Consent Management (CMP)
Cookie Information
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Cookie Information A/S · cookieinformation.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Cookie Information at a glance
- Vendor
- Cookie Information A/S
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention Netherlands source, captured 29 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates Cookie Information 3.5/5, the mean of 6 judges. Cookie Information A/S — a Copenhagen-based consent management platform (Danish CVR 38758292) with data on Microsoft Azure in the Netherlands — drew persona-weighted totals from 6.0 to 6.7; no criterion spans more than a point. how scores are made
- As of
- Vendor pages captured 29 Oct 2026 to 1 Nov 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Cookie Information A/S — a Copenhagen-based consent management platform (Danish CVR 38758292) with data on Microsoft Azure in the Netherlands — drew persona-weighted totals from 6.0 to 6.7; no criterion spans more than a point. The most concrete praise lands on pricing transparency and standards and platforms: Essential from €19.50/month per domain and Business from €36/month per domain, a consent ladder from €9 to €269 per month above 25,000 included monthly consents on single-module plans, IAB TCF v2.2 with an IAB-approved template, and Google Consent Mode v2 in basic and advanced mode under Google CMP Gold Partner certification. The weakest criterion is consent records, which holds the lowest score awarded: consents are stored on EU/EEA servers with timestamps, versioning and export, but the judges found no public information on log retention, a visitor-lookup consent ID, or API access to records. Sovereignty runs 6-7: higher scores weigh the Danish entity, Azure Netherlands hosting and standard contractual clauses; lower ones cite a general authorization to engage subcontractors without limitation in scope or geography and certifications that belong to Azure's cloud.
Speaks for it
- Two plans priced publicly per domain — Essential from €19.50/month and Business from €36/month — with consent overage banded from €9 to €269 per month above the 25,000 monthly consents included on single-module plans.
- IAB TCF v2.2 support with an IAB-approved template and automatic stub installation, usable alongside Google Consent Mode v2 in basic and advanced mode under Google CMP Gold Partner certification.
- First-party cookie autoblocking plus a Cookie Control SDK for third-party cookies, with an official Google Tag Manager guide that fires tags only after per-category consent.
- A crawler that walks the site page by page from the root, adds new cookies to the consent popup automatically, and updates the cookie policy itself.
- Consents stored on EU/EEA servers with timestamps, versioning and export, plus documented re-consent triggers for new categories, changed purposes or changed legal basis.
Held against it
- The judges found no public information on a retention period for consent logs, a consent ID visitors can look up, or search and export through an API.
- The terms grant general authorization to engage subcontractors without limitation in scope or geography, and the judges found no published subprocessor list with locations.
- No public prices for the named add-ons (Expert Scanning, Managed Compliance, Mobile SDKs) or custom plans, and no public figure for the monthly action limit consents count toward on Business and Enterprise.
- We found no public information on whether reject sits with equal weight to accept on the first banner layer, on A/B testing and its limits, or on a documented way to verify that nothing loads before consent.
- The certifications listed (ISO 27001, SOC and more) describe the Azure infrastructure rather than the vendor's own scope.
Best for
- You run WordPress or Drupal sites and want banner, blocking and scanning live without a developer — plugins or a single code snippet are documented, with placeholders for videos, maps, login and newsletter forms.
- Your advertising stack runs on Google and IAB TCF — Consent Mode v2 signals flow to Google Ads and GA4 from day one, and TCF v2.2 can be used alongside it.
- You need to budget the year from public pages — per-domain prices, a consent-volume ladder, a disclosed 4% annual increase and 30-day cancellation terms on yearly plans.
- You want to test before committing — a 14-day free trial with no credit card required, and integrations available during the trial.
Avoid if
- Your procurement requires tight subprocessor control — the terms grant general authorization to engage subcontractors without limitation in scope or geography.
- You need contractually fixed pricing — subscription fees adjust automatically by 4% each year without prior notice, renew automatically with 30 days' notice, and are non-refundable once paid.
- Your data-chain policy rules out US-processed services — the privacy policy names third-party providers established outside the EEA including the US, one supporting AI-based customer service, and checkout/billing may be processed via Paddle.
