# CookieFirst — Consent Management (CMP)

CookieFirst by Digital Data Solutions B.V. holds a panel rating of 2.5/5 from 6 AI judges (category median 3/5), as of 2026-10-30. Provenance: EU-Made; sovereignty: not determined.

- Vendor: Digital Data Solutions B.V. (https://cookiefirst.com/de/)
- Category: [Consent Management (CMP)](https://whats-best.ai/software/consent-management.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/consent-management/cookiefirst
- Alternatives: https://whats-best.ai/software/consent-management/cookiefirst/alternatives ([markdown](https://whats-best.ai/software/consent-management/cookiefirst/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-10-30 · oldest source captured 2026-10-29

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Digital Data Solutions B.V.
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Default not stated; pages mention the EU [S4]
- Free plan: Not stated on the vendor’s pages as of 1 Nov 2026

## The panel's verdict

CookieFirst is a consent management platform from Digital Data Solutions B.V. of Amsterdam, an iubenda company. Its strongest showing is sovereignty, 7 to 8: consent data stored in the EEA on DigitalOcean AMS3 and OVH in France and Germany, a banner delivered through a Slovenian CDN and a published data processing agreement, though United States companies appear among the subprocessors for payment, internal communication and support. Banner and choice sits at a uniform 6; scanning and classification runs 5 to 6. Pricing transparency is weakest, 3 to 5, holding the card's lowest score, a 3 from the in-house lawyer: the captured pages name Free, Basic and Plus plans, a 300.000 monthly page views per domain limit and a 25% overuse allowance for two months, but no euro figure. Prior blocking, consent records and standards and platforms run 4 to 5, with no public information on IAB TCF registration, APIs, mobile SDKs or a documented way to verify nothing fires before consent. The pricing spread is the card's widest; the rationales describe the same missing figures, not conflicting ones.

**Speaks for it:**
- Sovereignty scored 7 to 8, the highest marks on the card, with consent data stored in the EEA on named DigitalOcean AMS3 and OVH infrastructure in France and Germany
- Banner and choice scored 6 with no spread, on documented accept and reject buttons, per-category toggles, geo-targeting and more than 44 pretranslated languages
- The scanner covers first-, second- and third-party cookies, trackers and local storage, updating a cookie declaration in over 45 languages after each scan
- Google-certified CMP status with Consent Mode v2 and a Google Tag Manager template, plus plugins for WordPress, Shopify, Shopware 5 and 6, Wix, Drupal and others
- Each consent is logged with anonymised IP, timestamp, user agent, URL and consent state, held as proof of consent in an encrypted database

**Held against it:**
- Pricing transparency scored 3 to 5: no captured page quotes a euro figure for the Free, Basic or Plus plan, so a real annual cost cannot be computed
- We found no public information on IAB TCF registration, a JavaScript or REST API, GPP or GPC signals, or iOS and Android SDKs
- Prior blocking rests on the vendor's statement that scripts detect, block and delete cookies before they are installed, with no published steps to verify nothing fires before consent
- We found no public information on exporting the consent log, on records tied to the banner version shown, or on a retention period beyond deletion when no longer necessary or at contract end
- United States companies appear among the subprocessors for payment, internal communication and support, and the data protection officer would ask the vendor to reconcile that list with the agreement's stated EU and adequacy-country processing

**Best for:**
- You run a WordPress, Shopify or Shopware site and rely mainly on Google signals, where Consent Mode v2 and a Google Tag Manager template are documented
- You need multilingual consent quickly, with more than 44 pretranslated banner languages, automatic translation and geo-targeted display
- Your priority is European processing of consent data, with EEA storage on named EU infrastructure and a published data processing agreement
- You are an agency or multi-site operator, with a project per website, domains and subdomains grouped under one main domain, and a 30% reseller commission

**Avoid if:**
- You need processing free of United States subprocessors, since Stripe, Slack and Zendesk are listed with United States locations for payment, internal communication and support
- You need a short exit, since the data processing agreement is terminable at the end of each month subject to a six months notice
- You would run the free tier in production, since the terms state that in a free service provision the vendor is not obliged to rectify defects
- You must budget a firm annual cost before signing, since the published pages name the plans but quote no euro amount

