Consent Management (CMP)
CookieYes
UK / wider Europe Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by CookieYes Limited · www.cookieyes.com
Compare with Cookiebot → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
CookieYes at a glance
- Vendor
- CookieYes Limited
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 29 Oct 2026
- Panel verdict
- The AI panel rates CookieYes 3/5, the mean of 6 judges. CookieYes scores best on pricing transparency, 7 to 8: four published tiers at $0, $10, $25 and $55 per month per domain, pageview limits per tier, and overage at $0.30 per 1,000 extra pageviews. how scores are made
- As of
- Vendor pages captured 29 Oct 2026 to 1 Nov 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
CookieYes scores best on pricing transparency, 7 to 8: four published tiers at $0, $10, $25 and $55 per month per domain, pageview limits per tier, and overage at $0.30 per 1,000 extra pageviews. Banner and choice, prior blocking, scanning and classification, and standards and platforms cluster at 6 to 7, backed by documented depth: three banner layouts, 30+ languages with auto-translation, GDPR and US-state templates, automatic blocking of third-party scripts before consent, scheduled scans of 100 to 8,000 pages against 100,000+ pre-categorised cookies, and Google Consent Mode v2 and IAB TCF v2.4 certification — TCF limited to Pro and Ultimate. Sovereignty is the low at 3 to 4: the contracting entity is UK-registered CookieYes Limited, hosting is on AWS with no region stated, and the privacy policy says personal data may be stored and processed in any country where the company has operations. Consent records draws the widest spread, 5 to 7 — the data protection officer scored it 5 over no public information on consent-log retention or the banner version shown. Persona-weighted totals run 5.7 to 6.6.
Speaks for it
- Published per-domain pricing at $0, $10, $25 and $55 per month with pageview limits per tier and overage at $0.30 per 1,000 extra pageviews.
- Automatic blocking of third-party scripts and cookies before consent, with documented browser steps to verify nothing loads early.
- Google-certified CMP with Consent Mode v2 enabled by default, IAB TCF v2.4 certification, and a documented Microsoft UET consent mode section.
- Deep banner customisation across three layouts, colour themes, custom CSS, 30+ auto-translated languages, and GDPR versus US-state templates with geo-targeting.
- A consent log recording consent ID, domain, UTC date and time, country, a pseudonymised IP and category-wise status, exportable as a PDF Proof of Consent.
Held against it
- Sovereignty scores 3 to 4 — hosting is on AWS with no region stated, and the privacy policy says personal data may be stored and processed in any country where the company has operations.
- We found no public information on where the banner script is served, where consent logs sit, or who owns the company.
- We found no public information on alerts when a new or changed tracker appears, on scanning local storage and pixels, or on consent-rate analytics and A/B testing.
- We found no public information tying consent records to the banner version shown, on withdrawal recorded as its own event, or on search and export of the log through an API.
- The documentation includes an optional close button that lets visitors browse without choosing, and an option to load cookies before consent that sits alongside the vendor's own warning that this is not GDPR-compliant.
Best for
- You run sites on WordPress, Shopify, Wix or any CMS and want automatic blocking of third-party scripts before consent, with a Google Tag Manager template and JavaScript consent events.
- Your ad revenue depends on Google and Microsoft signals — Google-certified Consent Mode v2 on all plans, Google Additional Consent Mode, and Microsoft UET consent mode documented down to granted and denied behaviour.
- You need to compute the annual bill from public pages — $0, $10, $25 and $55 per month per domain with pageview limits per tier and $0.30 per 1,000 extra pageviews.
- You serve visitors across countries and languages — 30+ banner languages with auto-translation and per-country GDPR and US-state consent templates.
Avoid if
- You require a stated hosting region or EU storage for consent data — ask the vendor: the public pages we read do not show it
- Your audit or litigation file must show exactly which banner version and texts a visitor saw — the documented log records consent ID, domain, date and time in UTC, country, a pseudonymised IP and consent status.
- You need every visitor to register a choice — the documentation includes an optional close button that lets a visitor browse without responding.