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 3.5 of 5 |
| Prior blocking & script control | 3.5 of 5 |
| Scanning & cookie classification | 3 of 5 |
| Consent records & proof | 3 of 5 |
| Frameworks, signals & platforms | 3.5 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 3.5 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Non-necessary cookies are stated to be blocked before consent, with automatic first-party cookie blocking, an SDK for third-party blocking, placeholders with editable copy for YouTube, maps and forms, and documented Google Tag Manager triggers plus a JavaScript consent API and data-layer events. For a signature I would want a documented way to verify on the live site that nothing loads early and some word on server-side tagging; we found no public information on either. 1 2 11 12 15
The Agency Developer
Exactly what I need across client themes: first-party cookie autoblocking plus a Cookie Control SDK for third-party blocking, placeholders for YouTube, Vimeo, maps, booking widgets and newsletter forms with editable copy, and an official Google Tag Manager guide that fires tags per consented category with data-layer events and a documented window.CookieInformation API for forms. We found no public information on server-side tagging support or on browser-testing instructions that nothing loads before consent. 1 11 12 15
The Publisher Marketing Lead
Automatic blocking is documented — first-party cookies via autoblocking and third-party via the Cookie Control SDK, with non-necessary cookies blocked before consent — plus placeholders for YouTube, Vimeo, maps, login forms and booking widgets with editable copy and a JavaScript API, and a Google Tag Manager setup where tags fire only after per-category consent events hit the data layer. We found no public information on server-side tagging or a documented browser check that nothing loads early. 1 11 12 15
The In-House Lawyer
Blocking before consent is documented with a first-party autoblocking feature plus a Cookie Control SDK for third-party cookies, an official Google Tag Manager guide that fires tags only after consent per category, consent events pushed to the data layer, and a JavaScript event and API driving placeholders over videos, maps, forms and widgets with editable copy. The audit-trail claim and the flagging of hidden scripts add confidence that the blocking is taken seriously. We found no public information on server-side tagging support or on a documented way for the site owner to verify on the live site that nothing loads before consent. 1 2 11 12 15
The WordPress Webmaster
Non-necessary cookies are blocked before consent via a first-party autoblocking feature plus a Cookie Control SDK for third-party cookies, and placeholders are documented for exactly my use cases — YouTube or Vimeo videos, maps, login and newsletter forms — with editable copy and a JavaScript API, a consent event and Google Tag Manager data-layer pushes to wire up anything else. The Tag Manager guide describes controlling tag firing per consented category. We found no public information on server-side tagging, consent passed to CAPTCHAs specifically, or a documented way to test that nothing loads before consent. 1 11 12 15
The Skeptic
Autoblocking for first-party cookies and a Cookie Control SDK for third-party ones are documented, with placeholder guides for YouTube, maps, login forms and newsletter signups wired through a JavaScript API, a consent event and GTM data-layer pushes, and a GTM guide explaining triggers so tags fire only after consent. That is more than a banner. We found no public information on server-side tagging or on a documented way for the site owner to test that nothing loads before consent — until those test steps are published, the promise that cookies are blocked before consent stays a claim I cannot verify from the pages. 1 2 11 12 15
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
A crawler works through the site page by page from the root with a stated depth of 500 subpages on the entry plan, on weekly, daily or on-demand schedules up to three times a day, new cookies are added to the consent popup automatically, the cookie policy updates itself, and a compliance dashboard surfaces unclassified cookies for manual review rather than silently classifying them. We found no public information on scanning behind logins, on local storage and pixels, or on exportable scan reports for an audit file. 2 5 13 14 15
The Agency Developer
The crawler walks the site like a user, scans run weekly (daily on custom plans) with configurable depth — 500 subpages on Essential — plus on-demand scans up to three a day, automatic classification, new cookies pushed into the banner, and a dashboard flagging unclassified cookies with editable purposes, descriptions and data processors. We found no public information on scanning local storage or pixels, scanning behind logins, email alerts on new trackers, or exportable scan reports. 2 5 13 14 15
The Publisher Marketing Lead
