Velo · Market Brief Internal · Confidential

Everyone ships a cookie banner. Almost none of them actually work.

The consent market is small, growing double digit, and structurally unsolved. Two thirds of sites show a banner; one in seven is genuinely compliant. The incumbents are raising prices and walking up market. That hollow middle is where Velo enters — not as another banner, but as the first consent layer built by data engineers and measured in recovered revenue.

$1.05B
2025 market, growing to $2.8B by 2033 (13–20% CAGR)
67 → 15%
have a banner → are minimally GDPR compliant
34%
of sessions hidden by consent — Amplio measured
€475M
CNIL cookie fines in a single day, 2025
01 · The market

A small market, growing fast, that nobody has actually fixed.

Consent is a sub $1.1B category, but regulation is dragging it up at 13–20% a year across every estimate. The interesting number is not the size — it is the quality gap. Most sites bought a banner and still leak data, still fail audits, still get fined.

$2.78B
Market by 2033
from $1.05B in 2025 · Grand View Research
▲ 13.1% CAGR
15%
Sites minimally compliant
of 254k EU sites — 67% show a banner · CHI 2025 study
▼ 85% non compliant
39%
Honest acceptance rate
with a real reject button — vs ~90% via dark patterns
— the rest is illusory
20–40%
Conversions Amplio recovers
Consent Mode v2 + server side + enhanced conversions
▲ +37% ROAS proven
02 · The shape

The top is consolidating. The bottom is commoditising. The middle is hollow.

The field is a barbell. Enterprise suites are merging and pricing themselves out of small sites; self serve tools race to zero on a banner alone. The agency managed mid market — sites that need consent wired correctly into tracking — is served by nobody who understands the data layer.

Top — enterprise GRC

Moving up market, raising the floor.

  • OneTrust: ~$10k/yr minimum, renewal hikes of 275–468%, 110 more layoffs in Mar 2026, rumoured PE sale.
  • Didomi bought Sourcepoint and Addingwell in 2025 — a two year integration distraction at enterprise prices.
  • TrustArc: $10k–$22k/yr, privacy team buyers, compliance not performance.
Bottom — self serve SaaS

Commoditised to a banner and a price.

  • Cookiebot doubled base pricing to ~€30/domain in Aug 2025 and force upgraded small accounts — a live migration trigger.
  • CookieYes, iubenda, Cookie Script: €0–55/domain, per domain billing that stacks linearly for agencies.
  • Open source (Klaro, c15t) drives the banner itself toward free.
The opening

Nobody owns the agency managed middle. The enterprise tier is too expensive and too heavy; the self serve tier sells a banner and no implementation. The unserved buyer is the agency running 5 to 200 client sites that each need consent wired into Google Consent Mode v2, server side tagging and GA4 — and verified to actually fire. That is Amplio's existing competence, productised.

Usercentrics / CookiebotSMB plug and play scale
2.3M sites
CookieYesWordPress led, SMB
1.5M sites
OneTrustenterprise, >14k customers
350k sites
Google certified CMPsthe whole certified field
~47 vendors
Deployment scale by sites running the banner — scale lives at the cheap end, value does not
03 · Where they are exposed

The incumbents are annoying their own customers — and looking the other way.

Every cluster of complaints in 2024 to 2026 is a wedge. Price shocks, a Core Web Vitals tax, consent that is silently broken, and banners that look compliant but get fined anyway.

OneTrustPrice · abandonment

Moved to a usage metered $10k/yr floor; charities went from under £1,000 to £17,000+. Reviewers cite scattered settings and non existent support. It has left the small end entirely.

Evidence · G2 reviews 275–468% renewal hikes; Charity Today, Torchbox 2025–26
Cookiebot / UsercentricsPrice shock

Roughly doubled base Premium to ~€30/domain in Aug 2025 with little notice and auto upgraded 1 to 3 domain accounts. G2 sits at ~3.5 with surprise metered billing called a "scam". A datable switching event.

Evidence · Enzuzo, Capterra, Trustpilot 2025–26; one review cites +78.6% out of the blue
The whole fieldSpeed tax

CMP scripts pull 200KB+ of JavaScript, push LCP past 2.5s and add up to 73 third party requests after opt in. Consent is sold as compliance and paid for in Core Web Vitals.

Evidence · DebugBear, SpeedCurve 2025 (OneTrust, Quantcast, TrustArc, Usercentrics named)
Consent Mode v2 setupsSilently broken

Tags fire before consent, the banner signal reaches GTM too late, ~75% of tracking happens before the user ever interacts. Standard GTM preview does not catch it. This is exactly Amplio's diagnostic lane.

