Consent Management (CMP)
CookieFirst
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Digital Data Solutions B.V. · cookiefirst.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
CookieFirst at a glance
- Vendor
- Digital Data Solutions B.V.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention the EU source, captured 29 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates CookieFirst 2.5/5, the mean of 6 judges. CookieFirst is a consent management platform from Digital Data Solutions B.V. how scores are made
- As of
- Vendor pages captured 29 Oct 2026 to 1 Nov 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
CookieFirst is a consent management platform from Digital Data Solutions B.V. of Amsterdam, an iubenda company. Its strongest showing is sovereignty, 7 to 8: consent data stored in the EEA on DigitalOcean AMS3 and OVH in France and Germany, a banner delivered through a Slovenian CDN and a published data processing agreement, though United States companies appear among the subprocessors for payment, internal communication and support. Banner and choice sits at a uniform 6; scanning and classification runs 5 to 6. Pricing transparency is weakest, 3 to 5, holding the card's lowest score, a 3 from the in-house lawyer: the captured pages name Free, Basic and Plus plans, a 300.000 monthly page views per domain limit and a 25% overuse allowance for two months, but no euro figure. Prior blocking, consent records and standards and platforms run 4 to 5, with no public information on IAB TCF registration, APIs, mobile SDKs or a documented way to verify nothing fires before consent. The pricing spread is the card's widest; the rationales describe the same missing figures, not conflicting ones.
Speaks for it
- Sovereignty scored 7 to 8, the highest marks on the card, with consent data stored in the EEA on named DigitalOcean AMS3 and OVH infrastructure in France and Germany
- Banner and choice scored 6 with no spread, on documented accept and reject buttons, per-category toggles, geo-targeting and more than 44 pretranslated languages
- The scanner covers first-, second- and third-party cookies, trackers and local storage, updating a cookie declaration in over 45 languages after each scan
- Google-certified CMP status with Consent Mode v2 and a Google Tag Manager template, plus plugins for WordPress, Shopify, Shopware 5 and 6, Wix, Drupal and others
- Each consent is logged with anonymised IP, timestamp, user agent, URL and consent state, held as proof of consent in an encrypted database
Held against it
- Pricing transparency scored 3 to 5: no captured page quotes a euro figure for the Free, Basic or Plus plan, so a real annual cost cannot be computed
- We found no public information on IAB TCF registration, a JavaScript or REST API, GPP or GPC signals, or iOS and Android SDKs
- Prior blocking rests on the vendor's statement that scripts detect, block and delete cookies before they are installed, with no published steps to verify nothing fires before consent
- We found no public information on exporting the consent log, on records tied to the banner version shown, or on a retention period beyond deletion when no longer necessary or at contract end
- United States companies appear among the subprocessors for payment, internal communication and support, and the data protection officer would ask the vendor to reconcile that list with the agreement's stated EU and adequacy-country processing
Best for
- You run a WordPress, Shopify or Shopware site and rely mainly on Google signals, where Consent Mode v2 and a Google Tag Manager template are documented
- You need multilingual consent quickly, with more than 44 pretranslated banner languages, automatic translation and geo-targeted display
- Your priority is European processing of consent data, with EEA storage on named EU infrastructure and a published data processing agreement
- You are an agency or multi-site operator, with a project per website, domains and subdomains grouped under one main domain, and a 30% reseller commission
Avoid if
- You need processing free of United States subprocessors, since Stripe, Slack and Zendesk are listed with United States locations for payment, internal communication and support
- You need a short exit, since the data processing agreement is terminable at the end of each month subject to a six months notice
- You would run the free tier in production, since the terms state that in a free service provision the vendor is not obliged to rectify defects
- You must budget a firm annual cost before signing, since the published pages name the plans but quote no euro amount
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 3 of 5 |
| Prior blocking & script control | 2 of 5 |
| Scanning & cookie classification | 3 of 5 |
| Consent records & proof | 2 of 5 |
| Frameworks, signals & platforms | 2 of 5 |
| European sovereignty | 4 of 5 |
| Pricing transparency | 2 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Automatic blocking before consent is documented — scripts that detect, block and delete cookies before they are installed, with third-party scripts managed in the vendor portal so only the vendor script sits on the site — plus a Google Tag Manager template. We found no public information on placeholders for embedded videos or maps, separate auto and manual blocking modes, or a documented way for the site owner to verify nothing loads before the click. 11 12 15 16
