# Cookie Control — Consent Management (CMP)

Cookie Control by Civic Computing Ltd is not rated: too little public evidence for stars, as of 2026-11-03. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: Civic Computing Ltd (https://www.civicuk.com)
- Category: [Consent Management (CMP)](https://whats-best.ai/software/consent-management.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/consent-management/cookie-control
- Alternatives: https://whats-best.ai/software/consent-management/cookie-control/alternatives ([markdown](https://whats-best.ai/software/consent-management/cookie-control/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-11-03 · oldest source captured 2026-11-03

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Civic Computing Ltd
- Headquarters: Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 3 Nov 2026

## The panel's verdict

Cookie Control is a consent management product from Civic Computing Ltd; the captured homepage and privacy policy describe the vendor's own data practices, not the tool's behaviour toward visitors. On banner and choice, prior blocking, scanning and classification, consent records and standards and platforms, scores sit at 0 — we found no public information on the banner's choice architecture, pre-consent blocking, site scanning, a consent log a site owner could produce, or IAB TCF, Google Consent Mode and CMS integrations. The highest marks came on sovereignty, ranging 0 to 3: five of six judges scored 2 or 3, crediting the privacy policy's statement that anonymised website traffic information is hosted within the UK/EEA — the policy also states that no personal data or geolocation is collected from traffic tracking and that raw log files get no third-party access — while one judge scored 0, holding that it concerns the vendor's own analytics rather than the customer-facing consent chain. Too few criteria were evidenced for weighted totals. No prices appear; Stripe collects payments on the Cookie Control download page.

**Speaks for it:**
- Privacy policy states anonymised website traffic information is hosted within the UK/EEA
- Vendor states no personal data or geolocation information is collected from website traffic tracking
- Vendor states log files are kept secure with no third-party access to raw log files
- Stripe collects payments on the Cookie Control download page, pointing to an online purchase flow

**Held against it:**
- We found no public information on the banner's choice architecture — reject on the first layer, consent by category, or later withdrawal
- We found no public information on blocking of scripts, pixels or embedded content before consent
- We found no public information on site scanning, cookie classification or a self-updating cookie declaration
- We found no public information on consent records a site owner could produce or export
- We found no public information on IAB TCF registration, Google Consent Mode, CMS plugins or an API

**Best for:**
- You weigh a vendor's own data-handling commitments — UK/EEA hosting of its anonymised traffic analytics, no personal data from traffic tracking — ahead of documented product behaviour.
- You are prepared to obtain banner, blocking and platform details directly from the vendor, using the public pages only as a first screen.

**Avoid if:**
- You need public documentation that scripts and embedded content stay blocked until a visitor consents.
- You must produce a consent log with retention and export for a supervisory authority.
- Your ad stack or CMS depends on documented IAB TCF, Google Consent Mode or plugin support.
- You require a published data processing agreement and subprocessor list before a script runs on your site.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Data Protection Officer | The Agency Developer | The Publisher Marketing Lead | The In-House Lawyer | The WordPress Webmaster | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Banner & choice architecture | n/r | n/r | n/r | n/r | n/r | n/r |
| Prior blocking & script control | n/r | n/r | n/r | n/r | n/r | n/r |
| Scanning & cookie classification | n/r | n/r | n/r | n/r | n/r | n/r |
| Consent records & proof | n/r | n/r | n/r | n/r | n/r | n/r |
| Frameworks, signals & platforms | n/r | n/r | n/r | n/r | n/r | n/r |
| European sovereignty | 1/5 | 1.5/5 | n/r | 1/5 | 1/5 | 1.5/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **—** | **—** | **—** | **—** | **—** | **—** |

