# CookieYes — Consent Management (CMP) CookieYes by CookieYes Limited holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-10-30. Provenance: UK / wider Europe; sovereignty: not determined. - Vendor: CookieYes Limited (https://www.cookieyes.com/) - Category: [Consent Management (CMP)](https://whats-best.ai/software/consent-management.md) - Provenance (editorial classification): UK / wider Europe - Canonical page: https://whats-best.ai/software/consent-management/cookieyes - Alternatives: https://whats-best.ai/software/consent-management/cookieyes/alternatives ([markdown](https://whats-best.ai/software/consent-management/cookieyes/alternatives.md)) - Data as of: 2026-11-04 · evaluated 2026-10-30 · oldest source captured 2026-10-29 **AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology ## At a glance - Vendor: CookieYes Limited - Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026 - Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026 - Free plan: Yes, per the vendor’s own page [S1] ## The panel's verdict CookieYes scores best on pricing transparency, 7 to 8: four published tiers at $0, $10, $25 and $55 per month per domain, pageview limits per tier, and overage at $0.30 per 1,000 extra pageviews. Banner and choice, prior blocking, scanning and classification, and standards and platforms cluster at 6 to 7, backed by documented depth: three banner layouts, 30+ languages with auto-translation, GDPR and US-state templates, automatic blocking of third-party scripts before consent, scheduled scans of 100 to 8,000 pages against 100,000+ pre-categorised cookies, and Google Consent Mode v2 and IAB TCF v2.4 certification — TCF limited to Pro and Ultimate. Sovereignty is the low at 3 to 4: the contracting entity is UK-registered CookieYes Limited, hosting is on AWS with no region stated, and the privacy policy says personal data may be stored and processed in any country where the company has operations. Consent records draws the widest spread, 5 to 7 — the data protection officer scored it 5 over no public information on consent-log retention or the banner version shown. Persona-weighted totals run 5.7 to 6.6. **Speaks for it:** - Published per-domain pricing at $0, $10, $25 and $55 per month with pageview limits per tier and overage at $0.30 per 1,000 extra pageviews. - Automatic blocking of third-party scripts and cookies before consent, with documented browser steps to verify nothing loads early. - Google-certified CMP with Consent Mode v2 enabled by default, IAB TCF v2.4 certification, and a documented Microsoft UET consent mode section. - Deep banner customisation across three layouts, colour themes, custom CSS, 30+ auto-translated languages, and GDPR versus US-state templates with geo-targeting. - A consent log recording consent ID, domain, UTC date and time, country, a pseudonymised IP and category-wise status, exportable as a PDF Proof of Consent. **Held against it:** - Sovereignty scores 3 to 4 — hosting is on AWS with no region stated, and the privacy policy says personal data may be stored and processed in any country where the company has operations. - We found no public information on where the banner script is served, where consent logs sit, or who owns the company. - We found no public information on alerts when a new or changed tracker appears, on scanning local storage and pixels, or on consent-rate analytics and A/B testing. - We found no public information tying consent records to the banner version shown, on withdrawal recorded as its own event, or on search and export of the log through an API. - The documentation includes an optional close button that lets visitors browse without choosing, and an option to load cookies before consent that sits alongside the vendor's own warning that this is not GDPR-compliant. **Best for:** - You run sites on WordPress, Shopify, Wix or any CMS and want automatic blocking of third-party scripts before consent, with a Google Tag Manager template and JavaScript consent events. - Your ad revenue depends on Google and Microsoft signals — Google-certified Consent Mode v2 on all plans, Google Additional Consent Mode, and Microsoft UET consent mode documented down to granted and denied behaviour. - You need to compute the annual bill from public pages — $0, $10, $25 and $55 per month per domain with pageview limits per tier and $0.30 per 1,000 extra pageviews. - You serve visitors across countries and languages — 30+ banner languages with auto-translation and per-country GDPR and US-state