Setting up a cookie banner on one website is a fifteen minute job. Keeping twenty client sites compliant, through redesigns, staff changes and the marketing person who adds a new tracking script on a Friday, is a completely different problem.
Most agencies end up handling it the same way: a different tool per client, whichever one the client was already paying for, and nobody quite sure which sites are actually fine. This post is about the version that scales.
Who is responsible when an agency builds the site?
The client is almost always the data controller, and the agency is a processor acting on their instructions. That means the legal exposure sits with the client, but the practical work sits with you, and a data processing agreement should say so in writing. Building a non-compliant site is still your professional problem even when it is not your fine.
This distinction matters for how you sell it. You are not taking on the client's legal risk. You are taking on the job of making sure the technical setup matches what their privacy policy claims, which is a service with a clear scope and a clear price.
How bad is it out there, really?
Worse than most agencies assume. Across 1,775 sites in our own scan data, only 18.3% had any consent management platform at all, while 58.3% loaded at least one third party tracker. That gap is the entire market: sites that are tracking people with nothing in place to make it lawful.
The more uncomfortable number is what happens on the sites that do have a banner. Even among those, a large share still fired trackers before consent, usually because the banner was installed correctly and the tracking scripts were never actually gated. A banner is not the same as blocking, and clients cannot tell the difference by looking.
What breaks when you manage consent site by site?
Four things, in roughly this order.
Billing chaos
Every client on a different plan, different renewal date, different card. Some of them expired months ago and nobody noticed because the banner keeps showing while the account is dormant.
No overview
You cannot answer "which of our clients are compliant?" without opening twenty dashboards. When one client emails asking, you spend an afternoon finding out.
Silent drift
A client adds a chat widget, a heatmap tool, a new pixel. Nothing tells you. The cookie declaration you wrote in March is wrong by June, and the first you hear about it is when someone complains.
Pageview pricing surprises
Most consent tools price on traffic. One client has a good month, gets featured somewhere, and the bill jumps. You either absorb it or have an awkward conversation.
How much should cookie consent cost per client site?
Roughly the price of a coffee per month per domain, if you are buying at agency volume. Consentify charges around 22 NOK per domain per month on multi-site plans, flat, regardless of traffic. That is the number that makes reselling work, because it is small enough to disappear inside a maintenance retainer.
Compare that to per-site consumer pricing on the bigger platforms, where a mid-traffic site can run several hundred kroner a month. Our breakdown of Cookiebot alternatives covers where those costs come from, and the short version is pageview tiers.
Can you resell cookie consent as a service?
Yes, and it is one of the cleanest add-ons an agency can sell. You pay a flat per-domain rate, you charge the client for "cookies and consent handled", and you keep the margin. The client gets one less vendor relationship, and you get a recurring line item on work you were half doing for free anyway.
The reason it works is that the client is not buying software. They are buying not having to think about it. Nobody wants to compare consent platforms, they want someone to say it is handled. That is a service, and services carry margin in a way that reselling a tool at cost does not.
A workflow that actually scales
This is the sequence we see working across agency accounts.
1. Audit before you quote
Run a free GDPR scan on every site in the portfolio. It takes a minute per domain and gives you a concrete list of what each site loads before consent. That list is also your sales document, because it is specific and it is about their site.
2. Build one banner, reuse it everywhere
Design a house banner: your default colours, wording and categories. Then adjust the palette per client rather than starting over. Consistency here is not laziness, it is what makes the twentieth setup take five minutes.
3. One script tag, one place
The embed is a single tag in the <head>:
<script src="https://consentify.app/api/gateway?token=CLIENT_TOKEN"></script>
In Webflow it goes in Project Settings, Custom Code, Head Code. In WordPress it goes in the theme header or through the plugin. We cover both in the guides for cookie consent on Webflow and cookie consent on WordPress.
4. Let the declaration maintain itself
The step that kills agencies is keeping cookie declarations current across a portfolio. Tools that solve this by crawling each site monthly leave you a month behind reality. Consentify picks up a new tracker the first time a real visitor hits the page it is on, which means the declaration follows the site instead of a schedule.
What about subdomains?
A visitor should not have to accept twice to use one company's website. If a client runs booking.example.no alongside example.no, the consent given on one should apply on the other, because to the visitor it is the same organisation.
Plenty of platforms treat every subdomain as a separate billable domain and a separate consent scope. That is a pricing decision dressed up as a technical one, and it produces a worse experience for the end user. Worth checking before you commit a client portfolio to a platform.
What to hand over at project close
If the client is taking the site in-house, give them something they can act on:
- Which trackers the site loads, and which category each one sits in
- Where the consent script lives, so a future developer does not delete it
- How to withdraw consent, and where the revoke element sits (an element with id
revoke-consent-btnon the privacy page) - Who owns the account and what happens at renewal
- A plain sentence about what changes if they add new tracking
The last one matters most. Most compliance problems start with someone adding a tag after handover and assuming the banner covers it. It does not automatically, and saying so once in writing saves a support ticket later. Our GDPR compliance guide is a reasonable thing to link them to.
When you outgrow the standard plan
Portfolios above a certain size stop fitting a per-domain list: shared billing, client-level access, white labelling, sometimes an affiliate arrangement instead of reselling. That is what the enterprise setup exists for, and it is a conversation rather than a pricing page.
Managing consent for more than one site? Try Consentify free, then add your client domains under one dashboard.