The Agency Developer
Automatic blocking is documented — the scripts "detect, block and delete cookies before they are installed", third-party tracking scripts load only after consent, and scripts can be managed through their portal with a Google Tag Manager template and Consent Mode. For my clients' YouTube and Maps embeds I found no public information on content blockers or placeholders, and nothing on passing consent to forms and plugins or on any way to test that nothing fires before consent. 11 16 15 9
The Publisher Marketing Lead
Automatic blocking before consent is stated (scripts that "detect, block and delete cookies before they are installed"), with third-party scripts managed from the portal and a Google Tag Manager template plus Consent Mode support. We found no public information on placeholders for embedded videos or maps, content blockers for named services, server-side tagging, or a documented way for me to verify nothing loads before consent. 11 9 12 16 15
The In-House Lawyer
Automatic blocking before consent is documented — scripts that "detect, block and delete cookies before they are installed" — together with a Google Tag Manager template and third-party scripts managed through the vendor portal so that only the CMP script sits on the website. I found no public information on placeholders for embedded videos or maps, on consent signals for forms and CAPTCHAs, on server-side tagging, or on a documented way for the site owner to test that nothing loads early. 11 16 15 12
The WordPress Webmaster
The blocker page states scripts "detect, block and delete cookies before they are installed" and that consent is obtained before third-party tracking scripts load, with scripts managed through the CookieFirst portal so only the CookieFirst script goes on the site, plus a Google Tag Manager template. That is automatic blocking rather than hand-edited tags, but we found no public information on content blockers with placeholders for the YouTube embeds and Google Maps my site carries, on consent signals for forms and CAPTCHAs, or on a documented way to check that nothing fires before consent. 11 15 16
The Skeptic
The blocker is claimed to detect, block and delete cookies before they are installed, scripts are managed in the portal so only the CookieFirst script sits on the page, and a Google Tag Manager template exists. What I did not find is a published way to verify in the browser that nothing fires before consent, placeholders for videos, maps or social embeds, consent passed to forms or CAPTCHAs, or server-side tagging — auto-blocking stays a claim until the test steps are published. 11 12 15 16 9
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
The scanner is documented to find first-, second- and third-party cookies, trackers and local storage, rescan regularly, report purpose, function and lifetime, and update the cookie declaration automatically in over forty-five languages. We found no public information on scan depth or page count, scanning behind logins, email alerts on new or changed trackers, or exportable scan reports for an audit. 3 9 12 15
The Agency Developer
The scanner detects first-, second- and third-party cookies, trackers and local storage, rescans regularly with ongoing monitoring, and updates a generated cookie declaration in over 45 languages after each scan, with reports covering cookie type, function and duration. We found no public information on scan depth, scanning behind logins, or email alerts when a new tracker appears — exactly the check that would catch the pixel a client adds on Friday. 12 3 13 15
The Publisher Marketing Lead
The scanner detects first-, second- and third-party cookies, trackers and local storage, rescans regularly with ongoing monitoring, and after each scan updates a cookie declaration generated automatically in over 45 languages, with reports naming cookie types, functions served and duration on the device. We found no public information on alerts for new or changed trackers, a stated scan depth, or the classification sources and update process behind the categories. 12 15 4 3 9
The In-House Lawyer
The scanner covers first-, second- and third-party cookies, trackers and local storage, runs regularly, and automatically updates a cookie declaration in more than 45 languages; reports list cookie types, functions served and duration on the device. I found no public information on email alerts for new or changed trackers, on scan depth or scanning behind logins, or on exportable reports, and the captured pages give different figures for how fast a scan completes. 12 3 4 15 13
The WordPress Webmaster
The scanner is documented to detect first-, second- and third-party cookies, trackers and local storage, with regular rescans, ongoing monitoring and a cookie table updated automatically after each scan; reports list cookie type, function and duration, and the generated declaration covers over 45 languages. For finding Analytics, YouTube and Maps without typing them in by hand this is close to what I need, but we found no public information on alerts for new or changed trackers, stated scan depth, or a change history. 3 12 15
The Skeptic