consent templates. **Avoid if:** - You require a stated hosting region or EU storage for consent data — ask the vendor: the public pages we read do not show it - Your audit or litigation file must show exactly which banner version and texts a visitor saw — the documented log records consent ID, domain, date and time in UTC, country, a pseudonymised IP and consent status. - You need every visitor to register a choice — the documentation includes an optional close button that lets a visitor browse without responding. - You need IAB TCF on the Free or Basic plan — TCF support is documented as available on the Pro and Ultimate plans. ## Scores by judge and criterion Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion. | Criterion | The Data Protection Officer | The Agency Developer | The Publisher Marketing Lead | The In-House Lawyer | The WordPress Webmaster | The Skeptic | | --- | --- | --- | --- | --- | --- | --- | | Banner & choice architecture | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | | Prior blocking & script control | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 | 3/5 | 3/5 | | Scanning & cookie classification | 3/5 | 3/5 | 3.5/5 | 3/5 | 3.5/5 | 3/5 | | Consent records & proof | 2.5/5 | 3/5 | 3.5/5 | 3/5 | 3/5 | 3/5 | | Frameworks, signals & platforms | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | | European sovereignty | 2/5 | 2/5 | 2/5 | 1.5/5 | 2/5 | 2/5 | | Pricing transparency | 4/5 | 3.5/5 | 3.5/5 | 4/5 | 4/5 | 3.5/5 | | **Weighted verdict** | **3/5** | **3.5/5** | **3.5/5** | **3/5** | **3.5/5** | **3/5** | ### The judges - **The Data Protection Officer** (v1.0): External DPO for a dozen mid-sized companies, two of which received a letter from a state supervisory authority about their cookie banner last year. Wants reject on the first layer, nothing loaded before the click, a consent log that shows which banner version each visitor saw, a cookie list that matches the site, and a DPA and subprocessor list that keep visitor data in the EU. - **The Agency Developer** (v1.0): Lead developer at a web agency that maintains forty client sites on WordPress, TYPO3 and Shopify. Wants one account for every client, blocking that works without rewriting each theme, content blockers for YouTube and Maps, a Tag Manager template, a scanner that flags the tracker a client added on Friday, and a JavaScript API documented well enough that forms and plugins can ask for consent. - **The Publisher Marketing Lead** (v1.0): Runs marketing for an ad-funded news site and an online shop in the same group, where every point of consent rate shows up in ad revenue and in Google Ads conversions. Wants a registered IAB TCF CMP, Google Consent Mode v2 in advanced mode, banner tests within what the law allows, consent shared between the site and the app, and a dashboard that shows where visitors drop off. - **The In-House Lawyer** (v1.0): In-house counsel at a retailer with shops in Germany, France and Austria, who has read the court decisions on missing reject buttons and the regulators' banner guidance. Wants § 25 TDDDG and the GDPR mapped to concrete settings, equal-weight choices as the default, consent that can be withdrawn as easily as it was given, and records that would hold up if a competitor or a consumer group sued. - **The WordPress Webmaster** (v1.0): Looks after the WordPress site of a mid-sized engineering company on top of the actual job, with Google Analytics, a YouTube channel, a Maps embed and a contact form with reCAPTCHA. Wants a plugin that finds these by itself, blocks them until the visitor agrees, survives the next plugin update and caching, and costs a known amount per site per year without a call to sales. - **The Skeptic** (v1.0): Has opened the browser's network tab on sites with a "certified" banner and watched the ad pixels fire before anything was clicked. Reads "consent rate optimisation" as a hint that reject will be grey and small, "auto-blocking" as a claim until the test steps are published, and "EU hosting" next to a US script CDN — and asks what leaving would cost: the consent logs, and every visitor asked again. ## European sovereignty — proven facts Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined. | Dimension | Finding | Points | Source | |---|---|---|---| | Legal entity | Not determined | — | — | | Hosting location | Not determined | — | — | | Hosting options | Not determined | — | — | | Open source | Not determined | — | — | | Data processing agreement | Not determined | — | — | | Transfer impact assessment | Not determined | — | — | ## Key facts Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources). **Compliance** - Assistance fees: yes [S8] - Audit reports on request: 1 [S8] - Aws hosting: AWS [S8] - Backup frequency: hourly · daily [S8] - Breach notification: 72 [S8] - Controller vs processor scope: applies only when CookieYes is a data controller; not when acting as data processor/B2B service provider [S7] - Data deletion: 1 · 60 · 30 [S8] - Data portability tools: yes [S8] - Data retention period: duration of the Agreement [S8] - Datacenter certifications: ISO 27001 · SSAE 16 SOC 1 Type II · SOC 2 [S8] - DPA: yes [S1] - DPA: yes [S2] - DPA available: yes [S12] - DPA available: yes [S16] - DPA exists: cookieyes.com/dpa/ · yes [S6] - DPA precedence: yes [S6] - DPA with subprocessors: yes [S7] - Dpiassistance: yes [S8] - Dsar portal: https://gdpr.euverify.com/verify/2ea0ee81-7313-46b6-ae78-80863e25f8d6 [S7] - Encryption at rest: AES256 + LUKS [S8] - Encryption in transit: TLS [S8] - EU representative: Euverify Ltd (Ireland) · gdpr@euverify.com [S7] - EU scc governing law: courts of Ireland · Irish law [S8] - EU transfers scc: adequacy · EU SCCs · BCRs · EU-U.S. DPF · other EC-approved mechanisms [S7] - GDPR warning: Loading cookies prior to consent or hiding cookie categories are not GDPR-compliant practices [S9] - Google certified cmp: yes [S17] - Governing law: courts of England · England and Wales [S8] - Iab certified cmp: yes [S17] - International transfers scc: adequacy · IDTA · BCRs · UK Extension to EU-U.S. DPF · other ICO-approved mechanisms [S7] - Legitimate interest assessment: yes [S7] - No sale of data: no [S7] - No sensitive data: no [S8] - No special category data: no [S7] - Openai conversion data: purchase amount · currency · ad-click attribution reference · ad effectiveness on ChatGPT platform · OpenAI · yes [S7] - Pen test: yes [S8] - Regulations supported: GDPR (EU & UK), CCPA/CPRA, VCDPA, PIPEDA [S1] - Regulations supported: GDPR EU & UK · CCPA California · CPRA California · IAB TCF v2.4 · Google Consent Mode [S12] - Roles: processor · controller [S6] - Sensitive data handling: yes [S8] - Sub processor list on request: yes [S7] - Subprocessor list: yes [S8] - Subprocessor notice: email · 30 [S8] - Subprocessor refund: yes [S8] - Supervisory authorities: Irish DPC · ICO · FDPIC [S8] - Support dnt: yes [S7] - Swiss transfers: adequacy · EU SCCs · BCRs · Swiss-U.S. DPF [S7] - Tcf deadlines: 2026-10-23 · 2027-02-23 [S3] - Third party marketing opt in: yes [S7] - UK addendum: B1.0, in force 21 March 2022 · yes [S8] **Data** - Deletion on termination: machine-readable · 30 · yes [S6] - Export formats: yes · yes [S6] - Fees for requests: 0 · clearly unfounded, repetitive or excessive requests [S7] - Retention: yes [S7] - Rights available: access · rectification · deletion · restriction · objection · data_portability · withdraw_consent [S7] - Rights response time: 30 [S7] **Integrations** - Cms: yes [S13] - Google: Google Tag Manager · Consent Mode V2 · IAB TCF v2.4 [S1] - Google consent mode: Google Consent Mode, Google Tag Manager, exportable consent logs [S13] - Partner program: Agency Partner · Affiliate Partner · Strategic Partner · Partner Directory [S1] - Shopify app: yes [S2] - Wix app: yes [S2] - Wordpress plugin: yes [S2] **Legal** - Age restriction: 18 [S7] - Change notice: email · 30 [S6] - Company details: UK · 13074037 [S11] - Company number: 13074037 [S8] - Company number: 13074037 [S7] - Company registration: CookieYes Limited · UK · 13074037 [S3] - Company registration: CookieYes Limited · UK · 13074037 [S12] - Company registration: CookieYes Limited · UK · 13074037 [S16] - Company registration: CookieYes Limited · UK · 13074037 [S17] - Company registration: CookieYes Limited · UK · 13074037 [S18] - Disclaimer no legal advice: content does not constitute legal or regulatory advice [S10] - Document DPA: Data Processing Agreement available in footer legal links [S17] - DPA: yes [S13] - DPA available: yes [S5] - DPA available: yes [S11] - Entity: CookieYes Limited · UK · 13074037 [S1] - Entity: UK · 13074037 [S2] - Entity: CookieYes Limited · UK · 13074037 [S5] - Entity: CookieYes Limited · UK · 13074037 [S10] - Entity: CookieYes Limited · 3 Warren Yard Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom · GB381305513 · 13074037 [S6] - Entity: CookieYes Limited · UK · 13074037 [S9] - Entity: 3 Warren Yard Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom · CookieYes