Identity and Privacy

Open-source CMPs: Klaro and Orejime, and why neither is a TCF consent management platform

Published November 10, 2026 · Last updated November 10, 2026
Next review: 9 May 2027

Klaro and Orejime are the best-known open-source consent managers: free JavaScript libraries under the BSD-3 licence that you host yourself. Neither is registered with IAB Europe as a TCF CMP, and neither is on Google's certified CMP list. That makes them fit for cookie consent, not for ad-funded sites in Europe (IAB Europe CMP list, 5 November 2026).

Contents

At a glance

Company: KIProtect GmbH (Klaro contact)
Headquarters: Berlin, Germany (Klaro contact)
Founded: npm package first published 10 October 2019 (npm registry)
Ownership: Open-source project run by a private company
Product category: Open-source consent manager
What it does: Blocks third-party scripts until consent and lets users change choices
Deployment model: Self-hosted JS, KIProtect CDN, or paid hosted service
Pricing model: Free; hosted plans from €19 a month billed annually (Klaro pricing)
Key integrations: Google Tag Manager, Google Consent Mode v2 (Klaro, 21 March 2024)
Publicly named customers: RSA GmbH, Rohde Technics, VR Zahlungssysteme, VKA, Paper24 (named by Klaro, klaro.org)
Standards supported: No TCF registration; no GPP found; Consent Mode v2
Last verified: 9 November 2026

Field	Klaro	Orejime
Company	KIProtect GmbH (Klaro contact)
Headquarters	Berlin, Germany (Klaro contact)
Founded	npm package first published 10 October 2019 (npm registry)
Ownership	Open-source project run by a private company
Product category	Open-source consent manager
What it does	Blocks third-party scripts until consent and lets users change choices
Deployment model	Self-hosted JS, KIProtect CDN, or paid hosted service
Pricing model	Free; hosted plans from €19 a month billed annually (Klaro pricing)
Key integrations	Google Tag Manager, Google Consent Mode v2 (Klaro, 21 March 2024)
Publicly named customers	RSA GmbH, Rohde Technics, VR Zahlungssysteme, VKA, Paper24 (named by Klaro, klaro.org)
Standards supported	No TCF registration; no GPP found; Consent Mode v2
Last verified	9 November 2026

What it does

A consent management platform (CMP) does two jobs. It asks visitors for consent and blocks scripts until they agree. In advertising, it also writes a consent string in a standard format so that ad tech partners can read the choice. Klaro and Orejime do the first job well. They do not do the second.

Klaro comes from KIProtect, a Berlin company that funds the open-source code by selling hosted plans with server-side features (Klaro pricing). The library supports 23 languages and weighs about 50 kB compressed, according to its site (company claims, klaro.org). It has about 1,500 stars and 297 forks on GitHub (GitHub, kiprotect/klaro).

Orejime began as a fork of Klaro and is now maintained by Boscop in France (Orejime README). Its focus is accessibility. The project says it is tested against RGAA, the French accessibility standard, and ships a theme for the French state design system, DSFR (Orejime site). It claims a size under 15 kB.

How it works

Both tools work in the browser. You list your "purposes" or "services", such as analytics or video embeds, in a configuration file. You mark the matching script tags so they do not run on page load. When a visitor consents, the library turns those tags back on and saves the choice in a cookie. Klaro's paid service adds stored consent records and a scanner; the free code has no server part (Klaro pricing).

Neither tool writes a TC String or a GPP string. We found no TCF or GPP feature in either project's README or site. They are also missing from IAB Europe's list of 201 active CMPs and from Google's list of 145 certified CMPs (IAB Europe CMP list; Google Ad Manager Help).

