Didomi

What Is Didomi?

Most organisations discover their consent management problem the hard way. A cookie banner is deployed — often a tag manager plugin, often configured in an afternoon — and it works until a GDPR enforcement decision lands that makes clear "working" and "compliant" are different things. The French data protection authority CNIL has issued fines to Google (€150 million), Facebook (€60 million), and Microsoft (€60 million) specifically for cookie consent deficiencies. Spain's AEPD and German state-level DPAs have followed. Consent infrastructure that was treated as a checkbox has become a regulatory liability.

Didomi launched in Paris in 2017 with the premise that consent management deserves a dedicated platform, not a plugin. The company builds consent and preference management as its entire product focus — not a feature within a broader privacy management suite, as is the case with OneTrust or TrustArc. By 2026, the platform processes consent decisions from over 100 countries for enterprise clients across media, e-commerce, finance, and telecommunications.

Ownership changed in April 2025. Los Angeles private equity firm Marlin Equity Partners completed what its own announcement calls a "majority growth investment" in Didomi, a funding round Maddyness reported at €72 million. The French company register now lists a holding company, Milkyway Midco, as Président of Didomi SAS, the usual acquisition structure for a private equity buyout. Alongside the Marlin deal, Didomi bought Addingwell, a Lille-based server-side tagging provider now sold as Addingwell by Didomi. In July 2025 it added Sourcepoint, a US consent management platform with more than 200 enterprise customers. Didomi SAS remains a Paris-registered operating company, but ultimate control now sits with a US fund.

What makes Didomi relevant for European organisations specifically is the infrastructure posture. Consent data — records of which users agreed to what, when, on which legal basis — is personal data. It is subject to GDPR. Storing it with a US-based provider triggers adequacy concerns and creates precisely the kind of cross-border data transfer that regulators are scrutinising. Didomi's July 2026 sub-processor list puts consent data on AWS EMEA in Frankfurt and on Snowflake's EU deployment in the same region, with Addingwell's tagging service in Belgium. No processing outside the EU appears on that list.

Key Features

Cookie Consent and TCF v2.3

The foundation of any consent management platform is the cookie banner: the mechanism by which websites obtain, record, and honour user choices about tracking. Didomi's banner implementation is TCF v2.3 certified — meaning it conforms to the IAB Europe Transparency and Consent Framework, the standard used by the programmatic advertising industry to propagate consent signals through ad technology chains.

TCF v2.3 compliance is non-trivial. The framework specifies exactly how consent strings must be structured, how vendor lists must be managed, and how user choices must be recorded and forwarded to downstream partners. A non-compliant implementation can cost ad revenue, because ad tech partners reject malformed consent signals. It also creates regulatory exposure: the Belgian DPB's 2022 decision found the TCF framework itself created GDPR violations that publishers were implicated in. Didomi's certified implementation handles the technical complexity while giving organisations a compliant foundation.

Banner display logic uses geolocation to determine which regulation applies to each visitor. A user in California sees a CCPA-compliant banner. Visitors from France get a GDPR-compliant banner, while someone in Brazil sees an LGPD-compliant one. All from the same platform, without separate implementations per market.

Preference Centre

The distinction between consent management and preference management matters commercially, not just legally. Cookie consent captures a binary choice about tracking at a point in time. A Preference Centre captures ongoing, granular choices: which email types a user wants to receive, how frequently, whether their data can be shared with specific categories of partners, whether they want personalised recommendations.

Didomi's Preference Centre stores these choices centrally and forwards them to downstream systems — Salesforce Marketing Cloud, Marketo, HubSpot, Segment — via real-time integrations. When a user updates their email frequency preference in the Preference Centre, that change propagates to the email service provider immediately. This closes the gap between what users consent to and what organisations actually do with their data, which is both a compliance requirement and a practical requirement for maintaining trust.

