Data Protection
CookieFirst
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by CookieFirst · cookiefirst.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
CookieFirst at a glance
- Vendor
- CookieFirst
- Headquarters
- Not stated on the vendor’s pages as of 20 Oct 2026
- Data hosting
- Default not stated; pages mention Germany source, captured 20 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 20 Oct 2026
- Panel verdict
- The AI panel rates CookieFirst 2/5, the mean of 6 judges. CookieFirst, by Digital Data Solutions BV, “an iubenda company”, is a website cookie-consent platform. how scores are made
- As of
- Vendor pages captured 20 Oct 2026; evaluated by the panel 21 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
CookieFirst, by Digital Data Solutions BV, “an iubenda company”, is a website cookie-consent platform. Sovereignty scores 7, framework coverage 6 and audit readiness 4, while pricing transparency scores 1 and privacy management and rights and incidents sit at 1-2. Strongest is the live web estate: an official WordPress plugin with Consent API support, Shopify and Shopware apps, React, Google Tag Manager with Consent Mode v2 and Microsoft Consent Mode, automated monthly scans feeding an auto-updating cookie statement, and seven regimes, GDPR to Thai PDPA, served from one geo-templated configuration. Weakest: we found no public price for any paid edition — only a 14-day free trial, a free account option and a 30% reseller commission are published — and no public information on records of processing, DPIA tooling, request workflows with statutory clocks or exportable evidence packs. The split is integrations and automation (4 to 7): the lone 4 reflects that the only API in evidence covers consent categories and we found no public information on a management API, SSO or webhooks, against higher scores for checkable connectors and automated recurring work.
Speaks for it
- Official WordPress plugin directory listing with Consent API support, plus Shopify, Shopware and React connectors and Google and Microsoft Consent Mode
- Automated monthly cookie scans feed an auto-updating cookie statement, removing recurring cookie-list maintenance
- Seven regimes — GDPR, ePrivacy, CCPA, LGPD, PIPEDA & CPPA, Quebec Law 25, PDPA — served by one banner configuration through geo-templating and opt-in/opt-out region detection
- Consent registration logs given, modified or deleted consent, with monthly reporting of cookies, cookie changes and the consent log
- The published data processing agreement names a Dutch entity with Chamber of Commerce number 75762277, OVH hosting in Frankfurt, EEA-default processing, SCCs/BCRs for transfers and a 21-day subprocessor objection window
Held against it
- We found no public prices for any paid edition, billing period or scale step, so every real invoice is a sales conversation
- We found no public information on records of processing, DPIA tooling, processor management or customer-side TOMs as product modules
- We found no public information on request workflows with statutory clocks, a breach register or deletion execution tracking as product features
- We found no public information on revision-safe change history, auditor access roles or exportable evidence packs beyond the consent log
- Ownership is stated only as “an iubenda company” without a jurisdiction, the named subprocessors were not captured, and the captured pages give different figures for the data centers used (Frankfurt versus LIM3 and RBX8)
Best for
- You need one cookie banner that adapts across GDPR, ePrivacy, CCPA, LGPD, PIPEDA & CPPA, Quebec Law 25 and Thai PDPA regions from a single geo-templated configuration
- Your sites run on WordPress, Shopify, Shopware or React and use Google Tag Manager or Microsoft Consent Mode, and you want scans and the cookie statement maintained automatically
- You need logged, dated proof of consent — given, modified, deleted — with monthly reporting to answer the consent question a regulator asks first
- You are a European buyer who wants a Dutch contracting entity, OVH hosting in Frankfurt and EEA-default processing documented in a published data processing agreement
Avoid if
- You need records of processing, DPIA tooling or processor management as product modules — the captured pages evidence a cookie register, scans and consent logging, not a records system
- You need to run data-subject request workflows with statutory clocks, a breach register or deletion tracking — what is operational here is the visitor-facing slice: consent given, changed or revoked and logged, plus a Do Not Sell button option
- You need published prices to budget before talking to sales — the only published numbers are a 14-day free trial, a free account option and a 30% reseller commission
- You need to wire consent data into other systems by API — the only API in evidence covers consent categories, and we found no public information on a management API, SSO or webhooks
The scores
| Criterion | Panel median |
|---|---|
| Records & DPIA depth | 1 of 5 |
| Data subject rights & incidents | 1 of 5 |
| Privacy regime coverage | 3 of 5 |
| Audit readiness & evidence | 2 of 5 |
| Integrations & automation | 3.5 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 0.5 of 5 |
Records & DPIA depth
Show reasoningHide reasoning
How this is scored
The DSMS core: records of processing (RoPA/VVT), data protection impact assessments, processor/DPA management and TOMs — how deeply the legal artifacts are modeled and connected.
