Consent Management (CMP)
Cookie Control
Provenance unknown Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: not determined
by Civic Computing Ltd · www.civicuk.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Cookie Control at a glance
- Vendor
- Civic Computing Ltd
- Headquarters
- Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 3 Nov 2026
- Panel verdict
- Cookie Control is a consent management product from Civic Computing Ltd; the captured homepage and privacy policy describe the vendor's own data practices, not the tool's behaviour toward visitors. how scores are made
- As of
- Vendor pages captured 3 Nov 2026; evaluated by the panel 3 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Cookie Control is a consent management product from Civic Computing Ltd; the captured homepage and privacy policy describe the vendor's own data practices, not the tool's behaviour toward visitors. On banner and choice, prior blocking, scanning and classification, consent records and standards and platforms, scores sit at 0 — we found no public information on the banner's choice architecture, pre-consent blocking, site scanning, a consent log a site owner could produce, or IAB TCF, Google Consent Mode and CMS integrations. The highest marks came on sovereignty, ranging 0 to 3: five of six judges scored 2 or 3, crediting the privacy policy's statement that anonymised website traffic information is hosted within the UK/EEA — the policy also states that no personal data or geolocation is collected from traffic tracking and that raw log files get no third-party access — while one judge scored 0, holding that it concerns the vendor's own analytics rather than the customer-facing consent chain. Too few criteria were evidenced for weighted totals. No prices appear; Stripe collects payments on the Cookie Control download page.
Speaks for it
- Privacy policy states anonymised website traffic information is hosted within the UK/EEA
- Vendor states no personal data or geolocation information is collected from website traffic tracking
- Vendor states log files are kept secure with no third-party access to raw log files
- Stripe collects payments on the Cookie Control download page, pointing to an online purchase flow
Held against it
- We found no public information on the banner's choice architecture — reject on the first layer, consent by category, or later withdrawal
- We found no public information on blocking of scripts, pixels or embedded content before consent
- We found no public information on site scanning, cookie classification or a self-updating cookie declaration
- We found no public information on consent records a site owner could produce or export
- We found no public information on IAB TCF registration, Google Consent Mode, CMS plugins or an API
Best for
- You weigh a vendor's own data-handling commitments — UK/EEA hosting of its anonymised traffic analytics, no personal data from traffic tracking — ahead of documented product behaviour.
- You are prepared to obtain banner, blocking and platform details directly from the vendor, using the public pages only as a first screen.
Avoid if
- You need public documentation that scripts and embedded content stay blocked until a visitor consents.
- You must produce a consent log with retention and export for a supervisory authority.
- Your ad stack or CMS depends on documented IAB TCF, Google Consent Mode or plugin support.
- You require a published data processing agreement and subprocessor list before a script runs on your site.
The scores
Prior blocking & script control
n/r
n/r
n/r
n/r
n/r
n/r
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer not rated — no public information
We found no public information on blocking of scripts, cookies or embedded content before consent, tag-manager integration, or any method for the site owner to verify nothing loads before the click. Nothing loaded before the decision is my first requirement, and the captured pages leave it undocumented. 1 2
The Agency Developer not rated — no public information
We found no public information on automatic blocking of scripts, pixels and cookies, on content blockers for YouTube or Maps embeds, or on a Google Tag Manager template — the first things I check before rolling consent tooling across client sites. 1 2
The Publisher Marketing Lead not rated — no public information
We found no public information on blocking of scripts, pixels or embedded content before consent, tag-manager integrations, or any way for the site owner to verify nothing fires early. The captured pages describe the vendor's own payment session cookie and traffic data, not the product's script control. 1 2
The In-House Lawyer not rated — no public information
We found no public information on automatic blocking of scripts, pixels and cookies before consent, on placeholders for embedded videos or maps, on tag-manager or server-side tagging integration, or on any method for the site owner to verify that nothing loads early. The captured homepage and privacy policy contain no description of the technical blocking behaviour. 1 2
The WordPress Webmaster not rated — no public information
Nothing captured describes blocking of Google Analytics, reCAPTCHA, YouTube or Maps embeds before consent, tag-manager integration, or a way to test that nothing loads early — and automatic blocking that survives our plugin updates is exactly what I need. I found no public information on it. 1 2
The Skeptic not rated — no public information
We found no public information on automatic or manual blocking of scripts and cookies before consent, embeds and placeholders, tag-manager integration, or any way for the site owner to test that nothing fires early. "Cookie Control" is the product name on the captured pages, not a documented blocking method. 1 2
Scanning & cookie classification
n/r
n/r
n/r
n/r
n/r
n/r
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer not rated — no public information
