Biscotti CMP

Biscotti is a German-built, privacy-first consent management platform (CMP) that blocks every cookie and tracker before consent, auto-scans your site with AI, and generates your privacy legal texts — sold out as a lifetime deal on EarlyBird, but still available on a generous free plan.

What is Biscotti CMP?

Biscotti is a consent management platform and AI legal text generator in one, built by Campcruisers GmbH in Falkensee, Germany — the product was born when the founders needed a compliant CMP and legal texts for their own Campcruisers marketplace and balked at the cost and half-solutions on the market. CEO Daniel Bosch (a Berlin startup veteran who built eat-star.de, later acquired by Lieferando/Just Eat, and exited mentavio in 2020) and COO Philipp Marschall launched it in 2025, and the platform quickly earned IAB Europe TCF 2.3 registration (CMP ID 497). The pitch is straightforward: a lightweight Pre-Boot Shield that blocks every cookie, pixel, and script until a visitor consents, an AI cookie scanner that keeps your cookie declaration current, native Google Consent Mode v2 with Meta and Microsoft UET signals, and an AI legal suite that drafts Imprint, Privacy Policy, Cookie Policy, T&Cs, and DPA documents across 187 jurisdictions in 44 languages. Data stays on German servers with self-hosted fonts so visitor IPs never hit US infrastructure. There are official plugins for WordPress, Shopify, Shopware, Magento 2/Adobe Commerce, PrestaShop, and Joomla, plus GTM/GA4 integrations, a REST API, and open-source mobile SDKs for iOS, Android, Flutter, and React Native, with white-label sub-accounts and a reseller dashboard aimed squarely at agencies. It launched as a lifetime deal on EarlyBird in March 2026 at $49–$399 per tier; that deal is now sold out, and the remaining path in is a €0 free plan or €6.99–€79.99/month subscriptions.

Key Features

• Pre-Boot Shield — Blocks every cookie, pixel, and script before a visitor makes a consent choice, with no exceptions and no pre-consent data collection at all.
• AI-Powered Cookie Scanner — Automatically detects and categorizes cookies, beacons, and trackers and flags anything firing before consent; scan frequency runs up to every 15 minutes on the top tier.
• Native Google Consent Mode v2 — Sends the correct consent signals to GA4, Google Ads, and GTM in Basic or Advanced mode, plus Meta and Microsoft UET, with zero manual configuration.
• AI Legal Text Generator — The Smart Legal Wizard drafts Imprint, Privacy Policy, Cookie Policy, T&Cs, DPA, and 30+ more documents across 187 jurisdictions in 44 languages, with Legal Auto-Update on higher tiers.
• Multi-Regulation Compliance — Covers GDPR, CCPA, LGPD, POPIA, PDPA, PIPEDA, APPI, and PIPL with automatic geo-detection and Global Privacy Control (GPC) support.
• Consent Analytics & A/B Testing — Test banner layouts, placements, and copy and track opt-in rates and conversion tracking to push consent performance with real data.
• Full Audit Trail & Consent Logs — Every consent decision and revocation is logged as evidence, keeping you audit-ready for authorities.
• CMS & E-commerce Plugins — Official integrations for WordPress, Shopify, Shopware 6, Magento 2/Adobe Commerce, PrestaShop, and Joomla, plus GTM, GA4, and a REST API.
• Agency White-Label — Reseller dashboard, up to 50 client sub-accounts, custom domain (CNAME) and email, and a co-brandable public scanner for running compliance as a service.

Who is it for?

• Website owners and WordPress/e-commerce operators in the EU — or anywhere targeting EU visitors — who need real GDPR/ePrivacy consent rather than a cosmetic banner
• Agencies and freelancers managing compliance for many client sites who want unlimited domains and a reseller dashboard under one account
• Marketers running Google Ads or Analytics in the EU who must implement Google Consent Mode v2 and keep their conversion data usable
• Small teams that want cookie consent plus legal documents in one tool instead of stitching a banner together with paid lawyer templates
• Founders who'd rather pay once than commit to per-domain monthly fees across a portfolio of sites

Who is it NOT for?

• Ad-funded publishers whose ad stack demands a Google-certified CMP today — certification was still pending during the launch
• High-traffic sites on the entry tier: 100K sessions/month can vanish in a viral week, and overage pricing is still undefined
• Regulated businesses that can't rest on an AI legal generator whose output explicitly 'does not replace professional legal advice' without lawyer review
• Anyone chasing the lifetime deal right now — it's sold out on EarlyBird; only the free and monthly plans are currently available
• Enterprises needing deep privacy governance (DSAR workflows, vendor risk, GRC) — that's OneTrust/Usercentrics territory, not this tool's scope