TL;DR: Website tools are sold on a sticker price and bought on a billing model, and those are rarely the same number. There are six meters in common use: per domain, per subpage, per seat, per resolved outcome, metered with caps, and a lifetime quota dressed up as a free tier. Each one has a constraint attached that the “starts at” figure omits. CookieYes starts at $10, but geo-targeting starts at $25. Cookiebot prices by how many pages you have, so publishing costs money. Fin is $0.99 a resolution, which means the bot working is the expensive outcome. Tidio’s free AI allowance is 50 conversations for the lifetime of the account, not per month. Add a consent tool, a chatbot, translation, and maintenance to a $10 hosting plan and the honest range for a small business stack is $60 to $250 a month, most of it variable. Surmado Pro is $99 and Pro+ is $199, billed annually, as one number. The useful comparison isn’t feature counts. It’s that the cheapest tool is rarely the cheapest system.
Here’s the thing that makes this category hard to shop.
Every vendor publishes a number designed to win the comparison table, and then attaches a constraint that lives two clicks away in the documentation. The number is true. The constraint is where your money goes. You don’t find out which tier you actually needed until you’ve configured the one you bought.
We’ve now researched pricing across ten of these products in detail, checking each claim against the vendor’s own page rather than a roundup. The pattern was consistent enough to be worth writing down.
The sticker price is not the buying decision. The meter is.
Six billing models cover almost everything sold to small-business websites. Work out which one you’re signing up for before you compare prices, because they fail in completely different directions.
1. Per domain. CookieYes, Cookiebot, and Termly all work this way. One site is cheap and the second one doubles it, because there is no bundle. If you run a main site and a landing-page domain, you’re buying two subscriptions for one business.
2. Per subpage. Cookiebot prices by how many pages it scans per domain: free to 50, then $8 a month to 50, $16 to 350, $34 to 3,500, $56 to 7,000, and $96 above that. The consequence is unusual and worth sitting with. Publishing content is a pricing event. A blog that does its job walks you up the ladder.
3. Per seat. Zendesk is $55 per agent per month on Suite Team and $115 on Professional, billed annually, with Copilot another $50 per agent. Hiring is the meter. For a three-person shop, the tool costs more every time you grow.
4. Per resolved outcome. Fin charges $0.99 per resolution. Zendesk meters its AI the same way. This one inverts your incentives: under a flat fee a bot that answers more is better value, and under outcome pricing a bot that answers more is a bigger invoice. Success is the expensive scenario.
5. Metered with caps. CookieYes includes 100,000 pageviews on Basic and 300,000 on Pro, then charges $0.30 per additional 1,000. Tidio meters three things separately: human-agent conversations, Lyro AI conversations, and unique visitors reached with Flows. A good month costs more than a bad one.
6. A lifetime quota dressed as a free tier. Tidio’s Free and Starter plans include 50 Lyro AI conversations for the lifetime of the account. Not 50 a month. Fifty, ever, and then the AI stops answering until you buy capacity. That is a legitimate pricing choice and it is also the single most misread number we found.
“Starts at” is usually incomplete without the constraint beside it
Every entry price we checked had a condition attached. Not hidden exactly, but not in the place where you compare products either.
| The claim | The constraint |
|---|---|
| CookieYes from $10/domain | Geo-targeting starts at the $25 Pro tier |
| Cookiebot from $8/domain | Prices climb by subpage count, and Small requires multiple domains |
| Fin at $0.99 a resolution | Standalone starts at $49/mo, which includes the first 50 |
| Tidio Lyro from $39/mo | That buys 50 conversations; higher volumes are quoted, not published |
| HubSpot chat free | Rule-based only, HubSpot branding, and the account caps at 2 users |
| Zendesk AI included allowance | It’s $2–$10 per agent of credit, and the rate it buys isn’t published |
The CookieYes one is the clearest illustration. If you’re shopping for a consent tool because someone told you EU and California visitors should see different things, geo-targeting is the feature you came for. The $10 plan does not have it. Your real comparison was always $25, and at $25 the field looks different: Complianz Premium is $59 for a year.