0 — Document templates in a folder tree; the "register" is a Word file with version numbers in the filename.
3 — A structured RoPA with basic fields and a DPIA questionnaire, but processors, TOMs and legal bases live outside the system.
5 — RoPA and DPIA as linked modules with templates; processor management and TOM assignment exist but are shallow, and group reuse is copy-paste.
8 — A connected data model — processing activities linked to systems, processors, TOMs and legal bases — with DPIA triggers derived from the record, reusable group templates, and outputs a supervisory authority accepts.
10 — Privacy records as a system of record: the RoPA drives DPIAs, processor management and TOM coverage from one data model, multi-client/mandate capability included, and the documentation is audit-ready without manual assembly.
The External DPO
The only registers evidenced are a live cookie inventory feeding an auto-generated cookie declaration and policy, refreshed by monthly scans — cookies, not processing activities. I found no public information on records of processing, DPIA tooling, processor management or TOMs for the customer; the DPIA reference in the captured DPA is the vendor offering cooperation in my risk assessments, not a module. For a practice running client registers of processing, this is not a records system. 3 4 5
The In-House Counsel
The one structured register in evidence is the cookie register — periodic scans feeding an automated cookie declaration in 40+ languages — which is a fragment of processing records, not a record of processing activities. We found no public information on DPIA tooling, TOM administration or processor/DPA management for the customer's own records; the TOMs in view are the vendor's own appendix commitments, not a capability. 3 4 5
The Drafted Generalist
What the pages show is a cookie register — scans of tracking technologies, an automated cookie declaration, and monthly reporting — but for the paperwork I actually need I found no public information on a processing register, DPIA questionnaires, processor management or TOMs tracking as product features. The only DPIA mention is a promise in their own data processing agreement to cooperate in risk assessments, which does nothing for my documentation. 3 4 5
The Lead Auditor
What the captured pages evidence is a consent tool, not a records system: a scanning-generated cookie register with an auto-updating declaration and monthly change reports. We found no public information on records of processing, DPIA tooling, or processor and TOM management as product modules; the TOMs and processor lists that appear are appendices to the vendor's own data processing agreement. 3 4 5
The IT Integrator
This is a consent tool, not a records system: the evidence shows cookie scans, an automated cookie policy generator and consent logging, and we found no public information on records of processing, DPIAs, processor management or TOM modeling as product modules. The one legal artifact it generates — the automated cookie statement driven by scans — is structured, which keeps it just above a template folder. 3 5
The Skeptic
We found no public information on a records-of-processing register, DPIA tooling, processor management or customer-facing TOMs — the artifacts actually in evidence are a cookie scanner, an automated cookie statement and insight into third-party data sharing. The TOMs and subprocessor appendices we did see belong to the vendor's own data processing agreement, which documents the vendor rather than the customer's compliance program. 3 4 5
Data subject rights & incidents
Show reasoningHide reasoning
How this is scored
The operational half of the DSMS: data subject request handling with statutory clocks, breach register and authority notification, deletion concepts that actually delete.
0 — Requests arrive by email and live there; breaches are a phone call and a memo.
3 — A request log and a breach list exist, but deadlines are manual, intake is unstructured, and deletion rules are documentation rather than workflow.
5 — DSR workflows with the Art. 12 clock tracked, structured breach register with the 72-hour clock, deletion concepts assignable to records; automation is reminders.
