Consent Management (CMP)

CookieYes

UK / wider Europe Report an error

Panel rating · 6 judges · How to read the stars

Category median

Sovereignty: not determined

0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.

by CookieYes Limited · www.cookieyes.com

An AI-assisted analysis of public evidence — not a hands-on test.

Every score, rationale and verdict on this page is AI-generated. Every claim cites the source it was read from. Nothing here is a human star review — and no score can be bought. How scores are made →

Method and versions

The Data Protection Officer v1.0 · The Agency Developer v1.0 · The Publisher Marketing Lead v1.0 · The In-House Lawyer v1.0 · The WordPress Webmaster v1.0 · The Skeptic v1.0 · rubric v1 · evaluated 30 Oct 2026

Compare with Cookiebot → Report an error on this page Is this your product? →

Link to this page

HTML

<a href="https://whats-best.ai/software/consent-management/cookieyes"><img src="https://whats-best.ai/badge/consent-management/cookieyes.svg" alt="CookieYes: AI-assisted analysis on whats-best.ai" height="66"></a>

Markdown

[![CookieYes: AI-assisted analysis on whats-best.ai](https://whats-best.ai/badge/consent-management/cookieyes.svg)](https://whats-best.ai/software/consent-management/cookieyes)

Add ?theme=dark to the image address for dark backgrounds. The badge shows the category and the month of the latest evaluation, and EU-Made where that is the product’s provenance. It never shows a score.

CookieYes at a glance

Vendor: CookieYes Limited
Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026
Free plan: Yes, per the vendor’s own page source, captured 29 Oct 2026
Panel verdict: The AI panel rates CookieYes 3/5, the mean of 6 judges. CookieYes scores best on pricing transparency, 7 to 8: four published tiers at $0, $10, $25 and $55 per month per domain, pageview limits per tier, and overage at $0.30 per 1,000 extra pageviews. how scores are made
As of: Vendor pages captured 29 Oct 2026 to 1 Nov 2026; evaluated by the panel 30 Oct 2026. all sources

CookieYes alternatives, European ones first →

Read this page as one judge. Each weighs the same scores by what they care about.

The WordPress Webmaster

Weighted verdict

Looks after the WordPress site of a mid-sized engineering company on top of the actual job, with Google Analytics, a YouTube channel, a Maps embed and a contact form with reCAPTCHA. Wants a plugin that finds these by itself, blocks them until the visitor agrees, survives the next plugin update and caching, and costs a known amount per site per year without a call to sales.

Same scores as the panel view — this lens weights them the way this judge cares.

Scored by The WordPress Webmaster

Panel median The WordPress Webmaster This judge’s scores over the panel median. Each label opens its reasoning below.

Scores per criterion, in stars out of 5
Criterion	Panel median	The WordPress Webmaster
Banner & choice architecture	3.5 of 5	3.5 of 5
Prior blocking & script control	3.5 of 5	3 of 5
Scanning & cookie classification	3 of 5	3.5 of 5
Consent records & proof	3 of 5	3 of 5
Frameworks, signals & platforms	3.5 of 5	3.5 of 5
European sovereignty	2 of 5	2 of 5
Pricing transparency	4 of 5	4 of 5

Banner & choice architecture

How this is scored

What the visitor is asked and how: a reject option on the first layer with the same prominence as accept, consent by category and by vendor, withdrawal and changed choices as easy as the first consent (a persistent button or link), banner texts and layouts the site owner controls, languages, rules per country or regulation (GDPR, Swiss FADP, US state laws), accessibility of the banner itself, and consent-rate analytics or A/B tests that stay within the rules.

0 — Not a consent banner; the product shows a notice that cannot record a choice, or is a different kind of product.

3 — A banner with accept and a settings layer; whether reject sits on the first layer, how consent is withdrawn and how far the design can be changed are basic or not described.