The crawler walks the site page by page from the root, scanning depth is set in pages (500 subpages on the entry tier) and frequency weekly or daily, on-demand scans run up to three a day, new cookies land in the popup automatically, the cookie policy updates itself, and a compliance dashboard flags domains with unclassified cookies. We found no public information on scanning local storage or pixels, and the captured pages say only public domains are scanned. 2 13 14 15 17
The In-House Lawyer
A web crawler checks the site page by page with configurable depth and frequency (the entry tier is described as 500 subpages scanned weekly), on-demand scans are possible up to three a day, new cookies are added automatically to the banner, the cookie policy updates itself, and a compliance dashboard surfaces domains with unclassified cookies so they are moved into categories by hand rather than silently classified — the review-before-classification discipline I want. We found no public information on scanning of local storage and pixels, scanning behind logins or in different regions, email alerts on new trackers, or a published classification database with purposes, providers and lifetimes. 2 5 13 14 15
The WordPress Webmaster
A web crawler walks the site from the root like a normal user, page by page, with configurable depth (500 subpages on the entry plan) and frequency from weekly to daily, plus on-demand scans three times a day; new cookies are added to the consent popup automatically, the cookie policy updates itself, and a compliance dashboard flags domains with unclassified cookies, with a cookie management section to edit purpose, description and data processor. That is the finds-it-by-itself behaviour I want for Analytics, YouTube and Maps. We found no public information on scanning local storage or pixels, a maintained vendor database with purposes and lifetimes, or email alerts on new trackers. 2 13 14 15
The Skeptic
The crawler is described concretely: it starts at the root domain, clicks through pages, runs weekly or daily with configurable depth (500 subpages on the Essential plan), allows three on-demand scans a day, and new cookies are added to the popup automatically while the cookie policy updates itself. A compliance dashboard flags domains with unclassified cookies for review rather than silently filing them, which is the right instinct. We found no public information on scanning behind logins, on local storage and pixels as well as cookies, or on email alerts when trackers change. 2 5 13 14 15 17
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
Every consent is stated to be stored on EU/EEA servers with timestamps, versioning and export, consent changes are defined as recorded events, and the support centre documents exactly when visitors must be asked again after changes to categories, purposes or legal basis. What a supervisory authority asks me for — the exact banner version and texts each visitor saw, how long the consent log itself is kept, and a consent ID the visitor can look up — we found no public information on. 2 3 6 9
The Agency Developer
Every consent is stored on EU servers with timestamps, versioning and export, a complete audit trail is claimed from day one, consent changes are recorded events, and documented triggers tell the site owner when to ask again. We found no public information on the retention period for consent records, a consent ID visitors can look up, withdrawal logged as its own event, or search and export through an API. 1 2 3 6 9
The Publisher Marketing Lead
Every consent is stored on EU/EEA servers with timestamps, versioning and export — the audit story I want when a supervisory authority calls — and consent changes are recorded as their own events, with documented triggers for asking visitors again and a machine-readable one-time export before a term ends. We found no public information on how long consent records are kept, a consent ID visitors can look up, or searching the log through an API. 2 3 6 9
The In-House Lawyer
Every consent is described as stored on EU/EEA servers with timestamps, versioning and export, consent changes are defined as recorded events, and re-consent triggers on new categories, changed purposes or a changed legal basis are documented — the skeleton of the proof I would need if a consumer group sued. I read the audit-readiness claim as directed at exactly that scenario. We found no public information on a stated retention period for consent logs, a pseudonymous ID per record, a consent ID the visitor can look up, or tamper-evidence of the log. 1 2 3 6 9
The WordPress Webmaster
Every consent is stored on EU/EEA servers with timestamps, versioning and export, positioned for audit readiness, and the help centre documents exactly when consent must be reset (new categories, changed purposes or legal basis) plus how to handle audits. Consent changes are recorded as events. We found no public information on a retention period for the consent log itself, a consent ID the visitor can look up, configurable expiry, or search and export through an API. 2 3 9 15
