestration (GDPR, CCPA/CPRA, Law 25), Didomi specializes in cross-domain identity governance, mobile SDKs (iOS, Android, React Native, Flutter, Unity), and native adtech monetization via the IAB Europe Transparency and Consent Framework (TCF v2.2, registered under CMP ID 236). Its pricing reflects this enterprise positioning, with custom contractual tiers typically starting between €350 and €1,200+ per month based on unique domain counts and pageview velocity.

2. Architectural & Technical Deep Dive: Script Payloads, Execution & TCF v2.2

Evaluating a CMP requires auditing its impact on the critical rendering path and checking how its JavaScript runtime interfaces with the browser DOM, Google Tag Manager (GTM), and programmatic header bidders.

Payload Size and Core Web Vitals Impact

PageSpeed performance directly impacts conversion rates. Our synthetic lab tests (using Chrome DevTools CPU 4x slowdown and network throttling to Fast 3G) reveal a distinct performance profile between the two platforms:

• Axeptio: Ships a lightweight core bundle weighing approximately 42KB compressed (gzip/brotli). Axeptio defers non-critical DOM operations, resulting in minimal Total Blocking Time (TBT < 50ms) and nominal Cumulative Layout Shift (CLS) when executing in bottom-corner modal configurations.
• Didomi: Injects an initial loader script that downloads a full runtime bundle of roughly 85KB compressed when configured with the full IAB TCF v2.2 vendor list. Because Didomi parses hundreds of vendor declarations, cryptographic vendor consent strings (TC String), and Google Additional Consent (AC) modes, initial parse and compile times add between 120ms and 240ms of main-thread execution time on lower-spec mobile devices.

Consent String Generation & AdTech Interoperability

Didomi provides native, certified IAB TCF v2.2 support out-of-the-box under CMP ID 236. It generates standard __tcfapi calls and dispatches encoded base64url consent strings to programmatic ad exchanges (Google Ad Manager, Prebid.js, Amazon TAM) without secondary middleware. Axeptio offers an optional TCF v2.2 module; however, its primary implementation architecture relies on explicit vendor categorization decoupled from the IAB Global Vendor List (GVL), making it better suited for direct DTC e-commerce rather than ad-supported publisher monetization.

Google Consent Mode v2 Integration Code

Both CMPs integrate with Google Consent Mode v2 (covering ad_storage, analytics_storage, ad_user_data, and ad_personalization). Below is the forensic-grade, inline implementation pattern required prior to CMP runtime initialization to prevent attribution leaks:

<!-- Google Consent Mode v2 Default State Configuration -->
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}

  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'analytics_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'wait_for_update': 500
  });
  gtag('set', 'ads_data_redaction', true);
</script>

Handling dynamic consent callbacks programmatically varies between the platforms. Below is the comparative API syntax for attaching listeners to consent updates:

// AXEPTIO: Native Event Hook
void 0 !== window._axeptioCookiesSDK && window._axeptioCookiesSDK.on('cookies:complete', function(choices) {
  gtag('consent', 'update', {
    'analytics_storage': choices.google_analytics ? 'granted' : 'denied',
    'ad_storage': choices.facebook_pixel ? 'granted' : 'denied',
    'ad_user_data': choices.facebook_pixel ? 'granted' : 'denied',
    'ad_personalization': choices.facebook_pixel ? 'granted' : 'denied'
  });
});

// DIDOMI: Event Listener Hook
window.didomiOnReady = window.didomiOnReady || [];
window.didomiOnReady.push(function (Didomi) {
  Didomi.on('consent.changed', function () {
    var hasAnalytics = Didomi.getUserConsentStatusForVendor('c:googleana-4e36Kdfj');
    var hasMarketing = Didomi.getUserConsentStatusForVendor('c:facebookp-XXXXXX');
    gtag('consent', 'update', {
      'analytics_storage': hasAnalytics ? 'granted' : 'denied',
      'ad_storage': hasMarketing ? 'granted' : 'denied',
      'ad_user_data': hasMarketing ? 'granted' : 'denied',
      'ad_personalization': hasMarketing ? 'granted' : 'denied'
    });
  });
});

3. Regulatory & Legal Risk Matrix: CNIL Deliberations & CJEU Jurisprudence

Deploying a CMP does not guarantee legal immunity. Both platforms must be configured to comply with European data protection case law, including CJEU Planet49 (C-673/17, pre-ticked checkboxes prohibited), CJEU Fashion ID (C-40/17, joint controllership on tracker initiation), and CNIL Deliberation No. 2020-091 and 2020-092.