- You need IAB TCF on the Free or Basic plan — TCF support is documented as available on the Pro and Ultimate plans.
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 3.5 of 5 |
| Prior blocking & script control | 3.5 of 5 |
| Scanning & cookie classification | 3 of 5 |
| Consent records & proof | 3 of 5 |
| Frameworks, signals & platforms | 3.5 of 5 |
| European sovereignty | 2 of 5 |
| Pricing transparency | 4 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Automatic script blocking is documented in depth: third-party scripts and their cookies stay blocked until consent, only strictly necessary cookies should be present beforehand, embedded YouTube and Vimeo videos get editable placeholder text, and consent state is exposed through JavaScript events and a Google Tag Manager trigger. The help centre gives the site owner browser steps to verify nothing loads early. We found no public information on server-side tagging or on blocking that covers local storage, pixels or fingerprinting rather than cookies. 4 9 11 12 18
The Agency Developer
Automatic blocking of third-party scripts and cookies before consent has its own documentation page, embedded YouTube and Vimeo videos get a placeholder with editable text, there is a Google Tag Manager implementation route, documented consent events a plugin can listen to, and a step-by-step Chrome DevTools check that nothing loads early. We found no public information on a manual blocking mode with its limits, server-side tagging, or consent passed to forms and CAPTCHAs. 4 9 11 12 18
The Publisher Marketing Lead
Automatic blocking of third-party scripts before consent, with strictly necessary cookies exempt, editable placeholder text over blocked YouTube and Vimeo embeds, a Google Tag Manager template with a custom consent-update trigger, and a documented Chrome DevTools check that nothing fires early. We found no public information on server-side tagging, consent passed to forms or CAPTCHAs, or an automated monitor that reports scripts set before consent on the live site. 11 12 9 4 18
The In-House Lawyer
Automatic blocking of third-party scripts and cookies until consent, with only strictly necessary cookies beforehand, placeholder text over embedded videos, a Google Tag Manager template, a consent-update trigger event, and a documented Chrome DevTools procedure to verify nothing loads early. We found no public information on a manual blocking mode, server-side tagging, or an automated monitor that reports pre-consent trackers on the live site. The documented verification is a manual self-test, which is workable but not systematic proof. 4 9 11 12 18
The WordPress Webmaster
Automatic blocking of third-party scripts before consent is documented in the help centre, with editable placeholder text over blocked YouTube and Vimeo embeds, a Google Tag Manager template, consent-update events for tag managers and scripts, and Chrome DevTools steps to check that nothing loads before consent — exactly what I need for my Analytics and Maps embeds. We found no public information on a manual blocking mode with its limits, server-side tagging, or consent being passed to forms and CAPTCHAs, which matters with my reCAPTCHA contact form. 11 12 9 18 4
The Skeptic
Automatic blocking of third-party scripts and cookies before consent is claimed and the method is written up in the help pages, with editable placeholder text over blocked video embeds, a Google Tag Manager template, JavaScript events for consent updates, and published browser steps to check that only strictly necessary cookies exist before acceptance. It stops short of the deeper band: we found no public information on a manual blocking mode and its limits, server-side tagging, consent passed to forms or CAPTCHAs, or an automated monitor that reports early loads on the live site. 11 12 4 13 18 9
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
Scanning is concrete and tiered: 100 to 8,000 pages per scan depending on the plan, monthly or weekly scheduled rescans, scanning behind logins and from a static IP on the top plan, classification against a database of 100,000+ pre-categorised cookies with descriptions, and a cookie-policy generator. We found no public information on alerts when a new or changed tracker appears, on scanning local storage or pixels, or on a declaration that updates itself automatically from the scan. 1 5 13
The Agency Developer
The scanner is scheduled — monthly on Pro, weekly on Ultimate — with pages-per-scan limits per tier from 100 to 8,000, scan-behind-login and static IP scanning on the top plan, and classification against a database of 100,000+ pre-categorised cookies. For an agency like mine the gap is alerting: we found no public information on alerts when a new or changed tracker appears, on scanning local storage and pixels, or on a declaration that updates itself in several languages. 1 5 13