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Data Protection Officer | The Agency Developer | The Publisher Marketing Lead | The In-House Lawyer | The WordPress Webmaster | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Banner & choice architecture | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Prior blocking & script control | 2.5/5 | 2/5 | 2/5 | 2.5/5 | 2/5 | 2/5 |
| Scanning & cookie classification | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 2.5/5 |
| Consent records & proof | 2/5 | 2/5 | 2/5 | 2.5/5 | 2/5 | 2/5 |
| Frameworks, signals & platforms | 2.5/5 | 2.5/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| European sovereignty | 4/5 | 4/5 | 3.5/5 | 4/5 | 4/5 | 3.5/5 |
| Pricing transparency | 2.5/5 | 2/5 | 2/5 | 1.5/5 | 2/5 | 2/5 |
| **Weighted verdict** | **3/5** | **2.5/5** | **2.5/5** | **3/5** | **2.5/5** | **2.5/5** |

### The judges

- **The Data Protection Officer** (v1.0): External DPO for a dozen mid-sized companies, two of which received a letter from a state supervisory authority about their cookie banner last year. Wants reject on the first layer, nothing loaded before the click, a consent log that shows which banner version each visitor saw, a cookie list that matches the site, and a DPA and subprocessor list that keep visitor data in the EU.
- **The Agency Developer** (v1.0): Lead developer at a web agency that maintains forty client sites on WordPress, TYPO3 and Shopify. Wants one account for every client, blocking that works without rewriting each theme, content blockers for YouTube and Maps, a Tag Manager template, a scanner that flags the tracker a client added on Friday, and a JavaScript API documented well enough that forms and plugins can ask for consent.
- **The Publisher Marketing Lead** (v1.0): Runs marketing for an ad-funded news site and an online shop in the same group, where every point of consent rate shows up in ad revenue and in Google Ads conversions. Wants a registered IAB TCF CMP, Google Consent Mode v2 in advanced mode, banner tests within what the law allows, consent shared between the site and the app, and a dashboard that shows where visitors drop off.
- **The In-House Lawyer** (v1.0): In-house counsel at a retailer with shops in Germany, France and Austria, who has read the court decisions on missing reject buttons and the regulators' banner guidance. Wants § 25 TDDDG and the GDPR mapped to concrete settings, equal-weight choices as the default, consent that can be withdrawn as easily as it was given, and records that would hold up if a competitor or a consumer group sued.
- **The WordPress Webmaster** (v1.0): Looks after the WordPress site of a mid-sized engineering company on top of the actual job, with Google Analytics, a YouTube channel, a Maps embed and a contact form with reCAPTCHA. Wants a plugin that finds these by itself, blocks them until the visitor agrees, survives the next plugin update and caching, and costs a known amount per site per year without a call to sales.
- **The Skeptic** (v1.0): Has opened the browser's network tab on sites with a "certified" banner and watched the ad pixels fire before anything was clicked. Reads "consent rate optimisation" as a hint that reject will be grey and small, "auto-blocking" as a claim until the test steps are published, and "EU hosting" next to a US script CDN — and asks what leaving would cost: the consent logs, and every visitor asked again.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Automated decision rights: yes [S6]
- Backups daily: yes · yes · yes · yes [S8]
- Breach notification: 72 [S6]
- Datacenter certifications: SOC 1 Type II · SOC 2 Type II · ISO/IEC 27001:2013 · PCI-DSS [S8]
- Digitalocean ISO 27001: ISO/IEC 27001:2013 · yes [S8]
- DPA: yes · yes [S5]
- DPA breach notification: as soon as possible · yes [S7]
- DPA data return: 4 · yes · yes [S7]
- DPA indemnification: yes [S7]
- DPA latest version: latest DPA & TOMs and mutual signing offered via link [S7]
- DPA subject rights assistance: yes [S7]
- DPA subprocessor objection: yes · yes · yes [S7]
- DPA termination notice: terminable at end of each month with six months notice [S7]
- DPA transfers: Processing confined to EU and European Commission adequacy countries [S7]
- Encryption: yes · yes [S6]
- Encryption measures: Encryption of files containing personal data; SSL or similar secure network connections [S8]
- GDPR claim: DSGVO-Konformität angeblich innerhalb weniger Minuten erreichbar [S17]
- GDPR fines: 2022 · 10000000 · 20000000 · 2 · 4 [S11]
- GDPR rights: yes · yes [S6]
- Google certified cmp: CookieFirst ist eine von Google zertifizierte Consent Management Platform [S4]
- Regulations: DSGVO/GDPR · TTDSG · ePrivacy · LGPD · CCPA · PDPA [S1]
- Regulations: GDPR (Europe) · ePrivacy Regulation (Europe) · CCPA (US) · LGPD (Brazil) · PIPEDA & CPPA (Canada) · Quebec Law 25 (Canada) · PDPA (Thailand) [S10]
- Regulations: GDPR · ePrivacy · DSGVO · TTDSG [S15]