We found no public information on a site scanner, scheduled rescans, a classification database, alerts on new or changed trackers, or a self-updating cookie declaration. A cookie list that matches the site cannot be assessed from the captured pages. 1 2
The Agency Developer not rated — no public information
We found no public information on a website scanner, a maintained cookie and service database, or a cookie declaration generated from a scan. Without that, I cannot tell how a tracker a client adds on a Friday would ever be flagged. 1 2
The Publisher Marketing Lead not rated — no public information
We found no public information on a site scanner, a maintained database classifying cookies and services, scheduled rescans, alerts on new trackers, or a self-updating cookie declaration. I cannot judge from the captured pages how the product learns what a site sets. 1 2
The In-House Lawyer not rated — no public information
We found no public information on a site scanner, scheduled rescans, a maintained database classifying cookies by purpose and lifetime, or a cookie declaration generated from scan results. For a site owner mapping obligations under the German digital-services rules, classification and disclosure are the backbone, and we found no public information on them. 1 2
The WordPress Webmaster not rated — no public information
I found no public information on a site scan, automatic classification of cookies into purposes and providers, or a cookie declaration that keeps itself up to date; the two pages I read do not describe the product finding our Analytics, Maps and reCAPTCHA tags on its own. 1 2
Consent records & proof
n/r
n/r
n/r
n/r
n/r
n/r
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer not rated — no public information
We found no public information on a consent log with per-visitor records, banner versions, retention, export, re-consent or proof of withdrawal. The privacy policy's mention of log files concerns the vendor's own website logs, not records of visitor choices on customer sites, so there is nothing here to answer a supervisory authority with. 1 2
The Agency Developer not rated — no public information
We found no public information on per-consent records, retention periods, export, or the banner version kept with each consent. The privacy policy's statements about log files concern the vendor's own traffic logging, not a consent log I could produce for a client or an auditor. 1 2
The Publisher Marketing Lead not rated — no public information
We found no public information on consent records — nothing on a per-consent log with time, pseudonymous ID and choices, banner versions, retention, export, or proof of withdrawal. The log-file statements captured concern the security of the vendor's own logs, not the consent trail a customer could show a supervisory authority. 1 2
The In-House Lawyer not rated — no public information
We found no public information on consent records — a log per consent with time, choices and the banner version shown, retention, export, or proof that withdrawal took effect. The privacy policy's statements about log files kept secure concern the vendor's own traffic logs, not records a customer could produce if a consumer group sued. 1 2
The WordPress Webmaster not rated — no public information
The privacy policy speaks of the vendor's own log files being kept secure with no third-party access to raw logs, but that concerns CIVIC's operations. I found no public information on consent records a site owner could produce — entries per consent, retention, export, or the banner version shown. 1 2
The Skeptic not rated — no public information
We found no public information on per-visitor consent records, retention, export, re-consent on changes, consent expiry or proof of withdrawal. The privacy policy does speak of log files kept secure with no third-party access, but in the context of website traffic tracking rather than a consent log the site owner could produce. 1 2
Frameworks, signals & platforms
n/r
n/r
n/r
n/r
n/r
n/r
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer not rated — no public information
We found no public information on the IAB framework with a registered CMP ID, Google Consent Mode v2, Microsoft or other advertising signals, US privacy signals, CMS plugins, app SDKs, multi-domain management or an API. No consent-signal pathway can be assessed from the captured pages. 1 2
The Agency Developer not rated — no public information
We found no public information on IAB TCF, Google Consent Mode, Microsoft UET, plugins for WordPress, TYPO3 or Shopify, app SDKs, or a JavaScript API. The platform story an agency depends on is not touched in the captured pages. 1 2
The Publisher Marketing Lead not rated — no public information
We found no public information on IAB TCF registration, Google Consent Mode v2, Google's CMP certification, Microsoft or other ad-platform signals, CMS plugins, or app SDKs. These are the make-or-break items for my news site's ad stack and the shop's conversion tracking, and none are described on the captured pages. 1 2
The In-House Lawyer not rated — no public information
We found no public information on IAB TCF registration, Google Consent Mode, Microsoft or other ad-platform signals, CMS plugins, app SDKs or an API. The captured homepage and privacy policy do not describe how a visitor's choice is passed on to tags or advertising platforms. 1 2
The WordPress Webmaster not rated — no public information
I found no public information on a WordPress plugin, IAB TCF registration, Google Consent Mode, app SDKs or an API in the captured pages; where the consent signal goes and where the product runs are not described. 1 2
European sovereignty
panel opinion
n/r
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