The Skeptic
Every consent is stated to be stored on EU/EEA servers with timestamps, versioning and export, and the re-consent triggers (new categories, changed purposes or legal basis) are documented precisely. The deeper proof a dispute would need is thin: we found no public information on a retention period for consent records, a consent ID the visitor can look up, withdrawal recorded as its own event, or search and export through an API. "Versioning" is asserted without detail on whether the exact banner texts are kept with each record. 2 3 6 9
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
IAB TCF v2.2 with an IAB-approved template, an automatically installed TCF stub and a configurable vendor list, Google Consent Mode v2 in both basic and advanced mode with Gold CMP partner certification, mobile SDKs for iOS, Android, Flutter, Xamarin and React Native, and WordPress, Drupal and Tag Manager integrations cover most of a modern stack. A registered CMP ID, Microsoft and US-state signals such as GPP, and a REST configuration API are what we found no public information on. 3 4 12 16 17
The Agency Developer
TCF v2.2 ships with an IAB-approved template, automatic stub installation and a configurable vendor list; Consent Mode v2 works in basic and advanced mode under Google CMP Gold Partner certification, with WordPress and Drupal plugins, mobile consent across iOS, Android, Flutter, Xamarin and React Native, and a documented JavaScript API. For my TYPO3 and Shopify clients I found no plugins named on the captured pages — the list covers WordPress and Drupal plus guides for Umbraco, HubSpot, Wix and Squarespace — and we found no public information on a registered CMP ID, Microsoft UET consent mode, GPP or GPC, connected TV, or a REST API. 2 3 4 5 12 16 17
The Publisher Marketing Lead
This is where my ad money lives and it delivers: IAB TCF v2.2 with an IAB-approved template and automatic stub install, custom vendor lists falling back to the global vendor list, Google Consent Mode v2 in both basic and advanced mode as a Google CMP Gold Partner with signals flowing to Google Ads and GA4, mobile SDKs for iOS, Android, Flutter, Xamarin and React Native, and plugins or guides for WordPress, Drupal, Optimizely, Wix and more. We found no public information on a registered IAB CMP ID number, Microsoft UET consent mode, GPP or GPC signals, or a REST API for configuration. 1 3 16 17
The In-House Lawyer
Google Consent Mode v2 in basic and advanced mode under Gold Partner certification, IAB TCF v2.2 with an IAB-approved template, an automatically installed TCF stub, custom vendor restrictions in JSON configuration, plugins and guides for WordPress, Drupal, Umbraco, HubSpot, Wix and Squarespace, and SDKs for iOS, Android, Flutter, Xamarin and React Native give me the signal coverage my advertising stack needs, with TCF and Consent Mode usable together. We found no public information on a registered IAB Europe CMP ID number, Microsoft UET consent mode, GPP or Global Privacy Control for US laws, or a REST API for configuration. 3 4 5 16 17
The WordPress Webmaster
WordPress and Drupal plugins, Google Tag Manager and a single code snippet get you running with no developer, and as a Google CMP Gold Partner Consent Mode v2 ships natively in both basic and advanced mode; IAB TCF v2.2 is supported with an IAB-approved template, the TCF stub installed automatically, and custom vendor lists configurable, while mobile SDKs cover iOS, Android, Flutter, Xamarin and React Native and a partner programme exists. We found no public information on a registered IAB CMP ID number, Microsoft UET consent mode, GPP or GPC signals for US laws, or a REST API for configuration. 2 3 4 16 17
The Skeptic
TCF v2.2 is documented properly — stub installed automatically, custom vendor lists via JSON configuration, local versus global scope, consent reset on version change — and Google Consent Mode v2 runs in both basic and advanced mode under a stated Google CMP Gold Partner certification, with mobile SDKs for iOS, Android, Flutter, Xamarin and React Native and guides for WordPress, Drupal, Optimizely, Wix, Squarespace and more. We found no public information on a registered IAB Europe CMP ID, Microsoft UET consent mode or other named ad-platform signals, GPP or GPC for US states, or a REST API for configuration. 1 2 3 4 16 17
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
The contracting entity is a Danish company (CVR 38758292, Copenhagen), data sits on Microsoft Azure in the Netherlands with data-centre moves restricted to the EU, consent records are stored in the EU/EEA, processor agreements exist with all processors, and third-country transfers rely on adequacy decisions or standard contractual clauses. The chain is what worries me: the terms grant a general authorisation to engage subcontractors without limitation in scope or geography, no subprocessor list with their locations is published, an affiliate is seated in the USA, and where the banner script itself is served from we found no public information. 1 3 6 7 8