**Data**
- Account data collected: name · address · residence · phone number · email address · IP address (anonymised) · payment details · cookie preferences [S6]
- End user consent data: anonymised IP · date and time of consent · user agent · URL of consent · anonymous encrypted key · consent state · yes [S6]
- Min age policy: 16 · yes [S6]
- Retention: deleted when no longer necessary or after contract ends [S6]

**Hosting**
- Access control: yes · yes · yes [S8]
- Availability features: full redundancy · load balancing · automatic capacity scaling · continuous data backup · geo-replication · automatic geographical failover [S6]
- Centralized logging: yes · yes [S8]
- Company location: Amsterdam, Niederlande [S15]
- Data centers: EU only · yes [S6]
- Data location: EU [S4]
- Data residency: yes [S6]
- Datacenter provider: co-located datacenter facility · DigitalOcean AMS3 [S8]
- Decommission erasure: yes [S8]
- Legal entity: ein Unternehmen von iubenda · Digital Data Solutions BV [S17]
- Physical security: 24/7/365 · yes · yes · yes · yes [S8]
- Power backup: yes · yes · yes [S8]
- Snapshot backup regions: yes [S8]
- Support staff access: no · no [S8]

**Integrations**
- Available: yes [S15]
- Cms compatibility: Funktioniert mit praktisch jeder Webtechnologie / CMS [S17]
- Google consent mode: Google Consent Mode · yes [S9]
- Google consent mode v2: yes · yes [S2]
- Google tag manager: Google Tag Manager template and Google Consent Mode support [S16]
- Gtm: yes [S2]
- Gtm consent mode: Google Tag Manager & Google Consent Mode · yes [S17]
- Mentions: integrations with Google Tag Manager and Google Consent Mode; plugins/integrations footer section [S1]
- Named platforms: Wix · Hubspot · Drupal · Joomla · Prestashop · Woocommerce · Magento / Adobe Commerce · Typo3 [S17]
- Plugins: WordPress · Shopware · Shopify [S2]
- Plugins: yes [S3]
- Plugins: yes [S9]
- React: React integration [S16]
- React: React Cookie Consent · yes [S17]
- Shopify app: Shopify-App · yes [S17]
- Shopware: 5 · 6 · yes [S17]
- Wordpress plugin: WordPress-Plugin · yes [S17]

**Legal**
- Address: Plantage Middenlaan 42a, 1018DH, Amsterdam, Niederlande [S14]
- Chamber register: Niederländische Handelskammer · 75762277 [S14]
- Company: iubenda · Digital Data Solutions BV [S2]
- Company: iubenda · Digital Data Solutions BV [S3]
- Company: Digital Data Solutions BV [S15]
- Copyright entity: iubenda · Digital Data Solutions BV [S12]
- Entity: Digital Data Solutions BV [S10]
- Entity: Digital Data Solutions B.V. · Plantage Middenlaan 42A, 1018DH Amsterdam · Netherlands · 75762277 [S5]
- Entity: 2026 · Digital Data Solutions BV · iubenda [S8]
- Entity: Cookie First by Digital Data Solutions · Plantage Middenlaan 42a, 1018 DH Amsterdam · 75762277 [S7]
- Entity: 2026 · Digital Data Solutions BV · iubenda [S11]
- Entity: iubenda · Digital Data Solutions BV [S9]
- Entity: Digital Data Solutions BV, an iubenda company [S16]
- Entity: 75762277 · Digital Data Solutions B.V. · legal@cookiefirst.com · Plantage Middenlaan 42a, 1018 DH Amsterdam [S6]
- Entity name: Digital Data Solutions B.V. (CookieFirst) [S14]
- Fines disclaimer: no [S5]
- Force majeure termination: 14 [S5]
- Ip ownership: right to use only · no [S5]
- Jurisdiction: Dutch Law · the court of Amsterdam shall be the only competent court [S5]
- Liability cap: 12 month subscription fee of the Customer's plan [S5]
- Liability scope: damages directly caused by gross negligence, intentional action, or malice [S5]
- Offer validity: 14 [S5]
- Offers non binding: yes [S5]
- Owner: iubenda · Digital Data Solutions BV [S7]
- Ownership: iubenda [S14]
- Ownership: iubenda [S15]
- Ownership note: iubenda [S5]
- Parent company: iubenda [S6]
- Terms change rights: yes [S5]
- Terms version: 2026-06-19 [S5]
- Third party sharing: no [S6]
- VAT id: NL860388141B01 [S14]
- Vulnerability reporting: yes [S11]