The Publisher Marketing Lead
Scans are scheduled monthly (weekly on the top tier) with stated depth — 100 pages per scan on free up to 8,000 on Ultimate — plus scan-behind-login and static-IP scanning options, all classified against a database of 100,000+ pre-categorised cookies, with cookie and privacy policy generators to publish the result. We found no public information on local storage and pixel detection, alerts on new or changed trackers, or a declaration that updates itself automatically in several languages. 5 13 1
The In-House Lawyer
A scanner runs against a database of 100,000+ pre-categorised cookies, with scheduled monthly or weekly rescans, stated page depths per tier (600, 4,000 and 8,000 pages), behind-login and static-IP scanning on the top tier, and policy generators plus scan results flowing into the banner. We found no public information on alerts when new or changed trackers appear, scanning of local storage or pixels, or exportable scan reports. For my shops I would still re-check the declaration manually after every release. 1 5 13 14
The WordPress Webmaster
The scanner delivers an instant report without sign-up, scheduled monthly scanning (weekly on the top tier) with stated scan depths per plan from 100 up to 8,000 pages, scan-behind-login and static-IP scanning on the top tier, and classification against a database of 100,000+ pre-categorized cookies with descriptions, feeding a cookie policy generator and the banner. We found no public information on scanning local storage or pixels, email alerts when new or changed trackers appear, or the declaration updating automatically in several languages. 13 5 1 4 14
The Skeptic
The scanner is scheduled monthly (weekly on the top tier) with a stated page count per plan (100 to 8,000 pages per scan), a database of 100,000+ pre-categorized cookies with descriptions, an instant free report without email, scan-behind-login on the top plan, and scan results feeding the banner and cookie policy. What keeps it from the top: we found no public information on alerts when new or changed trackers appear, scanning of local storage and pixels rather than cookies, or a declaration that updates itself in several languages. 13 5 1 2 14
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
Every consent is logged on the server with a consent ID, date and time in UTC, country, a pseudonymised IP with the last segment masked, and overall and category-wise status including cookie names, purposes and durations; a PDF "Proof of Consent" export exists and expiry is configurable at 365 days by default. For my files the gap is decisive: we found no public information tying each record to the banner version and texts the visitor saw, on how long consent logs are kept, on withdrawal recorded as its own event, or on export through an API. 4 9 15 16
The Agency Developer
The consent log records consent ID, domain, date and time in UTC, country, a pseudonymised IP, and overall and category-wise status, a Proof of Consent can be generated as a PDF, consent expiry is configurable with a 365-day default, and the DPA covers retention for the duration of the agreement with deletion within 60 days of termination. We found no public information on records tied to the banner version and texts shown, withdrawal recorded as its own event, or search and export of the log through an API. 8 9 13 15 16
The Publisher Marketing Lead
The log records consent ID, date and UTC time, country, a pseudonymous IP with the last segment masked, and per-category status with cookie names, purposes and durations; there is a PDF proof-of-consent export, the consent ID is also readable in the visitor's own cookie, expiry is configurable (365 days by default) and subdomain consent sharing starts on Pro. We found no public information on records tied to the banner version shown, withdrawal recorded as its own event, or exporting the log through an API. 15 16 9 5 13
The In-House Lawyer
Each consent is logged with a consent ID, UTC timestamp, country, pseudonymous IP address and category-level choices, exportable as a proof-of-consent PDF, with expiry configurable at a 365-day default and retention stated as the duration of the agreement in the data processing agreement. We found no public information tying each record to the banner version and texts the visitor actually saw, no withdrawal recorded as its own event, and no API-based export of the log. If a competitor or a consumer group sued, I could not reconstruct from this documentation exactly what the visitor was shown. 8 9 13 15 16
The WordPress Webmaster
