How should agencies price cookie compliance work into client retainers?

Cookie compliance is recurring work, not a one-time setup. Price it as an ongoing service line in the retainer: a defined scope of monitoring, reporting, and maintenance, tiered by site complexity, with the value made visible in every client review.

Stop selling it as a setup

The banner installation takes an afternoon. Everything after it takes years: monthly scans, new tag reviews, consent record keeping, policy updates, and re-testing whenever the client adds tools. Agencies that charge once for the setup end up doing the ongoing work for free or, worse, not doing it at all while the client assumes they are covered. The retainer is the right container because the risk is continuous: a site that was compliant in January drifts by June without anyone touching it.

Scope what the line item covers

A compliance retainer line should name concrete deliverables, not intentions. A workable scope covers scheduled scans with change reports, consent banner maintenance and updates, review of new tags and tools before they go live, an updated cookie policy on a cadence, and consent records stored for accountability. Say explicitly what it does not cover: it is not legal advice, and it does not cover data processing agreements or DPIAs unless you say so. Named deliverables make the line defensible when the client asks what they are paying for.

Tier by site complexity

Not every client site costs the same to keep compliant. A five-page brochure site with no marketing stack is a light tier: quarterly scans and an annual policy refresh. A content site with embeds, a tag manager, and a marketing team that adds tools monthly is a heavier tier: monthly scans, new-tag review SLAs, and quarterly reports. Tiers let you price honestly instead of averaging everyone to the same number, and they give clients a path to upgrade as their marketing grows.

Make the value visible

Recurring compliance work is invisible until it is missing, so the report is the product as far as the client is concerned. Send a short compliance summary on the cadence you promised: what was scanned, what changed, what was fixed, and the current status. Clients renew retainers they can see working. The ones who never hear about compliance assume it is not happening, and they are right to, because unmanaged compliance quietly lapses the moment attention moves elsewhere.