**Pricing**
- Billing: yes · around the first of every billing cycle [S5]
- Change rights: yes · 14 [S5]
- Currency and taxes: EUR · no [S5]
- Free trial: yes · yes · 14 [S2]
- Free trial: 2 weeks free for paid plans · yes [S3]
- Free trial: 14 · free_trial [S10]
- Free trial: 14 · free_trial [S11]
- Free trial: paid plans · yes · 2 · yes [S9]
- Free trial: 14 · yes [S12]
- Free trial: yes [S15]
- Free trial paid plans: 2 · yes · yes [S11]
- Late payment interest: 1 [S5]
- Plans traffic limits: 3 · 4 · 5 · 2 · 25 · 300000 [S5]
- Refund policy: yearly subscription only · yes · 30 [S5]
- Reseller commission: 30 · 500 [S11]

**Product**
- Accept reject buttons: yes [S9]
- Account requirements: yes · yes [S5]
- Alternatives comparison: Cookiebot · Usercentrics · Borlabs Cookie · CookiePro · CookieYes [S9]
- Alternatives listed: positioned as alternative to Cookiebot, Usercentrics, Borlabs Cookie, CookiePro, CookieYes [S3]
- Alternatives listed: Alternatives listed: Cookiebot, Usercentrics, Borlabs Cookie, CookiePro, CookieYes [S14]
- Applicable regulations: GDPR (Europa) · ePrivacy (Europa) · Cookies DSGVO · TTDSG Cookies [S17]
- Auto cookie declaration: yes [S15]
- Automated cookie policy generator: yes [S13]
- Automatic scan results update: yes [S12]
- Automatic translation: yes [S9]
- Availability: 24/7 · no [S5]
- Banner and preference center: yes · yes [S12]
- Banner customization: colors · fonts · button type · banner type/position/width · yes [S2]
- Banner layouts: top banner · footer banner · boxed corner pop-up [S9]
- Blocker behavior: Detects, blocks and deletes cookies before they are installed [S11]
- Capabilities listed: Services: Cookie Consent, Cookie Banner, Cookie Erklärung, Cookie Scanner, Google Consent Mode, Consent Management Platform, Plugins/Integrationen [S14]
- Cms compatibility: Works with virtually every web technology or CMS [S16]
- Competitor alternative: Cookiebot · Usercentrics · Borlabs Cookie · CookiePro · CookieYes [S17]
- Competitor alternatives: Cookiebot · Usercentrics · CookiePro · Illow · Borlabs Cookie · Axeptio · CookieYes · Osano [S11]
- Competitors positioning: Cookiebot · Usercentrics · Borlabs Cookie · CookiePro · CookieYes [S2]
- Compliance frameworks: GDPR (EU) and CPRA (US) compliance support [S3]
- Consent audit trail: pseudonymized, encrypted · yes [S2]
- Consent banner: customizable consent banner and cookie preference center [S3]
- Consent banner: yes [S15]
- Consent before scripts: yes [S9]
- Consent gate scripts: yes [S12]
- Consent recording: yes [S9]
- Consent revocation page: yes [S9]
- Consent statistics: yes [S4]
- Consent statistics: yes · yes [S15]
- Consent withdrawal: yes [S9]
- Continuous monitoring: yes [S3]
- Cookie categorization: yes [S9]
- Cookie notice generator: yes [S9]
- Cookie policy generator: yes [S3]
- Cookie policy generator: yes [S12]
- Cookie scan: monthly or more frequent · email · account [S2]
- Cookie scan: regelmäßiger Scan von Cookies und lokalem Speicher [S4]
- Cross brand activation: email address · yes [S6]
- Cross domain consent: yes [S2]

**Subprocessors**
- Bunnyway: BunnyWay · content delivery network · Slovenia [S7]
- Bunnyway: BunnyWay d.o.o. · CDN for cookie banner · Slovenia [S6]
- Denovit: Denovit B.V. · Stripe-Exact synchronization · Netherlands [S6]
- Exact: Exact Group B.V. · bookkeeping and accounting · Netherlands · no [S6]
- Ip API: Artia International S.R.L. (IP-API) · determine country/region for consent data · Romania [S6]
- Iubenda: Iubenda srl · parent company · Italy [S6]
- Mailgun: Mailgun Technologies Inc. · email notifications · USA · no · Germany [S6]
- Ovh: OVH · hosting, API for saving data, CDN log data storage · France & Germany [S7]
- Ovh: OVH BV · API for saving consent data, hosting, CDN log storage · Netherlands · Germany · France [S6]
- Slack: Slack Technologies, LLC · internal communication · United States [S6]
- Stripe: Stripe, Inc. · payment provider · United States · no [S6]
- Zendesk: Zendesk · support ticket system · United States · no [S7]
- Zendesk: Zendesk Inc · support ticket system · USA · no · Ireland [S6]