The scanner documents first-, second- and third-party cookies, trackers and local storage, regular rescans that update the cookie table after each scan, reports with purposes and durations, and a cookie declaration generated in over 45 languages. We found no public information on alerts for new or changed trackers, stated scan depth, scanning behind logins, or how the classification database is maintained — ongoing monitoring appears as a claim without the method. 12 3 15 13 4
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
The privacy policy lists a per-consent record — anonymised IP, date and time, user agent, the URL of consent, an encrypted key, and the consent state held as proof of consent — with a re-consent feature, though retention is stated only as deletion when no longer necessary or at contract end. We found no public information on which banner version or texts each record carries, export of the consent log, configurable consent expiry, or a consent ID the visitor can look up — the banner version per record is what I would be asked for by a supervisory authority. 2 6 15
The Agency Developer
Each consent is logged pseudonymously and encrypted with the anonymised IP, date and time, user agent, URL, an anonymous random key and the consent state, which the vendor describes as serving as proof of consent, plus a re-consent feature. We found no public information on export of the consent log, on records tied to the banner version shown, or on a consent ID the visitor could look up. 6 2 9 15
The Publisher Marketing Lead
Each consent is logged with date and time, user agent, the URL it was given on, an anonymous encrypted key and the consent state, which the vendor describes as proof of consent stored in an encrypted database; statistics and audit trails are also listed. Retention is described only as deletion when no longer necessary, the re-consent feature is framed around returning visitors rather than changed texts or services, and we found no public information on exporting the consent log or a consent ID the visitor can look up. 6 2 9 15 7
The In-House Lawyer
Every consent is logged with date and time, anonymised IP, user agent, the URL of the consent, an anonymous encrypted key and the consent state, expressly held as proof of consent in an encrypted, pseudonymised database stored in the EEA. I found no public information on exporting the consent log, on banner versions or texts tied to each record, on a consent ID the visitor could look up, or on withdrawal being recorded as its own event — exactly what I would need if a consumer group sued. 6 2 12 9
The WordPress Webmaster
The privacy policy details each record — anonymised IP, date and time of consent, user agent, the URL it was given on, an anonymous encrypted key and the consent state "serving as proof of consent" — kept in an anonymised, encrypted database, with audit trails and statistics in the dashboard and data deleted when no longer necessary or at contract end. The only data-return mechanism we read about is contractual, in the data processing agreement's four-week request window; we found no public information on a dashboard export of the consent log, a stated retention period, banner versions tied to records, or consent expiry. 2 6 7 15
The Skeptic
Each consent is recorded with an anonymised IP, timestamp, user agent, URL, an anonymous encrypted key and the consent state serving as proof of consent, held pseudonymised and encrypted, with re-consent and audit trails. But we found no public information tying records to the banner version shown, a stated retention period for the log itself, or export of the log; the processing agreement promises data return on request within four weeks, while leaving takes six months' notice. 6 2 9 15 7
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
Google Consent Mode v2 with Google CMP certification is documented, along with plugins for WordPress, Shopify, Shopware and React, compatibility with Wix, Drupal, Joomla, Typo3 and other systems, and grouping of domains and subdomains under one account. We found no public information on IAB TCF with a registered CMP ID, Microsoft UET or GPP and GPC signals, native iOS or Android SDKs, or a configuration API. 2 4 16 17
The Agency Developer
Google Consent Mode v2 is supported with CookieFirst named a Google-certified CMP, a Tag Manager template exists, and plugins cover WordPress, Shopify, Shopware, TYPO3, Drupal, Joomla, Magento and more, with domains and subdomains grouped under one main domain and several projects per account. We found no public information on IAB TCF registration, a JavaScript API, app SDKs or dedicated agency accounts. 2 4 16 17 3
The Publisher Marketing Lead
Google Consent Mode v2 is documented with the vendor named a Google-certified CMP partner, alongside a GTM template, plugins for WordPress, Shopify, Shopware, Wix, Hubspot, Drupal, Joomla, Typo3 and others, and grouping of domains and subdomains under one main domain. As an ad-funded publisher I need a registered IAB TCF CMP ID, and we found no public information on TCF, Consent Mode in advanced mode, GPP or GPC signals, iOS and Android SDKs, or an API. 2 4 16 17 5
The In-House Lawyer
Google Consent Mode v2 with Google-certified CMP status, a Google Tag Manager template, domain grouping and plugins for WordPress, Shopify, Shopware, Wix, Drupal, Magento, Typo3 and others are documented. I found no public information on IAB TCF with a registered CMP ID, on a JavaScript or REST API, on GPP or Global Privacy Control for US states, or on iOS and Android SDKs. 2 4 16 17 3