8 — Intake channels for requests (portal/form), identity-check support, deadline automation with escalation, breach severity assessment and authority-report output, deletion rules tied to the RoPA with execution tracking.
10 — Rights and incidents as operations: end-to-end request handling an authority audit walks through, breach workflows that produce the Art. 33 notification, and deletion automation with evidence that the deletion happened.
The External DPO
What is operational is the visitor-facing slice: give, change or revoke consent, logged, recognized across devices, plus an "Exercise your rights – DSAR" option on the vendor's own pages. I found no public information on request workflows with statutory clocks, a breach register, or deletion execution for a controller's own processing; the 72-hour notification and request-forwarding commitments in the captured pages are the vendor's own duties as processor. 2 3 4
The In-House Counsel
On the visitor side this is real rights handling: consent can be given, changed or revoked, a 'Do not sell my personal information' button is supported, and every consent event is logged. We found no public information on a data subject request workflow with the Article 12 clock, a breach register, or authority-report output; the 72-hour undertaking in view is the vendor's own contractual commitment, and requests are simply forwarded to the controller. 2 3 4
The Drafted Generalist
The visitor-facing half exists — people can give, change or revoke consent on the banner, and a 'Do Not Sell' button option is supported for CCPA — but for my side I found no public information on request workflows with statutory deadlines, a breach register, or deletion rules with execution tracking. The commitments I see are the vendor's own: forwarding data subject requests to me and notifying authorities within 72 hours for their incidents. 2 3 4
The Lead Auditor
The log registering given, modified and deleted consent is real operational evidence for the withdrawal right, and a DSAR option plus a Do Not Sell button give subjects an intake point. We found no public information on controller-side request workflows with statutory clocks, a breach register, or deletion execution; the 72-hour and forwarding commitments captured are the vendor's own duties as processor. 3 4 5
The IT Integrator
An "Exercise your rights – DSAR" option is mentioned, but the pages present it as the vendor handling its own data subjects, and we found no public information on request workflows with statutory clocks, a breach register or deletion execution tracking as product features. The 72-hour notification in evidence is the vendor's contractual duty toward its controller, not customer-facing functionality. 2 3 4 5
The Skeptic
The one data-subject right the captured pages show working end to end is consent withdrawal — give, change or revoke, logged across devices — plus a do-not-sell button option. Beyond that we found no public information on request workflows with statutory clocks, a breach register or deletion tracking; the 72-hour notification and request-forwarding language sits in the vendor's own DPA as processor obligations, not product features. 2 3 4 5
Privacy regime coverage
Show reasoningHide reasoning
How this is scored
Which privacy regimes the product actually operationalizes — GDPR, BDSG, Swiss nDSG, UK GDPR, ePrivacy, EU AI Act privacy duties — and whether one record maps across them or each regime is a fresh island.
0 — One regime, hard-coded; anything else is "on the roadmap".
3 — GDPR plus one national law as separate checklists; the same processing activity is documented once per regime.
5 — The major regimes for its market with partial cross-mapping; newer duties (AI Act, ePrivacy changes) present as content packs of varying depth.
8 — Broad current coverage with one-record-many-regimes mapping and visible maintenance as regimes evolve.
10 — Regime coverage as a living product: multiple privacy regimes on one data basis, per-country variants, and documented update cadence when the law moves.