5 — Accept, reject and settings on the first layer, consent by category, a way for visitors to change or withdraw their choice later, customisable texts, colours and layout, the banner in several languages, and a basic consent-rate statistic.

8 — Choice architecture documented in depth: reject and accept of equal weight stated as a default, consent per vendor or service as well as per category, geolocation rules that show a different banner per country or regulation, the banner stated as accessible (WCAG level named), dozens of languages with automatic detection, and consent-rate analytics or A/B testing with the limits on what may be tested explained.

10 — The choice is designed to stand up to a supervisory authority: templates mapped to named regulator guidance (for example the German DSK, CNIL or EDPB cookie banner report), dark patterns the product prevents listed, every banner version kept with its texts so the choice shown can be reconstructed, and consent-rate figures reported without nudging defaults.

Report an error

The WordPress Webmaster

The customization documentation shows real depth — three layouts, colour themes, custom CSS, categories on the first layer and a floating button so visitors can change or withdraw consent later — plus 30+ languages with auto-translation, geo-targeting by region with GDPR and US-state consent templates, granular vendor-level consent in the TCF banner, and WCAG accessibility certification listed on the pricing page. We found no public information on consent-rate analytics or A/B testing, and nothing stating that reject carries the same weight as accept on the first layer. 9 4 2 3 5 10

Report an error

Prior blocking & script control

How this is scored

What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.

0 — No blocking of any kind; the product only shows a banner and leaves every script running.

3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.

5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.

8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.

10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.

Report an error

The WordPress Webmaster

Automatic blocking of third-party scripts before consent is documented in the help centre, with editable placeholder text over blocked YouTube and Vimeo embeds, a Google Tag Manager template, consent-update events for tag managers and scripts, and Chrome DevTools steps to check that nothing loads before consent — exactly what I need for my Analytics and Maps embeds. We found no public information on a manual blocking mode with its limits, server-side tagging, or consent being passed to forms and CAPTCHAs, which matters with my reCAPTCHA contact form. 11 12 9 18 4

Report an error

Scanning & cookie classification

How this is scored

How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.

0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.

3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.

5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.

8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.

10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.

Report an error

The WordPress Webmaster

The scanner delivers an instant report without sign-up, scheduled monthly scanning (weekly on the top tier) with stated scan depths per plan from 100 up to 8,000 pages, scan-behind-login and static-IP scanning on the top tier, and classification against a database of 100,000+ pre-categorized cookies with descriptions, feeding a cookie policy generator and the banner. We found no public information on scanning local storage or pixels, email alerts when new or changed trackers appear, or the declaration updating automatically in several languages. 13 5 1 4 14

Report an error

Consent records & proof

How this is scored

What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.

0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.

3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.

5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.

8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.

10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.

Report an error

The WordPress Webmaster

The consent log records consent ID, date and time, country, overall and category-wise status and a pseudonymous IP, viewable in the dashboard, with a Proof of Consent PDF export and the visitor's consent ID findable in their browser cookie; consent expiry is configurable (365 days by default) and the data processing agreement retains data for the duration of the agreement. We found no public information on records being tied to the banner version shown, withdrawal recorded as its own event, or search and export of the log through an API. 15 16 9 8 13

Report an error

Frameworks, signals & platforms

How this is scored

Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.

0 — No consent signal is passed on; other tools cannot read the visitor's choice.

3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.

5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.

8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.

10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.

Report an error

The WordPress Webmaster

CookieYes is documented as a Google-certified CMP with Consent Mode v2 enabled by default on all plans, Google Additional Consent Mode, IAB TCF v2.4 with the Global Vendor List and Google's ad tech provider list, and Microsoft UET consent mode via Tag Manager or custom script; there are WordPress, Shopify and Wix apps plus any-CMS installation, Global Privacy Control from Pro, and an agency partner programme. We found no public information on the registered CMP ID number, GPP support, iOS or Android SDKs, or a REST API for configuration — and IAB TCF sits only on the Pro and Ultimate plans. 17 4 5 18 2 1

Report an error

European sovereignty

How this is scored

Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.