Feature tables blur three different things
When a vendor’s grid puts a checkmark in a row, it can mean any of three things, and they are not equivalent:
- Technically available in the product. It exists somewhere.
- Included in the tier you’re pricing. It exists on your plan.
- Usable without another paid dependency. It works without buying something else.
iubenda is a clean example of the gap between one and two. Consent, policies, and DSAR handling all appear in the product. But core compliance is bundled per site at $6.99, $27.99, and $119.99, and DSAR management is Ultimate-only. If data-subject requests are why you’re shopping, the entry tier doesn’t do the job, even though the feature is unambiguously “in the product.”
HubSpot shows the gap between two and three. Free live chat is genuinely free with no conversation limit. But the bot on Free is limited to predefined ticket, qualification, and booking flows with no custom branching, and the actual AI agent needs a Professional or Enterprise subscription plus credits at roughly 50 per resolved conversation.
When you read a comparison, including ours, ask which of the three each checkmark means.
What a real stack costs
Take a plumbing company in Phoenix. One site, maybe forty pages, US-only customers, two people who answer the phone. They want analytics, a cookie banner that behaves correctly by region, a chat widget that handles the same four questions, and someone to keep WordPress from breaking.
Sticker prices, added up the way a spreadsheet would:
| Piece | “Starts at” |
|---|---|
| Hosting | $10 |
| Consent tool | $10 |
| Chatbot | $29 |
| SEO plugin | $0 |
| Backups and security | $8 |
| Total | $57/mo |
Now apply the constraints. Geo-aware consent means the $25 CookieYes tier, not $10. A chatbot that actually answers rather than routes means Tidio Starter plus Lyro, so $29 plus $39. Security and backups on a real plan is closer to $15. Nobody is maintaining any of it, so add either your own hours or a maintenance retainer, which runs $79 to $200 a month at the low end of that market.
| Piece | Realistic |
|---|---|
| Hosting | $10–25 |
| Consent (geo-aware) | $25 |
| Chatbot with working AI | $68 |
| Backups and security | $15 |
| Maintenance | $79–200 |
| Total | $197–333/mo |
That’s before translation, before anything metered spikes, and before the second domain. The $57 was never wrong. It was just never the number you were going to pay.
Three honest notes on that table, because a cost table that hides its own sourcing is the exact trick this article is complaining about.
Two lines are verified vendor prices. Consent at $10 and $25 is CookieYes Basic and Pro. The chatbot at $29 and $68 is Tidio Starter, then Starter plus Lyro. Those came off the vendors’ own pricing pages.
Three lines are typical market figures, not quotes. Hosting, backups, and maintenance vary enormously by provider and by how much hand-holding you want. The maintenance line is the widest variable of the lot and the one most likely to be wrong for your situation, in either direction. Treat those three as the shape of the bill rather than the bill.
And if you genuinely don’t need geo-aware consent or an AI chatbot, the cheap column is real and you should buy it. This piece is an argument against unexamined stacks, not against cheap ones.
Free tiers are worth understanding, not dismissing
Some of them are genuinely good. Complianz’s free version includes a single-site banner, cookie scanning, and a policy generator, which is more than most paid entry tiers. HubSpot gives away live chat and a CRM with no conversation cap.
The thing to check is what happens after the free tier stops working, because that’s the decision you’re actually making:
- A quota that never refills. Tidio’s 50 Lyro conversations. When they’re gone, the feature is gone.
- Branding you can’t remove. HubSpot’s widget carries HubSpot’s name.
- A user cap unrelated to usage. HubSpot Free is two users regardless of conversation volume.
- A domain cap. Every consent tool here is per-domain, free tiers included.
- Missing behavior rather than missing volume. The free version does a simpler thing, not less of the same thing. This is the one people misjudge, because it doesn’t show up as a limit warning. It shows up as the tool not doing what you assumed.
Where this leaves the compliance question
One thing worth being precise about, because vague versions of it are used to sell tools.
The clearest published statement of the “ask before you track” rule is the UK’s, in the ICO’s guidance: strictly necessary cookies can operate without consent, non-essential ones need an affirmative choice first, and continuing to browse isn’t a choice. The ICO regulates the UK, not the EU. EU rules run parallel through the ePrivacy Directive and GDPR as applied by each member state’s own regulator, so specifics vary by country in a way the ICO doesn’t speak to.
