Choosing between an open-source CMP and a SaaS CMP is not simply a choice between free and paid.
The main differences concern how the software is installed, maintained and updated, the level of automation available and the dependency you are willing to accept on the provider.
tarteaucitron exists in both models. tarteaucitron.js is an open-source project under the MIT licence, while tarteaucitron Pro operates as a SaaS service. This gives me a fairly practical view of the advantages and constraints of both approaches.
An open-source CMP can operate without SaaS
The principle of a genuinely open-source CMP is that its code is available and can operate independently from the company or service that published it.
tarteaucitron.js can, for example, be downloaded from GitHub, installed on a server and used without a tarteaucitron.io Pro account.
The developer retains control over the files loaded by the website. The code can be inspected, modified and updated whenever the website owner decides.
This independence is one of the main advantages of open source.
Open source does not mean maintenance-free
That independence comes with an important counterpart: someone has to maintain the installation.
When a new release fixes a bug, improves a service or addresses a security issue, a self-hosted installation will not necessarily update itself.
This is sometimes overlooked because a JavaScript file can usually continue working for a very long time. An old version may therefore remain in production for years without causing an obvious error.
Working and being properly maintained are two different things.
SaaS transfers part of that responsibility
A SaaS CMP can handle a significant part of maintenance. A script loaded from the provider’s infrastructure can be fixed and updated without requiring manual intervention on every website.
This is one of the main advantages of tarteaucitron Pro. When a fix needs to be deployed, it can be applied through the CDN and reach websites using the service without requiring them to download a new archive.
For an agency managing dozens or hundreds of websites, the difference quickly becomes significant.
I discuss this in detail in my article about maintenance in tarteaucitron open source and Pro.
SaaS also enables more automation
Maintenance is not the only difference. A SaaS product has remote infrastructure that can provide additional services such as an online console, scanning, statistics, synchronization or rules maintained by the provider.
With tarteaucitron Pro, this difference notably includes the online console and automatic service detection.
In the open-source version, integration is more manual. The developer declares the services being used and adapts the website accordingly.
Both approaches pursue the same general objective, but the amount of work required is different.
Open source allows code auditing
For a tool responsible for controlling third-party services and data flows, being able to inspect the code has particular value.
It is possible to see precisely what the CMP does, which requests it triggers and how it decides whether to load or block a service.
Publishing the code also allows security researchers and independent developers to report issues.
This obviously does not mean that open-source software is automatically secure. Code visibility only has value when the project is actively maintained and fixes are subsequently installed.
SaaS introduces an additional dependency
When a CMP depends on a SaaS service, the website also depends on the provider’s infrastructure and decisions.
An outage, pricing change, modification of terms or discontinuation of the service can affect users.
This is not specific to CMPs. It is the standard trade-off of many online services: less local maintenance in exchange for greater dependency on the provider.
That dependency should simply be considered as part of the technical decision rather than treating SaaS as an invisible abstraction.
Open-source software can also depend on remote services
The words “open source” alone are therefore not enough to determine a product’s actual architecture.
Software may publish part of its code while remaining dependent on a proprietary API that is essential to its operation. Conversely, a project may be genuinely usable on its own.
When an organization wants an open-source CMP for technical control or sovereignty reasons, I would therefore check what happens if every service operated by the provider becomes unavailable.
Does the CMP continue to work? Can it be hosted elsewhere? Are all required files actually available?
Free and open source are not synonyms
A SaaS CMP can provide a free plan without being an open-source CMP.
In that case, the provider simply allows its service to be used within certain limits, such as pageviews, domains, features or scans.
The service remains hosted and controlled by the provider.
Conversely, open-source software may be free to use while paid services are offered around hosting, automation, support or maintenance.
Comparing only the initial price therefore hides much of the actual difference.
The cost of open source is not always zero
Free software can require development and maintenance time.
If a developer spends two hours integrating a CMP manually and then needs to check new versions regularly, that time has a cost even if no licence invoice is received.
For a personal website or a developer already familiar with the tool, that cost may be negligible. For an agency with hundreds of websites, it can become much greater than the cost of a SaaS product.
This is why I never present tarteaucitron Pro as a version that suddenly makes something possible that the open-source version cannot do. Its main purpose is to automate and simplify maintenance.
SaaS is not automatically easier technically
The opposite assumption should also be avoided. Paying for a SaaS CMP does not guarantee a correct implementation.
The main script still needs to be positioned correctly. Services need to be identified. Google Tag Manager integrations need to be understood and trackers must actually wait for consent when required.
A loading-order mistake can make a paid CMP ineffective just as easily as an open-source CMP.
In both cases, I therefore recommend checking the result directly with DevTools.
When should you choose an open-source CMP?
Open source is particularly useful when a developer controls the integration, wants to control hosting and is willing to manage updates.
It is also a coherent choice for an organization that wants to audit the code or avoid making a fundamental function such as consent entirely dependent on a remote provider.
For a small number of websites with a stable configuration, maintenance can remain very reasonable.
When should you choose a SaaS CMP?
SaaS becomes attractive when automation, centralized maintenance or additional features save more time than the subscription costs.
This is particularly visible with multiple websites. Manually updating a CMP on two websites is one thing; guaranteeing the same maintenance across two hundred websites is another.
SaaS may also be necessary when a project requires features that inherently rely on remote infrastructure, such as regular scans, centralized reports, synchronization or large-scale configuration management.
The best model mainly depends on who handles maintenance
I therefore do not consider SaaS an evolution that makes open source obsolete. The two models address different requirements.
With open source, control and part of the responsibility remain with the user. With SaaS, part of that responsibility is delegated to the provider in exchange for a subscription and an additional dependency.
The most useful question is ultimately very simple: who will make sure in two years that the CMP installed today is still properly configured and up to date?
The answer to that question often helps more when choosing between open source and SaaS than a long feature list.