The privacy policy states that anonymised website traffic information is hosted within the UK/EEA and that no third party is given access to raw log files, with Stripe collecting payments on the download page. We found no public information on the contracting entity's jurisdiction, where the banner script is served or consent logs are stored, a data processing agreement, or the subprocessors behind hosting, delivery and scanning. A script that runs on every page of a customer's site needs that whole chain documented before I can accept it. 2
The Agency Developer
The privacy policy states anonymised website traffic information is "hosted within the UK/the European Economic Area (EEA)", that no personal data or geolocation is collected from traffic tracking, and that no third party gets access to raw log files, with Stripe named for payments. We found no public information on the contracting entity's jurisdiction, on where the banner script or any consent records are served and stored, on a data processing agreement, or on a fuller subprocessor list, so only part of the chain is addressed. 2
The Publisher Marketing Lead not rated — no public information
We found no public information on the contracting entity's jurisdiction, where the banner script is served or consent logs and scan results are stored, or the subprocessors behind the chain. The one residency statement captured — anonymised website traffic information hosted within the UK/EEA — concerns the vendor's own analytics rather than the customer-facing consent chain, and the remaining dimensions are unknown to us. 1 2
The In-House Lawyer
The privacy policy states that anonymised traffic analytics are hosted within the UK or the EEA, that the vendor's log files are kept secure with no third-party access, and that Stripe collects payments. We found no public information on the contracting entity's jurisdiction, on where the banner script is served or consent logs stored, on a data processing agreement, or on subprocessor locations. The UK/EEA statement covering the vendor's own analytics is the single European-residency signal in the chain, which leaves this barely above nothing for a group with shops in Germany, France and Austria. 2
The WordPress Webmaster
The privacy policy states that anonymised website traffic information is hosted within the UK/the European Economic Area, that CIVIC will not attempt to identify individual users and that no third party gets access to raw log files, with Stripe collecting payments on the download page. Beyond that, the contracting entity's jurisdiction, where the banner script and any consent data are served from, a data processing agreement and a subprocessor list are not shown, so I can credit only this narrow hosting statement. 1 2
The Skeptic
The only residency commitment in the captured material is that anonymised website traffic information is hosted within the UK/EEA; where the banner script is served and where any consent logs sit are not stated, no data processing agreement is documented, and the one third party visible in the chain is Stripe collecting payments via a session cookie. For a tool that sits on every page of a customer's site, one sentence about traffic statistics leaves the chain unaudited. 2
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
The one pricing-related fact is that Stripe collects payments on the Cookie Control download page, which shows an online purchase flow. We found no public information on prices per domain or licence, tier limits and overages, add-ons, minimum terms or agency terms in the captured pages, so no annual cost is computable from them. 1 2
The Agency Developer
The privacy policy shows payments are collected through Stripe on the Cookie Control download page, which points to a self-service purchase, but we found no public price figures, tier limits, page-view caps or terms on the captured pages. A buyer still cannot compute an annual cost from these pages. 1 2
The Publisher Marketing Lead not rated — no public information
We found no public information on prices, tiers, per-domain or licence costs, traffic or consent limits, or add-ons such as TCF, app SDKs or agency terms. The only pricing-related detail captured is that Stripe is used to collect payments on the Cookie Control download page, with no figures on the pages we read. 1 2
The In-House Lawyer not rated — no public information
We found no public information on prices, tier limits for page views or domains, add-ons, minimum terms or agency terms. The only payment-related statement on the captured pages is that Stripe is used to collect payments on the download page, which does not let me compute an annual cost for a known number of domains. 1 2
The WordPress Webmaster
The only purchase detail anywhere in the captured pages is that Stripe collects payments on the Cookie Control download page — no price per site, tier limits or contract term appear on the vendor homepage or privacy policy. I cannot compute an annual per-site cost from the public pages captured here, and that figure is what I would need before recommending anything. 1 2
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Cookie Control
Is Cookie Control European?
Not determined: the vendor’s pages as captured do not say where Cookie Control is based.
Where does Cookie Control store data?
Not stated on the vendor’s pages as of 3 Nov 2026.
Does Cookie Control have a free plan?
Not stated on the vendor’s pages as of 3 Nov 2026.
What are the best alternatives to Cookie Control?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Cookie Control alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 3 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (civicuk.com, civicuk.com/privacy). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 2 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (2)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page www.civicuk.com Checked 3 Nov 2026 Details →
- 2 Privacy policy — found from the homepage www.civicuk.com Checked 3 Nov 2026 Details →