9 of 9 rows

Density


IAB Europe TCF registration	Not registered	Not registered	IAB Europe CMP list, 5 November 2026
TCF v2.3 and v2.4	Not applicable: no TCF strings	Not applicable: no TCF strings	Klaro README; Orejime README
GPP sections	None found	None found	same
Google certified CMP (EEA, UK, Switzerland)	Not listed	Not listed	Google Ad Manager Help
Google Consent Mode v2	Supported through Google Tag Manager since a tutorial update of 21 March 2024; not a Google CMP partner	n/d; not a Google CMP partner	Klaro blog; Google CMP Partner Program
Platforms	Web	Web	READMEs
Hosting and data residency	Your own server, KIProtect's CDN or KIProtect's hosted service (location n/d)	Your own server or a public CDN	Klaro README; Orejime README
Latest release	0.7.21, 26 March 2024	3.2.1, 3 August 2026	npm, klaro; npm, orejime
Licence	BSD-3-Clause	BSD-3-Clause	npm registry

IAB Europe TCF registration

Klaro: Not registered
Orejime: Not registered
Source: IAB Europe CMP list, 5 November 2026

TCF v2.3 and v2.4

Klaro: Not applicable: no TCF strings
Orejime: Not applicable: no TCF strings
Source: Klaro README; Orejime README

GPP sections

Klaro: None found
Orejime: None found
Source: same

Google certified CMP (EEA, UK, Switzerland)

Klaro: Not listed
Orejime: Not listed
Source: Google Ad Manager Help

Google Consent Mode v2

Klaro: Supported through Google Tag Manager since a tutorial update of 21 March 2024; not a Google CMP partner
Orejime: n/d; not a Google CMP partner
Source: Klaro blog; Google CMP Partner Program

Platforms

Klaro: Web
Orejime: Web
Source: READMEs

Hosting and data residency

Klaro: Your own server, KIProtect's CDN or KIProtect's hosted service (location n/d)
Orejime: Your own server or a public CDN
Source: Klaro README; Orejime README

Latest release

Klaro: 0.7.21, 26 March 2024
Orejime: 3.2.1, 3 August 2026
Source: npm, klaro; npm, orejime

Licence

Klaro: BSD-3-Clause
Orejime: BSD-3-Clause
Source: npm registry

Download JSON

Table by AdSovereign, CC BY 4.0.

Can you use them with programmatic ads?

5 of 5 rows

Density


Site with analytics and embeds, no ads	Yes	Script blocking and a consent record in a cookie cover the need
Google Ads or GA4 measurement only	Klaro, with Consent Mode v2 via GTM	Klaro documents the four Consent Mode v2 signals
Ad Manager, AdSense or AdMob ads to EEA, UK or Swiss users	No	Google requires a certified CMP that is integrated with the TCF for personalised ads (Google)
Header bidding with TCF vendors	No	Bidders expect a TC String; neither tool writes one
US programmatic with state opt-outs	No	Neither writes GPP strings for US sections

Site with analytics and embeds, no ads

Klaro or Orejime fit?: Yes
Why: Script blocking and a consent record in a cookie cover the need

Google Ads or GA4 measurement only

Klaro or Orejime fit?: Klaro, with Consent Mode v2 via GTM
Why: Klaro documents the four Consent Mode v2 signals

Ad Manager, AdSense or AdMob ads to EEA, UK or Swiss users

Klaro or Orejime fit?: No
Why: Google requires a certified CMP that is integrated with the TCF for personalised ads (Google)

Header bidding with TCF vendors

Klaro or Orejime fit?: No
Why: Bidders expect a TC String; neither tool writes one

US programmatic with state opt-outs

Klaro or Orejime fit?: No
Why: Neither writes GPP strings for US sections

Download JSON

Table by AdSovereign, CC BY 4.0.

Pricing

Both libraries are free under the BSD-3 licence, for commercial and non-commercial use. Klaro's hosted plans add consent records, URL scans and more "privacy managers". Billed annually, they cost €19 (Startup), €79 (Company) and €239 (Group) a month; billed monthly, €25, €99 and €299 (Klaro pricing, accessed 9 November 2026). We found no paid plan for Orejime. Your real cost is developer time to configure and maintain the script list.

Strengths and limits

Strengths

No licence fee and full control. You can read, change and self-host every line of code.
No third-party consent server. Self-hosting keeps the banner script on your own domain, which suits strict public-sector rules.
Accessibility. Orejime is built and tested for screen readers and keyboards (Orejime site).