The WordPress Webmaster
CookieFirst is named a Google-certified CMP with a Consent Mode v2 integration and a Google Tag Manager template, and offers a WordPress plugin alongside apps and plugins for Shopify, Shopware 5 and 6, TYPO3, Wix, Drupal, Joomla, WooCommerce, Magento and React, with domains and subdomains groupable under one main domain. We found no public information on IAB TCF support with a registered CMP ID, a JavaScript or REST API, Microsoft or GPP/GPC signals, or native app SDKs, so the signal side rests almost entirely on Google. 2 4 16 17
The Skeptic
Google-certified Consent Mode v2, a Google Tag Manager template, cross-domain grouping and a long plugin list — WordPress, Shopify, Shopware, React, Typo3, Magento and more — are public, alongside multi-regulation coverage. We found no public information on an IAB TCF registration with a CMP ID, a JavaScript or REST API, Microsoft or GPP/GPC signals, or mobile SDKs; for a consent tool in 2026 I check TCF first. 2 4 16 17 11
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
The chain that touches visitors is European and named: a Dutch contracting entity with chamber registration and VAT number, consent data stored in the EEA on named infrastructure (DigitalOcean AMS3, OVH France and Germany), the banner CDN at BunnyWay in Slovenia, geolocation via IP-API in Romania, and a published data processing agreement confining processing to the EU and adequacy countries, with SOC 2 Type II and ISO 27001 stated at the datacenter. The privacy policy's subprocessor list does include United States companies for payments (Stripe), internal communication (Slack) and support tickets (Zendesk, stated to receive no consent data), so I would ask the vendor to reconcile that list with the agreement's EU-only commitment before signing. 6 7 8 14
The Agency Developer
Digital Data Solutions B.V. of Amsterdam contracts under Dutch law, consent data is stored in the EU/EEA on named DigitalOcean AMS3 infrastructure, the banner is delivered through a CDN in Slovenia, and subprocessors are listed with their locations alongside a published data processing agreement and datacentre SOC and ISO 27001 certifications. US-headquartered processors remain in the chain for payment, support and internal communications, so the chain is strong but not sovereign end to end. 5 6 7 8 4 14
The Publisher Marketing Lead
The contracting entity is Digital Data Solutions B.V. in Amsterdam (iubenda in Italy as parent), consent data is stored in EEA databases, the banner is delivered through a Slovenian CDN with hosting on named EU infrastructure (DigitalOcean AMS3, OVH France and Germany), and subprocessors are listed with locations together with a published DPA and datacenter ISO 27001 and SOC 2 statements. Payments, support and internal communication run through US providers (Stripe, Zendesk, Slack) with no stated transfer safeguard on the captured pages, which keeps this short of the top level. 14 6 7 8 4 15
The In-House Lawyer
The chain I care about is European and named: a Dutch contracting entity in Amsterdam with chamber register and VAT numbers, iubenda in Italy as parent, consent data stored in the EEA on DigitalOcean AMS3 and OVH in France and Germany, the banner CDN at BunnyWay in Slovenia, and a published data processing agreement confining processing to the EU with mutual signing. Subprocessors are listed with locations; Mailgun, Stripe, Slack and Zendesk sit in the United States for email, payment, internal communication and support only, and the ISO 27001 and SOC certifications stated on the security page are those of the datacenter. 6 7 8 14 15
The WordPress Webmaster
The contracting entity is Digital Data Solutions B.V. in Amsterdam (KvK 75762277) under Dutch law, consent data is stored in the EEA on named infrastructure — DigitalOcean AMS3 plus OVH in France and Germany — the banner is delivered through a Slovenia-based CDN, geolocation runs via a Romanian provider, and the subprocessor list names each provider with its country, backed by a published data processing agreement and datacenter certifications (ISO 27001:2013, SOC 1 and 2 Type II, PCI-DSS). The chain still contains US entities for payment, notification email, internal chat and support tickets (Stripe, Mailgun, Slack, Zendesk, the last stated to receive no consent data), so it is not sovereign end to end — but everything touching the banner and consent logs is documented as EU-based. 5 6 7 8 14
The Skeptic
A Dutch company on the chamber register, consent data stored in the EEA, the banner delivered via BunnyWay in Slovenia, hosting on DigitalOcean AMS3 and OVH in France and Germany, a published data processing agreement and a located subprocessor list is more chain than most vendors show. I hold it below the top band because Stripe, Slack, Zendesk and Mailgun Inc. sit in the United States for payments, internal communication, support and mail, the ISO 27001 and SOC 2 certificates belong to the datacenter rather than to CookieFirst, and the group's team.blue Hub does cross-brand remarketing from account email addresses. 14 6 7 8 4
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