### The judges

- **The Data Protection Officer** (v1.0): External DPO for a dozen mid-sized companies, two of which received a letter from a state supervisory authority about their cookie banner last year. Wants reject on the first layer, nothing loaded before the click, a consent log that shows which banner version each visitor saw, a cookie list that matches the site, and a DPA and subprocessor list that keep visitor data in the EU.
- **The Agency Developer** (v1.0): Lead developer at a web agency that maintains forty client sites on WordPress, TYPO3 and Shopify. Wants one account for every client, blocking that works without rewriting each theme, content blockers for YouTube and Maps, a Tag Manager template, a scanner that flags the tracker a client added on Friday, and a JavaScript API documented well enough that forms and plugins can ask for consent.
- **The Publisher Marketing Lead** (v1.0): Runs marketing for an ad-funded news site and an online shop in the same group, where every point of consent rate shows up in ad revenue and in Google Ads conversions. Wants a registered IAB TCF CMP, Google Consent Mode v2 in advanced mode, banner tests within what the law allows, consent shared between the site and the app, and a dashboard that shows where visitors drop off.
- **The In-House Lawyer** (v1.0): In-house counsel at a retailer with shops in Germany, France and Austria, who has read the court decisions on missing reject buttons and the regulators' banner guidance. Wants § 25 TDDDG and the GDPR mapped to concrete settings, equal-weight choices as the default, consent that can be withdrawn as easily as it was given, and records that would hold up if a competitor or a consumer group sued.
- **The WordPress Webmaster** (v1.0): Looks after the WordPress site of a mid-sized engineering company on top of the actual job, with Google Analytics, a YouTube channel, a Maps embed and a contact form with reCAPTCHA. Wants a plugin that finds these by itself, blocks them until the visitor agrees, survives the next plugin update and caching, and costs a known amount per site per year without a call to sales.
- **The Skeptic** (v1.0): Has opened the browser's network tab on sites with a "certified" banner and watched the ad pixels fire before anything was clicked. Reads "consent rate optimisation" as a hint that reject will be grey and small, "auto-blocking" as a claim until the test steps are published, and "EU hosting" next to a US script CDN — and asks what leaving would cost: the consent logs, and every visitor asked again.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Stripe payments: Stripe used to collect payments on the Cookie Control download page [S2]

**Data**
- No personal collection: No personal data or geolocation information collected from website traffic tracking [S2]
- Third party log access: Log files kept secure; no third-party access to raw log files [S2]
- User identification: CIVIC will not attempt to identify individual users except on reasonable suspicion of unauthorised access attempts [S2]

**Hosting**
- Analytics residency: Anonymised website traffic information is hosted within the UK/EEA [S2]

## Questions

### Is Cookie Control European?

Not determined: the vendor’s pages as captured do not say where Cookie Control is based.

### Where does Cookie Control store data?

Not stated on the vendor’s pages as of 3 Nov 2026.

### Does Cookie Control have a free plan?

Not stated on the vendor’s pages as of 3 Nov 2026.

### What are the best alternatives to Cookie Control?

As of 3 Nov 2026, the panel rates [Usercentrics CMP (3.5/5)](https://whats-best.ai/software/consent-management/usercentrics), [Didomi (3.5/5)](https://whats-best.ai/software/consent-management/didomi) and [CCM19 (3.5/5)](https://whats-best.ai/software/consent-management/ccm19) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Usercentrics CMP](https://whats-best.ai/software/consent-management/usercentrics) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Cookie Control alternatives](https://whats-best.ai/software/consent-management/cookie-control/alternatives).

## What this page leaves out

- We found no public information on pricing on the pages we read (civicuk.com, civicuk.com/privacy). If the vendor publishes it somewhere else, send us the page.
- 2 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.

## Sources

- [S1] Vendor page: https://www.civicuk.com (checked 2026-11-03)
- [S2] Privacy policy — found from the homepage: https://www.civicuk.com/privacy (checked 2026-11-03)

---

Cite as: whats-best.ai, "Cookie Control — Consent Management (CMP)", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/consent-management/cookie-control

Corrections: https://whats-best.ai/correct/1376?target=page