The Agency Developer
The contracting entity is Cookie Information A/S in Copenhagen (Danish CVR 38758292), all data sits on Microsoft Azure in the Netherlands with a clause that any data-centre move stays inside the EU, consents are stored on EU/EEA servers, a data processing agreement covers all processors, and third-country transfers rely on adequacy decisions or standard contractual clauses; Piwik PRO A/S is named as sub-processor and Meta Ireland as joint controller. We found no public information on where the banner script is served from, on a published full subprocessor list with locations, or on certifications in the vendor's own name — the ISO and SOC listings shown belong to the Azure infrastructure. 3 6 7 8
The Publisher Marketing Lead
The chain is European where it counts for me: Cookie Information A/S in Copenhagen, all data hosted on Microsoft's data centre in the Netherlands with data-centre changes restricted to within the EU, consents stored on EU/EEA servers, processor agreements in place and third-country transfers covered by adequacy decisions or standard contractual clauses. The subprocessor picture is thinner — the terms authorise engaging subcontractors without limitation in scope or geography, and the published certifications (ISO 27001, SOC 2 and more) belong to the Azure cloud rather than the vendor. 3 6 7 8
The In-House Lawyer
The contracting entity is Danish (CVR 38758292, Copenhagen) with data hosted in a named Microsoft Azure data centre in the Netherlands, consent logs on EU/EEA servers, any change of data centre confined to the EU, transfers outside the EEA covered by adequacy decisions or standard contractual clauses, deletion and a machine-readable export at term end, and ISO 27001 and SOC certifications stated for the Azure cloud. Two points hold me back: the terms grant a general authorisation to engage subcontractors without limitation in scope or geography, and I found no published subprocessor list with their locations; the certifications also describe the cloud provider's coverage rather than the vendor's own scope. 1 3 6 7 8
The WordPress Webmaster
The contracting entity is Cookie Information A/S in Copenhagen with a Danish CVR number, data sits on a named Microsoft Azure data centre in the Netherlands, and consents are stored on EU/EEA servers; the privacy policy states data processor agreements with all processors and SCCs or adequacy decisions for transfers, with some providers outside the EEA including the US. Export and deletion on termination are documented in the terms. The certifications listed are the Azure cloud's rather than the vendor's own, and we found no published full subprocessor list with their locations, nor where the banner script itself is served from. 3 6 7 8
The Skeptic
The entity and hosting are on the record: Cookie Information A/S in Copenhagen with a Danish CVR, all data on Microsoft Azure in the Netherlands, consent logs on EU/EEA servers, datacentre moves restricted to within the EU, and standard contractual clauses or adequacy for third-country transfers. The chain has holes a buyer should weigh: the terms grant general authorization to engage subcontractors "without limitation in scope or geography", the privacy policy acknowledges providers established in the US including for AI-based support, billing may run through Paddle, only Meta Ireland and Piwik PRO are named as subprocessors, and we found no public information on where the banner script itself is served from. The certifications listed are Microsoft Azure's, not the vendor's own. 1 3 6 7 8
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
The two public plans start at €19.50 and €36 per domain per month, consent overage is priced in bands from €9 to €269 per month after 25,000 included consents, subdomains are counted as domains with pro-rated charges for added ones, and VAT treatment, the automatic 4% annual increase and the 30-day cancellation terms are all stated — a buyer can compute most of the annual cost from public pages. Expert Scanning, Managed Compliance and Mobile SDKs are named as add-ons without public prices, and Enterprise terms are agreed individually. 1 5 6
The Agency Developer
Essential is public at from €19.50/month per domain and Business at from €36/month per domain, with a priced consent ladder (€9 to €269 per month) above the 25,000 monthly consents included on single-module plans, pro-rated extra domains, subdomains counting as domains, a stated 4% automatic annual increase, thirty-day cancellation on yearly terms and VAT treatment spelled out. The Expert Scanning, Managed Compliance and Mobile SDK add-ons and the Business plan's monthly action limit are what we found no public prices or figures for, and the Partner Program exists without published agency pricing. 1 5 6
The Publisher Marketing Lead