California is a different regime, not a stricter version of the same one, and it doesn’t apply to everyone. A business is covered if it clears any one of roughly $26.6 million in annual gross revenue, data on 100,000 or more consumers or households, or 50% or more of revenue from selling or sharing personal information. Plenty of small businesses clear none of those.
No tool on any of these lists makes you compliant by installation. Complianz says so in its own words: “A correct configuration of this plugin by a website administrator is always required.” That’s true of all of them, and it’s a cost in your time that no pricing page lists.
Where Surmado fits, and where it doesn’t
Surmado Sites is one bill: Pro at $99 a month billed annually ($150 month to month), Pro+ at $199 ($250 month to month). Hosting, maintenance, updates, and content are in it. Pro+ adds a chatbot, up to five additional languages, weekly blog posts, and ad and visitor tracking with a geo-aware consent banner.
The relevant thing here isn’t the number, it’s the shape. No per-domain multiplier. No subpage ladder, so publishing doesn’t reprice you. No per-seat cost, so hiring doesn’t. No resolution meter, so the chatbot working well isn’t a bigger invoice. No pageview cap to blow through in a good month. That’s the entire argument: the meter is the thing you’re escaping, more than the price.
Now the part that should keep you honest about it.
Surmado is not a consent management platform. No automated cookie discovery, no granular preference center, no stored consent records, no generated legal policies, no DSAR handling, no Google Consent Mode v2, no IAB certification. Termly, CookieYes, Complianz, and Cookiebot all do most or all of that. If you need consent records for an audit, generated policies, or DSAR workflows, buy one of them. It’s not close, and we’d rather say it here than have you find out in month two.
It’s also not a support platform. No shared inbox, no ticketing, no agent seats, no routing, no omnichannel. Fin and Zendesk do that properly.
And the switching cost is real in a way the others aren’t. Every tool above installs onto the website you already have. This one replaces it. That’s the right trade only if the website is itself something you’d rather not own, which is a much bigger question than “what should my consent tool cost.”
For a business running Google Analytics, an ad pixel, a contact form, and forty pages, the enterprise-shaped half of those feature lists was never aimed at you. For a business selling into the EU at volume or handling sensitive data in a regulated field, it absolutely was, and you should buy the specialist.
How to price a stack without getting caught
Five questions, in order. They take about twenty minutes and they beat any comparison table, including this one.
- What is the meter? Domains, subpages, seats, outcomes, pageviews, or a fixed fee. Write it down for every line item before comparing any prices.
- What does the entry tier not include? Find the feature you’re actually buying for and confirm which tier it starts on. This is where most of the surprise lives.
- What does success cost? Model the bill at the traffic and resolution volume where the thing is working, not at today’s numbers.
- What’s the second-domain price? If there’s any chance of a second site, multiply now.
- Who notices when it breaks? Consent tools and chatbots fail quietly. If the answer is nobody, the cheap plan isn’t cheap, it’s just unmonitored.
The bottom line
The tools in this category are mostly good, and the pricing mostly isn’t dishonest. It’s just built to be compared on one number and paid on another.
The cheapest tool is rarely the cheapest system. Five subscriptions at $10 to $30 apiece, each with its own renewal, its own meter, its own dashboard, and its own way of breaking without telling you, is not a $60-a-month website. It’s a $200-a-month website plus an unpaid operations job, and the job is the part that quietly doesn’t get done.
That doesn’t mean buy from us. It means count the whole system before you compare the parts. If the count comes out fine and you like your website, buy the specialist tools and get on with it. If the count is the reason you searched for this in the first place, Surmado Sites rebuilds your existing site and sends you a preview before you pay anything, and the pricing page has the current numbers.
The related reading, if you want the per-category detail: cookie consent tools compared, AI chatbots compared, what a website costs to build, and what $100 a month actually includes.
Prices retrieved from vendor pricing pages in August 2026 and verified against primary sources. This category re-prices often, and promotional rates come and go; check the vendor’s own page before budgeting. General information, not legal advice.