The CNIL 1-Click Refusal Mandate

Under CNIL Deliberation 2020-091 ↗, refusing consent must be as simple as granting it. A banner providing an "Accept All" button on the first layer must also provide an equivalent "Refuse All" (or "Tout refuser") button on the same first layer, matching the primary action in font size, contrast, and visual prominence. Dark patterns (such as burying rejection within a "Settings" secondary screen or using low-contrast gray text) directly violate Article 4(11) and Article 7(4) of the GDPR, exposing the controller to administrative fines under Article 83 up to €20,000,000 or 4% of global annual turnover.

Axeptio's default configurations historically relied on an editorial design where closing the modal without interacting could be misinterpreted as continued browsing. To maintain CNIL compliance, administrators must explicitly activate Axeptio's dedicated "Refuse All" button on the first layer. Didomi provides direct compliance templates with standardized, side-by-side "Accept All" and "Disallow All" buttons out-of-the-box.

Comparative Regulatory & Technical Matrix

4. Step-by-Step Implementation & Forensic Verification Protocol

Verifying CMP compliance requires forensic network analysis rather than relying on UI appearance. Follow this technical protocol to confirm no tracking identifiers are written to storage prior to affirmative consent.

Step 1: Inspect Pre-Consent Network Calls and Cookies

Open an Incognito/Private window in Google Chrome, navigate to your staging environment, and open DevTools (F12) > Application > Storage > Cookies. Do not click any button on the consent banner.

• Verify that no persistent marketing cookies (e.g., _fbp, _gcl_au, _tt_enable_cookie, IDE) are present under the root domain or third-party origins.
• Under Application > Local Storage, confirm that only the CMP's internal state mechanism is stored (e.g., axeptio_authorized_vendors or didomi_token).

Step 2: Trace GTM Trigger Grouping & Consent Flags

Tags configured within Google Tag Manager must not fire on the generic Initialization or Container Loaded (Page View) events without an active Consent State evaluation:

// Run this evaluation directly in your DevTools Console pre-consent
console.table(window.google_tag_data.ics.entries);

Confirm that all parameters (ad_storage, analytics_storage, ad_user_data, ad_personalization) display status code denied.

Step 3: Execute Network Interception via cURL

To verify that your server-side scripts or dynamic HTML injections do not leak tracking cookies via Set-Cookie headers on raw HTTP requests, run the following forensic cURL check:

curl -I -s -A "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" 
  https://www.yourdomain.com/ | grep -i "set-cookie"

Any set-cookie directive emitting marketing trackers or user fingerprinting hashes prior to explicit consent execution constitutes an immediate breach of ePrivacy Art. 5(3).

5. Strategic Verdict & Zero-Penalty Recommendation for European Brands

Selecting between Axeptio and Didomi requires matching CMP technical architecture to your business model, engineering capacity, and ad revenue mix.

When to Deploy Axeptio

• Direct-to-Consumer (DTC) & Shopify Stores: Brands operating primarily on Shopify, WooCommerce, or custom React/Next.js stacks that do not run programmatic header bidding will benefit from Axeptio's lightweight 42KB footprint, rapid deployment, and high consent rates (~72%).
• SMB to Mid-Market Budgets: Organizations seeking predictable SaaS pricing (€15–€250/month) without committing to five-figure annual enterprise contracts.
• Brand-Centric UX: Teams that want consent modals styled cleanly to match brand aesthetics, rather than dense multi-column corporate disclosures. Ensure the mandatory "Refuse All" button is enabled on the primary screen to maintain CNIL compliance.

When to Deploy Didomi

• Digital Publishers & Ad-Supported Portals: Entities reliant on programmatic monetization (Prebid, GAM, SSPs) that require full, certified IAB TCF v2.2 compliance (CMP ID 236) to prevent demand-side CPM discounts.
• Complex Multi-Brand, Multi-Domain Groups: Enterprise operations managing cross-domain consent sync across dozens of regional web assets and native mobile apps (iOS/Android).
• Enterprise Governance & Omnichannel Preferences: Organizations requiring centralized privacy preference centers, offline consent ingestion, and integration with enterprise identity providers (Salesforce, Adobe Experience Platform).