I can compute most of my annual cost from public pages: Essential from €19.50/month per domain and Business from €36/month per domain, 25,000 consents a month included with a published ladder from €9/month up to €269/month above that, pro-rated extra domains, a stated overage rule, VAT treatment with EU reverse charge, and auto-renewal on 30 days' notice with a 4% annual increase. We found no public information on prices for the Expert Scanning, Managed Compliance and Mobile SDK add-ons, or on Enterprise pricing. 1 5 6
The In-House Lawyer
The core cost is computable from public pages: Essential from €19.50/month per domain and Business from €36/month per domain, 25,000 monthly consents included on single-module plans with overage banded from €9/month up to €269/month, extra domains pro-rated, cancellation and auto-renewal with 30 days' notice, VAT treatment including EU reverse charge, and a disclosed automatic 4% annual increase. The named add-ons Expert Scanning, Managed Compliance and Mobile SDKs are pointed to a pricing schedule without prices in the captured pages, custom plans and agency terms are on request, and the monthly action limits that consents count toward on Business and Enterprise are not quantified. 1 2 5 6
The WordPress Webmaster
I can price my one site from the public pricing page alone: Essential from €19.50/month per domain and Business from €36/month per domain, with 25,000 monthly consents included on single-module plans and every overage band priced in euros from €9/month up to €269/month; subdomains count as separate domains, extra domains on Essential are pro-rated, yearly cancellation needs 30 days' notice, a 4% automatic annual increase is stated, and VAT treatment and non-refundable fees are in the terms. Add-ons such as Expert Scanning, Managed Compliance and Mobile SDKs are named but we found no prices for them, and agency or reseller terms are unpriced on the captured pages. 1 5 6
The Skeptic
The public pages are unusually computable: Essential from €19.50/month per domain and Business from €36/month per domain, consent-volume bands priced from €9/month up to €269/month above 25,000 monthly consents, pro-rated domain additions, VAT treatment, cancellation windows, and even the 4% automatic annual increase disclosed in advance of the invoice. What breaks the computation: we found no public information on prices for the named add-ons (Expert Scanning, Managed Compliance, Mobile SDKs), on Custom plan pricing, or on the monthly action limit that consents count toward on Business and Enterprise plans. The 14-day trial without a credit card is clear; the captured pages give different trial lengths in the terms and on the pricing page. 1 5 6
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Cookie Information
Is Cookie Information European?
Yes. whats-best.ai classifies Cookie Information as EU-Made.
Where does Cookie Information store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention Netherlands as hosting location, per the vendor’s page captured 29 Oct 2026.
Does Cookie Information have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to Cookie Information?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Cookie Information alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Hosting options, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 6 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (18)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage cookieinformation.com Checked 29 Oct 2026 Details →
- 2 Features page (consent management platform) cookieinformation.com Checked 29 Oct 2026 Details →
- 3 Features page (mobile apps) cookieinformation.com Checked 29 Oct 2026 Details →
- 4 Integrations page cookieinformation.com Checked 29 Oct 2026 Details →
- 5 Pricing page cookieinformation.com Checked 29 Oct 2026 Details →
- 6 Terms of service cookieinformation.com Checked 29 Oct 2026 Details →
- 7 Privacy policy cookieinformation.com Checked 29 Oct 2026 Details →
- 8 Security / trust page cookieinformation.com Checked 29 Oct 2026 Details →
- 9 Banner & choice architecture — found from sitemap support.cookieinformation.com Checked 29 Oct 2026 Details →
- 10 Banner & choice architecture — found from sitemap support.cookieinformation.com Checked 29 Oct 2026 Details →
- 11 Prior blocking & script control — found from sitemap support.cookieinformation.com Checked 29 Oct 2026 Details →
- 12 Prior blocking & script control — found from sitemap support.cookieinformation.com Checked 29 Oct 2026 Details →
- 13 Scanning & cookie classification — found from sitemap support.cookieinformation.com Checked 29 Oct 2026 Details →
- 14 Scanning & cookie classification — found from sitemap support.cookieinformation.com Checked 29 Oct 2026 Details →
- 15 Consent records & proof — found from sitemap support.cookieinformation.com Checked 29 Oct 2026 Details →
- 16 Frameworks, signals & platforms — found from sitemap support.cookieinformation.com Checked 29 Oct 2026 Details →
- 17 Frameworks, signals & platforms — found from sitemap support.cookieinformation.com Checked 29 Oct 2026 Details →
- 18 Terms of service — found from the homepage cookieinformation.com Checked 1 Nov 2026 Details →