The consent log records consent ID, date and time, country, overall and category-wise status and a pseudonymous IP, viewable in the dashboard, with a Proof of Consent PDF export and the visitor's consent ID findable in their browser cookie; consent expiry is configurable (365 days by default) and the data processing agreement retains data for the duration of the agreement. We found no public information on records being tied to the banner version shown, withdrawal recorded as its own event, or search and export of the log through an API. 15 16 9 8 13
The Skeptic
Every consent is logged on the vendor's servers with a consent ID, consented domain, date and time in UTC, country, a pseudonymous IP with the last segment masked, overall and category-wise status, and a Proof of Consent exportable as PDF; expiry is configurable with a 365-day default, and customer data is returnable in machine-readable form free of charge within 30 days of termination. I still ask the audit questions: we found no public information tying each record to the banner version and texts shown, no stated retention period for the consent log itself, and no documented API search or open-format export of the log. 15 16 9 4 6
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
The signal chain is broad for the web: IAB TCF v2.4 with IAB and Google CMP certification, Google Consent Mode v2 enabled by default plus Additional Consent Mode, Microsoft UET consent mode via Tag Manager or a custom script, Global Privacy Control from the Pro plan, WordPress, Shopify and Wix apps, and documented JavaScript events. We found no public information on a registered CMP ID number, the Global Privacy Platform, iOS or Android SDKs, connected TV, or a REST API for configuration; agency use appears only as a partner programme. 2 4 5 17 18
The Agency Developer
The signal story is strong: registered IAB TCF v2.4 certification, Google-certified for Consent Mode v2 including Additional Consent Mode, a full documentation page on Microsoft UET consent mode with granted and denied behaviour, Global Privacy Control from Pro, WordPress, Shopify and Wix apps, a Google Tag Manager trigger event, and an agency partner programme. We found no public information on a REST configuration API, iOS or Android SDKs, GPP, or a published CMP ID number — and TCF itself sits behind the Pro and Ultimate plans. 1 2 4 5 17 18
The Publisher Marketing Lead
This hits my must-haves on paper: a Google-certified CMP with Consent Mode v2 on all plans, IAB TCF v2.4 with an IAB-approved banner showing the Global Vendor List and Google's ATP list (though TCF sits on Pro and Ultimate only), Google Additional Consent Mode, a genuinely detailed Microsoft UET consent mode section with ad storage behaviour, GPC from Pro, and WordPress, Shopify and Wix apps. We found no public information on a registered CMP ID number, the split between basic and advanced Consent Mode, GPP, iOS or Android SDKs, or a REST API — so the one-consent-across-site-and-app story I need is undocumented. 17 4 5 18 3 2
The In-House Lawyer
The IAB TCF v2.4 certification and Google Consent Mode v2 certification are documented, Microsoft UET consent mode is explained down to the granted and denied behaviour of ad storage, Global Privacy Control arrives from the Pro plan, and WordPress, Shopify and Wix plugins plus a GTM trigger and JavaScript events cover the web estate. We found no public information on iOS or Android SDKs, GPP, or a REST configuration API, and TCF support sits behind the paid tiers. The UET documentation notes that with no default set, granted applies — a default I would override for European traffic. 3 4 5 12 17 18
The WordPress Webmaster
CookieYes is documented as a Google-certified CMP with Consent Mode v2 enabled by default on all plans, Google Additional Consent Mode, IAB TCF v2.4 with the Global Vendor List and Google's ad tech provider list, and Microsoft UET consent mode via Tag Manager or custom script; there are WordPress, Shopify and Wix apps plus any-CMS installation, Global Privacy Control from Pro, and an agency partner programme. We found no public information on the registered CMP ID number, GPP support, iOS or Android SDKs, or a REST API for configuration — and IAB TCF sits only on the Pro and Ultimate plans. 17 4 5 18 2 1
The Skeptic
The signal chain is broad and documented: Google-certified CMP status with Consent Mode v2 enabled by default and Additional Consent Mode, IAB TCF v2.4 with vendor-list configuration options, Microsoft UET consent mode written up down to what a denied ad storage does, Global Privacy Control from the Pro plan, WordPress, Shopify and Wix plugins, GTM triggers and JavaScript events. We found no public information on iOS or Android SDKs, connected TV, the Global Privacy Platform, a REST API, or the difference between basic and advanced Consent Mode behaviour. 17 18 4 5 2 12