Limits

No TCF, no GPP. Neither can pass a valid consent signal to ad tech, so neither fits an ad-funded site in Europe or US programmatic.
Not Google certified. That blocks personalised Google ads in the EEA, the UK and Switzerland.
Klaro's release pace has slowed. Its latest npm release dates from 26 March 2024 (npm), while Orejime shipped 3.2.0 and 3.2.1 in 2026.
Manual upkeep. You must track every new tracker yourself, and rules differ by country; see cookie banner rules by country.

Alternatives

Usercentrics and Cookiebot: free tiers for small sites, with TCF on paid plans from €30 (Usercentrics) or Premium (Cookiebot).
InMobi CMP (formerly Quantcast Choice): a free, TCF-registered and Google certified tier for publishers.
Osano: a commercial CMP with a free tier for low-traffic sites.

If you move to a TCF CMP later, check its output with the TCF consent string decoder. GPP and TCF implementation for engineers shows what ad tech expects. More pages sit on the identity and privacy hub.

What we could not verify

Where KIProtect hosts its paid Klaro service and its consent records.
Whether KIProtect still develops the open-source Klaro code. GitHub shows no release date, and npm shows no release since March 2024.
Usage numbers for either project beyond GitHub stars.
Whether Orejime has any documented Google Consent Mode support.

FAQ

Is Klaro an IAB TCF CMP?

No. Klaro does not appear on IAB Europe's CMP list of 5 November 2026, and its code does not write TC Strings (IAB Europe CMP list). It can still manage cookie consent and send Google Consent Mode v2 signals through Google Tag Manager.

Can I use Orejime with Google ads in Europe?

Not for personalised Google ads served through Ad Manager, AdSense or AdMob in the EEA, the UK or Switzerland. Google requires a certified CMP integrated with the TCF there, and Orejime is not on Google's list (Google Ad Manager Help).

Is there a free CMP that is registered for the TCF?

Yes, but not open-source ones. InMobi CMP's Essentials tier is free and is registered as CMP 10, and Usercentrics and Cookiebot offer free plans without the TCF (IAB Europe CMP list).

Sources

IAB Europe, CMP list (JSON, lastUpdated 5 November 2026). https://cmplist.consensu.org/v2/cmp-list.json
Google Ad Manager Help, "Google consent management requirements for serving ads in the EEA, the UK, and Switzerland" (certified CMP list, accessed 9 November 2026). https://support.google.com/admanager/answer/13554116
Google, "CMP Partner Program" (accessed 9 November 2026). https://cmppartnerprogram.withgoogle.com/
KIProtect, klaro.org home page (accessed 9 November 2026). https://klaro.org/
KIProtect, Klaro pricing (accessed 9 November 2026). https://klaro.org/pricing
KIProtect, "Klaro! and Google Consent Mode v2" (21 March 2024). https://klaro.org/blog/klaro-and-google-consent-mode-v
KIProtect, Klaro contact page (accessed 9 November 2026). https://klaro.org/company/contact
GitHub, kiprotect/klaro repository (accessed 9 November 2026). https://github.com/kiprotect/klaro
npm registry, klaro package metadata (latest 0.7.21, 26 March 2024). https://registry.npmjs.org/klaro
GitHub, boscop-fr/orejime README (main branch, accessed 9 November 2026). https://raw.githubusercontent.com/boscop-fr/orejime/main/README.md

More sources (3)

GitHub, boscop-fr/orejime repository (accessed 9 November 2026). https://github.com/boscop-fr/orejime
npm registry, orejime package metadata (latest 3.2.1, 3 August 2026). https://registry.npmjs.org/orejime
Boscop, Orejime documentation site (accessed 9 November 2026). https://orejime.boscop.fr/

Changelog

9 November 2026: option profile drafted. Neither project registered with IAB Europe or certified by Google.

Author: Art Kukharenko, CEO, AdSovereign. Published: 10 November 2026. Last updated: 10 November 2026.

Spotted an error? Tell us