0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.

3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.

5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.

8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.

10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.

Report an error

The WordPress Webmaster

The contracting entity is CookieYes Limited, a UK company in Milton Keynes, with a published data processing agreement naming AWS hosting (region unstated), a sub-processor list with 30-day change notice, and suppliers such as Stripe, Zendesk, Intercom and Sendgrid named in the privacy policy; an Irish EU representative and EU standard contractual clauses under Irish law are in place. We found no public information on where the banner script is served or the consent logs stored, on EU hosting, or on the company's ownership — so the chain behind a script that loads on every page of my site stays partly dark. 8 7 18 6

Report an error

Pricing transparency

How this is scored

Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.

0 — No public prices at all; every customer is a sales call.

3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.

5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".

8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.

10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.

Report an error

The WordPress Webmaster

All four tiers are published per domain per month — Free at $0, Basic at $10, Pro at $25, Ultimate at $55 — with pageview allowances per tier, extra pageviews at $0.30 per 1,000, scan limits per tier, an annual "2 months free" discount, VAT charged in addition, a 14-day trial that auto-converts to a paid subscription, and termination on 30 days notice. What keeps it short of full computability for me is the Enterprise tier on custom contracts and no published agency or reseller terms, though subdomains counting as separate domains is clearly defined. 5 6 17

Report an error

European sovereignty — proven facts

0 of 6 dimensions proven

Built only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.

Legal entity	Not determined ⚠ unverified	—	uncited Report an error
Hosting location	Not determined	—	uncited Report an error
Hosting options	Not determined	—	uncited Report an error
Open source	Not determined	—	uncited Report an error
Data processing agreement	Not determined ⚠ unverified	—	uncited Report an error
Transfer impact assessment	Not determined	—	uncited Report an error

Questions about CookieYes

Is CookieYes European?

Yes, though not from the EU. whats-best.ai classifies CookieYes as UK / wider Europe.

Where does CookieYes store data?

Not stated on the vendor’s pages as of 1 Nov 2026.

Does CookieYes have a free plan?

Yes. CookieYes has a free plan, per the vendor’s page captured 29 Oct 2026.

What are the best alternatives to CookieYes?

As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: CookieYes alternatives.

Where this could be wrong

Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
Weak sourcing — Legal entity, Data processing agreement. Not confirmed on the vendor’s own pages as captured.
AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.

What we left out

A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.

16 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
3 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us

Do you know more about CookieYes? Tell us Report an error on this page

Sources (19)

The pages every claim on this page was read from — each one checked, dated, and kept verifiable.

1 Vendor homepage www.cookieyes.com Checked 29 Oct 2026 Details →
2 Features page (cookie consent) www.cookieyes.com Checked 29 Oct 2026 Details →
3 Features page (IAB TCF) www.cookieyes.com Checked 29 Oct 2026 Details →
4 Features page (Google Consent Mode) www.cookieyes.com Checked 29 Oct 2026 Details →
5 Pricing page www.cookieyes.com Checked 29 Oct 2026 Details →
6 Terms of service www.cookieyes.com Checked 29 Oct 2026 Details →
7 Privacy policy www.cookieyes.com Checked 29 Oct 2026 Details →
8 Data processing agreement (dpa) www.cookieyes.com Checked 29 Oct 2026 Details →
9 Banner & choice architecture — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
10 Banner & choice architecture — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
11 Prior blocking & script control — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
12 Prior blocking & script control — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
13 Scanning & cookie classification — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
14 Scanning & cookie classification — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
15 Consent records & proof — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
16 Consent records & proof — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
17 Frameworks, signals & platforms — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
18 Frameworks, signals & platforms — found from sitemap www.cookieyes.com Checked 29 Oct 2026 Details →
19 Self-hosting / on-premises installation docs — found from the homepage www.cookieyes.com Checked 1 Nov 2026 Details →