Evidence · Seresa, Cookie Script, Bounteous 2025; VG Hannover ruled GTM itself needs consent
Compliance theaterFined anyway

Dark patterns coax ~90% accept while regulators fine despite the banner: CNIL €325M Google and €150M Shein in one day; Honda's settlement named a misconfigured OneTrust. A banner is not a defence.

Evidence · noyb (560 sites, 81% no first layer reject); CNIL, CPPA 2025
Agency economicsPer domain stacking

Per domain pricing scales linearly with no real bundling — 5 sites on CookieYes Pro is $125/mo for consent alone. Agencies are openly searching for flat, portfolio priced, white label consent.

Evidence · Enzuzo multi domain guide 2025; CookieHub, CookieYes partner programs
04 · Why next generation

What the next generation consent layer has to fix.

Velo wins by redefining the category on four axes the incumbents structurally cannot move on without cannibalising themselves.

A banner that proves you tried to comply
A revenue instrumentmeasured in recovered conversions and ROAS, not legal cover
A 200KB script that taxes every page load
An edge native layer under 20KBserved from Cloudflare Workers, no Core Web Vitals penalty
Per domain billing that punishes a growing book
Flat portfolio pricingwhite label, one multi tenant dashboard, usage metered not per seat
A banner that looks compliant and still gets fined
Compliance you can proverendered screenshot verification, honours Global Privacy Control, real reject layer
05 · The ideas

Six ways Velo becomes the lane nobody is defending.

Each is anchored to an unfair Amplio advantage no banner vendor can copy cheaply — the data engineering, the agency channel and the Cloudflare edge.

USP 01

The CMP that pays for itself

Bundle the banner with Consent Mode v2 and server side tagging so it recovers the 20 to 40% of conversions every other banner silently loses. Priced against recovered revenue, the banner is free.

Why we win: Amplio already ships the recovery stack and the +37% ROAS proof. No incumbent sells the outcome — they sell the banner and leave the data on the floor.

Performance agenciesE commerce
USP 02

Zero speed tax consent

An edge native banner under 20KB on Cloudflare Workers, versus the 200KB+ scripts that push LCP past 2.5s and add dozens of third party calls. Consent that does not cost you Core Web Vitals.

Why we win: the Klaro fork on Cloudflare edge is the architecture; page speed is a top, datable complaint against OneTrust, Usercentrics and TrustArc.

SEO sensitiveHigh traffic retail
USP 03

Priced for the agency book

Flat portfolio pricing, white label, one dashboard across every client site — killing the per domain stacking that makes Cookiebot and OneTrust untenable past a handful of sites.

Why we win: the B2B2C agency motion already exists (Rapid). Meter by traffic and domain slots like c15t, not per seat, with agency margin built in.

Agencies, 5–200 sitesWhite label
USP 04

Compliance you can prove

Every banner verified with a rendered screenshot, honouring Global Privacy Control on logged in users, with a real same layer reject. Sold against the 85% that fail and the fines that land despite a banner.

Why we win: Amplio's verify with a screenshot discipline becomes a product feature. GPC is now legally required in 12 US states and barely anyone honours it.

Risk aware brandsUS + EU traffic
USP 05

One config, every platform

Sane defaults per jurisdiction out of the box — denied for EU opt in, GPC honoured for US opt out states — reconciling Google Consent Mode v2, Microsoft UET and Meta in a single setup, not a blank rules engine.

Why we win: multi signal, multi jurisdiction wiring is exactly what generic banner vendors do badly. One verified setup satisfies three ad platforms at once.

Multi market advertisers72h setup
USP 06

Consent that optimises itself

Built in consent rate optimisation — A/B test the banner copy, design and placement to lift opt in 5 to 15%, tied straight to measured revenue rather than vanity accept rates.

Why we win: experimentation plus measurement is Amplio's home turf. Lifting genuine opt in compounds directly with the recovery stack in USP 01.

Growth teamsCRO led
06 · Positioning + the wedge

Old CMPs are lawyers in a banner. Velo is engineers in the data.

The one line

Compliance you can prove. Conversions you keep.

"The first consent layer built by data engineers — edge fast, tracking native, measured in recovered revenue."

The first wedge

Price hike refugees, through the agency channel. Lead with Rapid's book and every agency bleeding on Cookiebot's August doubling and OneTrust's renewal shocks. The opener writes itself: your banner just got more expensive — and it is quietly costing you a fifth of your conversions. Land the portfolio, prove the recovery on three sites, then widen. Google certification is a later credibility floor, not the wedge.