Download websites that use iubenda

About iubenda

A consent banner is a legal artifact before it is a technical one, and iubenda is a clear example of that on the open web. Our Cookie compliance grouping holds it alongside tag managers and cookie blockers, but the product is really a document generator with a widget attached: privacy policy, cookie notice, terms, and the consent record a European site needs in order to argue it collected permission before it set a tracker. The service launched in 2011 and is delivered as a hosted JavaScript include, Proprietary and operated by iubenda, so the wording and the consent logic live with the supplier rather than in the site's own codebase.

Geography explains the shape of the install base better than the feature list does. Italy accounts for 83,321 of the sites we see running it, and .it recurs through the list, which follows from a company built in that market and sold first to the agencies, accountants and small law practices who serve it. As of October 2026 the total stands at 176,847 sites, so the platform is not confined to one country, but the distribution is steep enough that anyone modelling European compliance adoption should treat the home market and the rest as separate populations.

Presence of a paid consent platform on a domain is a decent proxy for two commercial facts. The first is that the owner decided regulatory risk was real enough to pay a subscription for, which sorts them from the much larger group that pasted a free banner script and stopped thinking about it. The second is that the site almost certainly runs trackers worth consenting to, because nobody buys consent management for a brochure page with no analytics. For a vendor selling privacy tooling, analytics or anything that touches personal data, a list of domains running a paid consent layer is a list of buyers who have already accepted the category and only need convincing about the supplier.

A single lookup tells you which platform one prospect uses. The download answers the questions a lookup cannot: how consent tooling is spread across a country's commercial web, which platforms cluster with which CMS and hosting choices, and how that population shifts between snapshots as enforcement pressure moves. Compliance researchers run the same list backwards, sampling domains in a jurisdiction to ask what proportion carry any consent layer at all.

What we record is the presence of the script, not its correctness. We cannot tell you whether the banner blocks trackers before consent, whether the policy text is current, or whether the configuration matches the law where the visitor happens to be, and a site can embed the platform perfectly and still leak identifiers on load. Detection also runs against the page we fetched, so an install that appears only in a checkout flow stays invisible to us. The count is evidence of intent and of spending, not evidence of compliance.