Organisations that have deployed Preference Centres report reduced unsubscribe rates because users can adjust rather than exit. It also produces higher-quality marketing data: email lists filtered to genuinely consented contacts have higher engagement rates and lower spam complaint rates.

Headless Consent API

Cookie banners are a browser-native pattern. Mobile applications, connected TV platforms, and server-to-server data flows require a different approach. Didomi provides a headless consent API and native SDKs for iOS and Android that enable consent collection and storage for non-browser surfaces.

A mobile app using the Didomi iOS SDK can present a native consent experience — not a WebView loading a browser banner — and store the resulting consent record in Didomi's centralised consent store. When the user opens the same service in a web browser, their prior consent is recognised. This cross-surface consent portability is technically complex to implement from scratch and is increasingly required by regulators who treat mobile and web as parts of the same data processing activity.

Connected TV consent via the IAB's OTT framework is also supported, positioning Didomi for the growing segment of media companies whose users access content across browsers, apps, and smart TVs.

Compliance Dashboard and Consent Analytics

Didomi's analytics layer tracks consent rates by property, banner variant, user geography, and time period. Banner design is a meaningful optimisation lever, since consent rates can vary by 20–40 percentage points across configurations. For organisations running A/B tests, the analytics dashboard provides the data needed to make evidence-based design decisions.

The compliance dashboard shows real-time vendor configuration status. It flags vendors present on a property who are not in the configured IAB vendor list, and vendors active on properties where their consent has not been obtained. This audit capability is valuable for large organisations managing dozens of web properties where tracking tag proliferation is difficult to monitor manually.

Data Subject Request Management

Enterprise plans include DSR (Data Subject Request) workflow management — the process of receiving, verifying, routing, and fulfilling requests from users to access, correct, or delete their personal data. GDPR Article 15–17 requires organisations to respond to these requests within 30 days. Didomi's DSR module creates a structured workflow with audit trails, connecting consent records to downstream data processing systems via API integrations.

Pricing

Didomi does not publish pricing. All plans require a sales conversation, which is the norm for enterprise consent management but a friction point for technical teams evaluating independently. Based on market intelligence, Didomi's pricing is positioned in the mid-to-upper tier of the consent management market — above self-serve tools like Cookiebot and Iubenda, below OneTrust's enterprise contracts.

For organisations comparing Didomi to OneTrust, the value calculation often favours Didomi for EU-focused deployments. Didomi is a more focused product, covering consent and preferences rather than the full privacy programme suite. That means lower licence costs, but also less functionality for privacy impact assessments, vendor risk management, and policy lifecycle management, which OneTrust supports natively.

Professional services for implementation are typically recommended for organisations with complex multi-property setups. This adds to total cost of ownership but reflects the genuine complexity of configuring a TCF v2.3-compliant consent infrastructure across multiple markets.

EU Compliance & Privacy

Didomi's data-protection posture is still its clearest differentiator against American competitors. Didomi SAS is a French company registered in Paris. According to its sub-processor list, updated in July 2026, consent data is hosted by AWS EMEA SARL in Frankfurt and by Snowflake Computing Netherlands B.V. in the AWS eu-central-1 region. Addingwell's server-side tagging runs in Belgium. That list shows no processing outside the EU for standard deployments. ISO/IEC 27001:2022 certification is in place, and TCF v2.3 certification is current.

For Data Protection Officers making a consent platform selection, due diligence on the data flows is simpler with Didomi than with a US-hosted provider. Consent records stay in the EU, so there is no transfer impact assessment to document for standard deployments. AWS and Snowflake are themselves US-headquartered providers contracting through EU subsidiaries, which strict sovereignty policies may still need to account for.

Ownership is the other half of the picture, and it changed in 2025. Marlin Equity Partners, a Los Angeles private equity firm, has held a majority stake since April 2025. Didomi SAS continues to operate under French law from Paris, and its certifications remain in place. Long-term governance, roadmap priorities and any future sale do, however, now run through a US investor's fund cycle. Buyers whose procurement rules require EU ownership, not just EU hosting, should treat Didomi the same way they would treat IDnow (Corsair Capital) or Jedox (Insight Partners).