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
The contracting entity is CookieYes Limited, registered in the United Kingdom; hosting is on AWS with no region stated, and the privacy policy says personal data may be stored and processed in any country where the company has operations. Subprocessors are named — Google, Hotjar, Stripe, Intercom, Zendesk, Sendgrid among them — but without their locations, and a published data processing agreement with EU standard contractual clauses and an EU representative in Ireland are the stated safeguards. We found no public information on EU hosting, where the banner script is served from, or where consent logs and scan results sit. 7 8 13
The Agency Developer
The contracting entity is CookieYes Limited, registered in the UK with company number 13074037, an EU representative in Ireland is named, a DPA is published using SCCs, and subprocessors including Stripe, Intercom, Zendesk and Sendgrid are named in the privacy policy, though without their locations. Hosting is on AWS covered by ISO 27001 and SOC 2 data-centre attestations, but no region is stated and the privacy policy says personal data may be stored and processed in any country where they have operations — the weak link when a client asks where every visitor's consent sits. 7 8 18
The Publisher Marketing Lead
The contracting entity is UK-registered CookieYes Limited in Milton Keynes, with an EU representative in Ireland and a published DPA relying on SCCs, but the picture stops there: subprocessors are named (Stripe, Intercom, Zendesk, Sendgrid among others) without locations, hosting is AWS with no region stated, and the privacy policy says personal data may be stored and processed in any country where the company has operations. For a script that loads on every page and sees every one of my visitors, this chain cannot be shown to be European from what is published. 8 7 13
The In-House Lawyer
The contracting entity is CookieYes Limited, registered in the UK, the data processing agreement cites AWS hosting without a region, and the privacy policy itself says personal data may be stored and processed in any country where the company has operations. Several US providers are named in the privacy policy, but the service's own sub-processor list is available only on request; the Irish-law standard contractual clauses and the Irish EU representative are the only European anchors, with a published DPA. For shops in Germany, France and Austria I would not sign before seeing the hosting region and the full sub-processor list. 6 7 8 11
The WordPress Webmaster
The contracting entity is CookieYes Limited, a UK company in Milton Keynes, with a published data processing agreement naming AWS hosting (region unstated), a sub-processor list with 30-day change notice, and suppliers such as Stripe, Zendesk, Intercom and Sendgrid named in the privacy policy; an Irish EU representative and EU standard contractual clauses under Irish law are in place. We found no public information on where the banner script is served or the consent logs stored, on EU hosting, or on the company's ownership — so the chain behind a script that loads on every page of my site stays partly dark. 8 7 18 6
The Skeptic
The contracting entity is UK-registered with an Irish EU representative and supervisory authorities named for the EU, UK and Switzerland; a DPA is published, subprocessors are named (Google, Hotjar, Stripe, Sendgrid, SendinBlue, Getresponse, Intercom, Zendesk) with SCC-based transfer safeguards, and hosting runs on AWS with ISO 27001 and SOC 2 attested data centres. I still do not know where my consent logs sit: the hosting region is unstated, the privacy policy says personal data may be stored in any country where the company has operations, and we found no public information on where the banner script is served from or who owns the vendor. 13 7 8
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
A buyer can compute most of the annual cost from public pages: $0, $10, $25 and $55 per domain per month with stated page-view limits per tier, overage at $0.30 per 1,000 extra pageviews, scan depth per plan, 2 months free on annual billing, VAT stated as charged in addition, and terms covering advance billing, 30-day termination notice and the trial converting automatically to a paid subscription. Not computable from public pages: the Enterprise tier with its custom contracts and any agency or reseller fee. 5 6
The Agency Developer
From public pages alone I can quote a client: $0, $10, $25 and $55 per month per domain with pageview limits from 5,000 to unlimited, overage at $0.30 per 1,000 extra pageviews, pages-per-scan limits per tier, two months free on annual billing, VAT charged in addition, and subdomains counting as separate domains. Enterprise is custom contracts, and we found no public information on agency or reseller terms, separately priced add-ons, or the minimum term length. 1 5 6