**Support**
- Dsar: DSAR rights exercise link available [S11]
- Reseller program: 30 [S2]
- Vulnerability reporting: yes [S8]
- Vulnerability reporting: yes [S9]

65 more facts on the canonical page: https://whats-best.ai/software/consent-management/cookiefirst

## Questions

### Is CookieFirst European?

Yes. whats-best.ai classifies CookieFirst as EU-Made.

### Where does CookieFirst store data?

The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention the EU as hosting location, per [the vendor’s page captured 29 Oct 2026](https://whats-best.ai/evidence/12325).

### Does CookieFirst have a free plan?

Not stated on the vendor’s pages as of 1 Nov 2026.

### What are the best alternatives to CookieFirst?

As of 3 Nov 2026, the panel rates [Usercentrics CMP (3.5/5)](https://whats-best.ai/software/consent-management/usercentrics), [Didomi (3.5/5)](https://whats-best.ai/software/consent-management/didomi) and [CCM19 (3.5/5)](https://whats-best.ai/software/consent-management/ccm19) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Usercentrics CMP](https://whats-best.ai/software/consent-management/usercentrics) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [CookieFirst alternatives](https://whats-best.ai/software/consent-management/cookiefirst/alternatives).

## What this page leaves out

- 20 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 10 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage (prices on the homepage): https://cookiefirst.com/de/ (checked 2026-10-29)
- [S2] Features page: https://cookiefirst.com/de/cookie-consent-manager-funktionen/ (checked 2026-10-29)
- [S3] Features page (cookie scanner): https://cookiefirst.com/de/cookie-scanner/ (checked 2026-10-29)
- [S4] Features page (Google Consent Mode): https://cookiefirst.com/de/google-consent-mode/ (checked 2026-10-29)
- [S5] Terms of service: https://cookiefirst.com/legal/general-terms-conditions/ (checked 2026-10-29)
- [S6] Privacy policy: https://cookiefirst.com/legal/privacy-policy/ (checked 2026-10-29)
- [S7] Data processing agreement (dpa): https://cookiefirst.com/legal/data-processing-agreement/ (checked 2026-10-29)
- [S8] Security / trust page: https://cookiefirst.com/data-security/ (checked 2026-10-29)
- [S9] Banner & choice architecture — found from sitemap: https://cookiefirst.com/de/cookie-banner/ (checked 2026-10-29)
- [S10] Banner & choice architecture — found from sitemap: https://cookiefirst.com/right-of-withdrawal/ (checked 2026-10-29)
- [S11] Prior blocking & script control — found from sitemap: https://cookiefirst.com/cookie-blocker/ (checked 2026-10-29)
- [S12] Scanning & cookie classification — found from sitemap: https://cookiefirst.com/cookie-scanner/ (checked 2026-10-29)
- [S13] Scanning & cookie classification — found from sitemap: https://cookiefirst.com/cookie-policy-generator/ (checked 2026-10-29)
- [S14] Consent records & proof — found from sitemap: https://cookiefirst.com/de/informationen-zu-cookie-einwilligung/ (checked 2026-10-29)
- [S15] Consent records & proof — found from sitemap: https://cookiefirst.com/de/wir-starten-cookiefirst-manager-fuer-die-cookie-einwilligung/ (checked 2026-10-29)
- [S16] Frameworks, signals & platforms — found from sitemap: https://cookiefirst.com/cookie-consent-plugins-integrations/ (checked 2026-10-29)
- [S17] Frameworks, signals & platforms — found from sitemap: https://cookiefirst.com/de/cookie-consent-plugins-integrationen/ (checked 2026-10-29)
- [S18] Legal notice — found from the homepage: https://cookiefirst.com/legal/cookie-declaration/ (checked 2026-11-01)

---

Cite as: whats-best.ai, "CookieFirst — Consent Management (CMP)", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/consent-management/cookiefirst

Corrections: https://whats-best.ai/correct/1160?target=page