Three named tiers (Free, Basic and Plus) share a stated limit of 300,000 monthly page views per domain with a 25% overuse allowance for two months, prices in Euro excluding taxes, a 14-day free trial, a 30-day refund window on yearly subscriptions and a 30% reseller commission. The captured pages give no figures for what each plan costs, what happens after the two overuse months, or pricing for additional domains and add-ons, so the real annual cost is not computable from what we captured. 5 11 15
The Agency Developer
The plan names (Free, Basic, Plus), the 300,000 monthly page views per domain limit with a 25% overuse allowance for two months, Euro pricing excluding taxes, a 14-day trial, a 30-day refund window on yearly subscriptions and a 30% reseller commission are all documented. We found no public information stating the monthly or annual prices of the individual plans, so I cannot compute a client's real annual cost from what I read. 5 11 2 10
The Publisher Marketing Lead
Plan names (Free, Basic, Plus, custom enterprise), a limit of 300.000 monthly page views per domain with a 25% overuse allowance for two months, a free tier and 14-day trial, a 30% reseller commission, prices in EUR excluding taxes, and a 30-day refund on yearly subscriptions are public. No price figures per tier appear in the captured passages, and we found no public information on what happens after the two overuse months or which features cost extra in which plan. 5 11 15 1 2
The In-House Lawyer
Plan names (Free, Basic, Plus), an allowance of up to 300,000 monthly page views per domain with 25% overuse for two months, a 14-day trial, a 30% reseller commission, Euro prices excluding taxes and a 30-day refund window on yearly subscriptions are public. I found no public information with the euro amounts of any tier, so a buyer cannot compute the real annual cost. 5 11 15
The WordPress Webmaster
The terms name three regular plans (Free, Basic, Plus), state they are "meant for traffic of up to 300.000 monthly page views per domain" with "an overuse of 25% for two months", price in Euro excluding taxes, allow refunds within "the first 30 days of a yearly subscription", and publish a 30% reseller commission alongside a 14-day free trial or free account. None of the captured pages quote an actual euro amount for any tier, and we found no public information on extra-domain pricing, on what happens after the two overuse months, or on minimum term and setup, so I cannot compute my per-site yearly cost from the public pages I read. 1 5 11
The Skeptic
A free tier, a two-week trial of the paid plans, plans named Free, Basic and Plus meant for traffic of up to 300.000 monthly page views per domain with a 25% overuse allowed for two months, EUR prices excluding taxes, a 30-day refund on yearly subscriptions and a 30% reseller commission are all public. But the captured pages state no figure for any paid plan, what happens after the two overuse months, or which features cost extra; the homepage capture is noted to carry prices, yet the plan amounts themselves are absent from what we captured. 1 5 11
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about CookieFirst
Is CookieFirst European?
Yes. whats-best.ai classifies CookieFirst as EU-Made.
Where does CookieFirst store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention the EU as hosting location, per the vendor’s page captured 29 Oct 2026.
Does CookieFirst have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to CookieFirst?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: CookieFirst alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 20 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 10 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (18)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (prices on the homepage) cookiefirst.com Checked 29 Oct 2026 Details →
- 2 Features page cookiefirst.com Checked 29 Oct 2026 Details →
- 3 Features page (cookie scanner) cookiefirst.com Checked 29 Oct 2026 Details →
- 4 Features page (Google Consent Mode) cookiefirst.com Checked 29 Oct 2026 Details →
- 5 Terms of service cookiefirst.com Checked 29 Oct 2026 Details →
- 6 Privacy policy cookiefirst.com Checked 29 Oct 2026 Details →
- 7 Data processing agreement (dpa) cookiefirst.com Checked 29 Oct 2026 Details →
- 8 Security / trust page cookiefirst.com Checked 29 Oct 2026 Details →
- 9 Banner & choice architecture — found from sitemap cookiefirst.com Checked 29 Oct 2026 Details →
- 10 Banner & choice architecture — found from sitemap cookiefirst.com Checked 29 Oct 2026 Details →
- 11 Prior blocking & script control — found from sitemap cookiefirst.com Checked 29 Oct 2026 Details →
- 12 Scanning & cookie classification — found from sitemap cookiefirst.com Checked 29 Oct 2026 Details →
- 13 Scanning & cookie classification — found from sitemap cookiefirst.com Checked 29 Oct 2026 Details →
- 14 Consent records & proof — found from sitemap cookiefirst.com Checked 29 Oct 2026 Details →
- 15 Consent records & proof — found from sitemap cookiefirst.com Checked 29 Oct 2026 Details →
- 16 Frameworks, signals & platforms — found from sitemap cookiefirst.com Checked 29 Oct 2026 Details →
- 17 Frameworks, signals & platforms — found from sitemap cookiefirst.com Checked 29 Oct 2026 Details →
- 18 Legal notice — found from the homepage cookiefirst.com Checked 1 Nov 2026 Details →