Limited [S7] - Entity: CookieYes Limited · UK · 13074037 [S13] - Governing law: England and Wales · England [S6] - Jurisdiction: EU · UK [S7] - Last updated: 2025-09-10 [S7] - Liability cap: 100% of fees in prior 12 months [S6] - No contract: no [S7] - Processor entity: CookieYes Limited · 3 Warren Yard Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom [S8] - Registration: CookieYes Limited · UK · 13074037 [S15] - Termination notice: 30 [S6] - UK authority: The Information Commissioner's Office [S7] **Pricing** - Annual discount: 2 months free [S2] - Annual discount: 2 months free [S5] - Basic price: USD · 10 [S5] - Cancel anytime: yes [S1] - Cancel anytime: yes [S4] - Enterprise available: yes · yes [S5] - Extra pageviews: USD · 0.3 [S5] - Free price: USD · 0 [S5] - Free tier: yes [S1] - Free trial: yes · 14 [S3] - Invoice price source: current online price list at invoice time [S6] - No refunds on termination: no [S6] - Payment advance: in_advance · credit_card · debit_card [S6] - Pro price: USD · 25 [S5] - Taxes exclusive: yes · yes [S6] - Trial: yes · 14 [S1] - Trial: 14 · 0 [S5] - Trial: 14 · yes [S13] - Trial auto conversion: yes [S6] - Trial days: yes · 14 [S4] - Trial no fees: yes [S6] - Ultimate price: USD · 55 [S5] - VAT: no [S2] - VAT: charged in addition to prices [S5] **Product** - 2FA: yes [S5] - Accessible worldwide: any country where we have operations [S7] - AI features: no · yes [S6] - Auto block cookies: yes [S4] - Auto block third party scripts: Auto-blocks third-party scripts that set cookies [S11] - Automated consent management: cookie auto-blocking · scheduled monthly scanning · centralised consent log [S1] - Automatic blocking: automatic blocking of third-party scripts prior to consent [S13] - Automatic script blocking: yes [S11] - Banner compatibility: yes [S2] - Banner customisable: responsive pre-built banner layouts [S4] - Banner customization: yes · yes · yes [S3] - Banner customization: banner customization with colour, content, behaviour, branding, CSS [S13] - Banner geo targeting: yes · yes [S4] - Banner languages: 30+ [S2] - Banner layouts: Box · Banner · Popup [S9] - Banner positions: Bottom · Top [S9] - Basic limits: 600 · 100000 [S5] - Blocked content text: yes [S9] - Box positions: Bottom left · Bottom right · Top left · Top right [S9] - Categories first layer layout: Banner + Push down [S9] - Certifications: Google Certified CMP · IAB TCF Certified CMP · GDPR Compliant Data Storage · WCAG Accessibility Certified · PCI DSS Certified Payment Gateway [S5] - Close button: yes [S9] - Cms integration: yes [S4] - Colour themes: Light · Dark · Auto-generated · Custom [S9] - Consent cookie name: cookieyes-consent [S18] - Consent expiration configurable: yes [S9] - Consent expiration default: 365 [S9] - Consent id cookie: consentid · cookieyes-consent [S16] - Consent log: yes [S4] - Consent log country plans: Basic · Pro · Ultimate [S15] - Consent log definition: Records all user consents given via the banner [S15] - Consent log enablement: Enabled via Advanced Settings > Consent Settings > Consent log toggle [S15] - Consent log fields: consented domain · consent date · consent ID · location · pseudonymous IP address · consent status · category-wise consent status [S16] - Consent log location: Consent log accessible via Dashboard > Consent Log in app.cookieyes.com [S16] - Consent log records: Consent ID · Country · Consent Status · Date & Time · Proof of Consent · UTC [S15] - Consent mode default: yes [S4] - Consent templates: GDPR · US STATE LAWS · GDPR & US STATE LAWS [S9] - Consent withdrawal widget: yes [S3] - Cookie consent summary: Custom cookie banner, script blocking, consent recording without code [S2] - Cookie database: 100000 [S13] - Cookie list second layer: yes [S9] - Cookie scans: 5 scans/month · unlimited [S5] - Cookies after optin: Cookies only set after user opts in for specific cookie categories [S11] - Custom branding: yes [S2] - Custom css: no · yes [S5] - Custom css plans: Basic · Pro · Ultimate [S9] - Custom event cookieyes banner load: cookieyes_banner_load · eventData.detail.categories.advertisement [S18] - Custom event cookieyes consent update: cookieyes_consent_update · eventData.detail.accepted [S18] - Custom logo: yes [S5] - Custom logo plan: Ultimate [S9] - Customer count: product.gcm_mandate_eea_uk · Starting March 2024, Google has mandated the use of Consent Mode to access measurement, ad personalization, and remarketing features for users in the European Economic Area and the