The Publisher Marketing Lead
Prices are fully public — free, Basic at $10 /month /domain, Pro at $25 /month /domain, Ultimate at $55 /month /domain, each with pageview limits (5,000 on free up to unlimited) and overage at $0.30 per 1,000 extra pageviews, two months free on annual billing, VAT treatment stated, and feature gating documented tier by tier including TCF from Pro. Enterprise sits on custom contracts and the agency partner programme publishes no fee terms, so a full annual cost for an agency setup or a large multi-domain estate cannot be computed from public pages alone. 5 6 17 1
The In-House Lawyer
Every tier is public with its per-domain monthly price, its pageview allowance, overage at $0.30 per 1,000 extra pageviews, scan limits, VAT charged in addition, an annual discount of two months free, 30-day termination notice, and free machine-readable export of customer data within 30 days of termination. Agency partner types are listed but unpriced, and we found no public information on setup fees. A buyer can compute the real annual cost for a given number of domains and traffic from the public pages alone. 1 5 6 17
The WordPress Webmaster
All four tiers are published per domain per month — Free at $0, Basic at $10, Pro at $25, Ultimate at $55 — with pageview allowances per tier, extra pageviews at $0.30 per 1,000, scan limits per tier, an annual "2 months free" discount, VAT charged in addition, a 14-day trial that auto-converts to a paid subscription, and termination on 30 days notice. What keeps it short of full computability for me is the Enterprise tier on custom contracts and no published agency or reseller terms, though subdomains counting as separate domains is clearly defined. 5 6 17
The Skeptic
A buyer can compute most of the bill: $0, $10, $25 and $55 per month per domain with pageview limits (5,000 / 100,000 / 300,000 / unlimited), a published overage of $0.30 per 1,000 extra pageviews, scan page counts per tier, two months free on annual billing, VAT stated as charged in addition, and the terms defining each fully qualified domain as a separate licence. The gaps: Enterprise is custom contracts, the minimum term length is not published, the 14-day trial auto-converts to a paid subscription with no refunds on early termination, and agency or reseller fees are not priced. 5 6 17 1
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about CookieYes
Is CookieYes European?
Yes, though not from the EU. whats-best.ai classifies CookieYes as UK / wider Europe.
Where does CookieYes store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does CookieYes have a free plan?
Yes. CookieYes has a free plan, per the vendor’s page captured 29 Oct 2026.
What are the best alternatives to CookieYes?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: CookieYes alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 16 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (19)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.cookieyes.com Checked 29 Oct 2026 Details →
- 2 Features page (cookie consent) www.cookieyes.com Checked 29 Oct 2026 Details →
- 3 Features page (IAB TCF) www.cookieyes.com Checked 29 Oct 2026 Details →
- 4 Features page (Google Consent Mode) www.cookieyes.com Checked 29 Oct 2026 Details →
- 5 Pricing page www.cookieyes.com Checked 29 Oct 2026 Details →
- 6 Terms of service www.cookieyes.com Checked 29 Oct 2026 Details →
- 7 Privacy policy www.cookieyes.com Checked 29 Oct 2026 Details →
- 8 Data processing agreement (dpa) www.cookieyes.com Checked 29 Oct 2026 Details →
- 9 Banner & choice architecture — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
- 10 Banner & choice architecture — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
- 11 Prior blocking & script control — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
- 12 Prior blocking & script control — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
- 13 Scanning & cookie classification — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
- 14 Scanning & cookie classification — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
- 15 Consent records & proof — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
- 16 Consent records & proof — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
- 17 Frameworks, signals & platforms — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
- 18 Frameworks, signals & platforms — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
- 19 Self-hosting / on-premises installation docs — found from the homepage www.cookieyes.com Checked 1 Nov 2026 Details →