Who It's Best For

Large EU enterprises with multiple web properties and markets where managing consent across jurisdictions without a dedicated platform creates compliance exposure. Media companies, retailers, and telecommunications providers with international user bases are Didomi's natural market.

Organisations with advertising-funded digital products where TCF v2.3 compliance directly affects ad revenue. Incorrectly structured consent strings result in consent signals that programmatic ad platforms reject, reducing available inventory.

Data Protection Officers and privacy teams at companies where consent records will be subject to regulatory review. Didomi's audit trails, certification status, and EU data hosting create a defensible compliance posture.

Companies replacing OneTrust who find they are paying for privacy programme management features they do not use and want a more focused, EU-hosted consent platform at a lower total cost.

The Verdict

Didomi is one of the strongest European alternatives to OneTrust for organisations whose consent management requirements are primarily GDPR and TCF v2.3 compliance, not broader privacy programme management. Its Preference Centre goes meaningfully beyond what most consent platforms offer, addressing both commercial and compliance objectives. EU data hosting, ISO/IEC 27001 certification and TCF v2.3 status make procurement straightforward for regulated industries.

The limitations are real: no self-serve trial, opaque pricing, and an implementation complexity that requires budget for professional services in large deployments. Since April 2025 the company has also been majority-owned by a US private equity firm, which matters to buyers who require EU ownership rather than EU hosting. Teams looking for a quick-to-implement, low-cost consent banner will be better served by Cookiebot or Iubenda. For consent at enterprise scale, across multiple markets, with advertising technology dependencies and regulatory scrutiny, Didomi's depth is worth the investment.

Frequently Asked Questions

Is Didomi GDPR compliant?

Yes. Didomi SAS is incorporated in Paris, France, and hosts consent data in the EU on AWS in Frankfurt and on Snowflake's EU deployment, according to its July 2026 sub-processor list. The company holds ISO/IEC 27001:2022 certification and TCF v2.3 certification from IAB Europe, and offers Data Processing Agreements to all customers. Buyers should note that US private equity firm Marlin Equity Partners has held a majority stake since April 2025, a governance consideration separate from data-protection compliance.

How does Didomi compare to OneTrust?

Didomi is a European alternative to OneTrust with a stronger focus on consent and preference management as its core product. OneTrust has broader privacy programme management features, such as privacy impact assessments, vendor risk and policy management. Didomi's EU data hosting and European regulatory depth make it more attractive for organisations prioritising GDPR compliance over breadth. Neither vendor is EU-controlled at the top level, though: OneTrust is American, and Didomi has been majority-owned by US investor Marlin Equity Partners since 2025.

Does Didomi support mobile app consent?

Yes. Didomi provides a headless consent API and native SDKs for iOS and Android, enabling consent collection and storage for mobile applications where browser cookie banners are not applicable. Connected TV (CTV) consent is also supported via the API, and choices made on mobile can be recognised on web.

What is a Preference Centre and why does it matter?

A Preference Centre goes beyond cookie consent to give users granular control over how an organisation communicates with them, such as email frequency, product notification types and data sharing permissions. Didomi's Preference Centre integrates these choices with downstream marketing tools like Salesforce, HubSpot and Marketo. That reduces unsubscribes and improves marketing data quality, because only genuinely consented contacts receive communications.

Where does Didomi store consent data?

Consent records are hosted in the EU on AWS EMEA in Frankfurt (eu-central-1) and on Snowflake in the same region, according to Didomi's July 2026 sub-processor list. Addingwell's server-side tagging service runs in Belgium, and the list names no processing outside the EU. Both AWS and Snowflake are US-headquartered providers contracting through EU subsidiaries, so organisations with strict sovereignty rules should still review the Data Processing Agreement.