UK. · {"mandate_from": "March… [S4] - Customer count: 1500000 [S13] - Customisable banner: yes [S1] - Customisation matrix: 2 · 2 · 3 · 3 [S5] - Documentation last updated: 2025-06-12 [S18] - Domain definition: FQDN · yes [S6] **Subprocessors** - Intercom: Intercom - live chat customer support [S7] - Named: Google · Hotjar [S7] - Stripe: Stripe - payment services [S7] - Zendesk: Zendesk - chat/communication services [S7] **Support** - Channels: yes · yes [S5] - Docs: yes [S5] - Help center: Help Center · Contact Us [S1] 76 more facts on the canonical page: https://whats-best.ai/software/consent-management/cookieyes ## Questions ### Is CookieYes European? Yes, though not from the EU. whats-best.ai classifies CookieYes as UK / wider Europe. ### Where does CookieYes store data? Not stated on the vendor’s pages as of 1 Nov 2026. ### Does CookieYes have a free plan? Yes. CookieYes has a free plan, per [the vendor’s page captured 29 Oct 2026](https://whats-best.ai/evidence/12359). ### What are the best alternatives to CookieYes? As of 3 Nov 2026, the panel rates [Usercentrics CMP (3.5/5)](https://whats-best.ai/software/consent-management/usercentrics), [Didomi (3.5/5)](https://whats-best.ai/software/consent-management/didomi) and [CCM19 (3.5/5)](https://whats-best.ai/software/consent-management/ccm19) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Usercentrics CMP](https://whats-best.ai/software/consent-management/usercentrics) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [CookieYes alternatives](https://whats-best.ai/software/consent-management/cookieyes/alternatives). ## Head-to-head - [CookieYes vs Cookiebot](https://whats-best.ai/compare/cookiebot-vs-cookieyes.md) ## What this page leaves out - 16 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 3 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. - 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. ## Sources - [S1] Vendor homepage: https://www.cookieyes.com/ (checked 2026-10-29) - [S2] Features page (cookie consent): https://www.cookieyes.com/product/cookie-consent/ (checked 2026-10-29) - [S3] Features page (IAB TCF): https://www.cookieyes.com/iab-tcf-compliance/ (checked 2026-10-29) - [S4] Features page (Google Consent Mode): https://www.cookieyes.com/google-consent-mode-certified-cmp/ (checked 2026-10-29) - [S5] Pricing page: https://www.cookieyes.com/pricing/ (checked 2026-10-29) - [S6] Terms of service: https://www.cookieyes.com/terms-and-conditions/ (checked 2026-10-29) - [S7] Privacy policy: https://www.cookieyes.com/privacy-policy/ (checked 2026-10-29) - [S8] Data processing agreement (dpa): https://www.cookieyes.com/dpa/ (checked 2026-10-29) - [S9] Banner & choice architecture — found from sitemap: https://www.cookieyes.com/documentation/customize-cookie-banner/ (checked 2026-10-29) - [S10] Banner & choice architecture — found from sitemap: https://www.cookieyes.com/documentation/cookie-banner-in-specific-regions/ (checked 2026-10-29) - [S11] Prior blocking & script control — found from sitemap: https://www.cookieyes.com/documentation/automatic-script-blocking/ (checked 2026-10-29) - [S12] Prior blocking & script control — found from sitemap: https://www.cookieyes.com/documentation/test-cookie-blocking/ (checked 2026-10-29) - [S13] Scanning & cookie classification — found from sitemap: https://www.cookieyes.com/cookie-scanner/ (checked 2026-10-29) - [S14] Scanning & cookie classification — found from sitemap: https://www.cookieyes.com/documentation/scan-result-be-updated-in-my-cookie-banner/ (checked 2026-10-29) - [S15] Consent records & proof — found from sitemap: https://www.cookieyes.com/documentation/consent-log/ (checked 2026-10-29) - [S16] Consent records & proof — found from sitemap: https://www.cookieyes.com/documentation/proof-of-consent/ (checked 2026-10-29) - [S17] Frameworks, signals & platforms — found from sitemap: https://www.cookieyes.com/documentation/iab-tcf-compliance-with-cookieyes/ (checked 2026-10-29) - [S18] Frameworks, signals & platforms — found from sitemap: https://www.cookieyes.com/documentation/microsoft-uet-consent-mode/ (checked 2026-10-29) - [S19] Self-hosting / on-premises installation docs — found from the homepage: https://www.cookieyes.com/documentation/how-to-install-and-setup-cookieyes-shopify/ (checked 2026-11-01) --- Cite as: whats-best.ai, "CookieYes — Consent Management (CMP)", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/consent-management/cookieyes Corrections: https://whats-best.ai/correct/1162?target=page