The External DPO
Seven regimes are named — GDPR, ePrivacy, CCPA, LGPD, Canadian and Quebec law, Thai PDPA — and a single scan plus geo-templating and opt-in/opt-out regional detection genuinely serves them from one configuration. The captured pages show no UK GDPR, Swiss or German federal variants and no AI Act duties. Maintenance appears as content updates and monthly rescans rather than a stated legal-update cadence. 3 4 5 6 8
The In-House Counsel
Seven regimes are named — GDPR and ePrivacy through CCPA/CPRA, LGPD, Canadian federal and Quebec law, and Thai PDPA — with geo-templating and regional opt-in/opt-out detection so one banner configuration adapts by jurisdiction. I found no public information on Swiss or UK coverage, on EU AI Act duties, or on a documented update cadence when the law moves, so the breadth is not demonstrably maintained. 3 4 5 6 8
The Drafted Generalist
Seven regimes are named — GDPR, ePrivacy, CCPA, LGPD, PIPEDA/CPPA, Quebec Law 25, PDPA — and one configuration genuinely maps across them via geo-templating and automatic opt-in/opt-out region detection, which is the plain-language behavior I want. I found no public information on EU AI Act duties or a documented update cadence when laws move; the CPRA explainer is helpful content but content, not capability. 1 4 5 6 8
The Lead Auditor
Seven regimes are named — GDPR, ePrivacy, CCPA, LGPD, PIPEDA and CPPA, Quebec Law 25, PDPA — and geo-templating with opt-in/opt-out region detection lets one banner configuration serve several regimes. We found no public information on per-country variants or a documented cadence for updating coverage when the law moves, and the CPRA material reads as guidance content. 4 5 6 8
The IT Integrator
The regime list is broad and current — GDPR, ePrivacy, CCPA/CPRA, LGPD, PIPEDA and CPPA, Quebec Law 25, PDPA — with geo-templating that shows the banner only in EU countries and switches to opt-out handling in CCPA regions, so one consent setup serves several regimes. Maintenance is visible in the CPRA enforcement content and Consent Mode v2 support; we found no public information on UK GDPR, German BDSG or Swiss nDSG variants. 1 4 5 6 8
The Skeptic
Seven regimes are named — GDPR, ePrivacy, CCPA/CPRA, LGPD, PIPEDA and CPPA, Quebec Law 25, PDPA — and one banner configuration serves them through geo-templating and opt-in versus opt-out region detection, which is genuine one-record-many-regimes behavior for the consent domain. The depth behind the list is blog content of uneven age (a 2023 CPRA explainer carries the US story), and we found no public information on UK GDPR, Swiss nDSG or a documented update cadence when the law moves. 1 4 5 6 8
Audit readiness & evidence
Show reasoningHide reasoning
How this is scored
Whether the system produces defensible proof: revision-safe history, evidence collection, reports for auditors, authorities and management.
0 — Exports are screenshots; history is overwritten in place.
3 — PDF reports exist but evidence is attached ad hoc and changes leave no reliable trail.
5 — Versioned records, standard report generators for the core registers, evidence attachments per activity; assembling a full audit file still takes days.
8 — Revision-safe change history, audit-scoped evidence packs on demand, management and authority reports current at a click, auditor access roles.
10 — Audit readiness as a standing state: continuous documentation status per regime and scope, exportable proof packs an auditor accepts as-is, and a defensible answer to "show me the state on date X".
The External DPO
Consent registration of given, modified and deleted consent, plus monthly reporting of cookies, cookie changes and the consent log, is standing proof for the consent question an authority asks first. I found no public information on revision-safe change history, auditor access roles, or exportable evidence packs, so this proves consent rather than a defensible documentation state on a given date. 3 5
The In-House Counsel
The consent registration logs every given, modified or deleted consent, with monthly reporting of cookies and cookie changes — precisely the proof of consent I need under Article 7. We found no public information on revision-safe change history across records, auditor access roles, or exportable proof packs beyond the consent log, so a full audit file remains a manual exercise. 3 5
The Drafted Generalist
The consent registration — logging given, modified or deleted consent — plus monthly reporting of cookies, cookie changes and the consent log gives me something defensible to hand a regulator who asks how we obtained consent. I found no public information on revision-safe change history, evidence packs, auditor access roles, or proving the state of the record on a given date. 3 5
The Lead Auditor
Consent given, modified and deleted is registered, and cookies, cookie changes and the consent log are reported monthly — recurring, dated documentation rather than an assembly exercise. We found no public information on revision-safe change history, exportable evidence packs, auditor access roles, or reconstructing the state on a given date. 1 3 5
The IT Integrator
Consent is registered with given, modified or deleted states plus monthly reporting of cookies, cookie changes and the consent log, which is a real trail for the one register this product keeps. We found no public information on revision-safe history across records, auditor access roles or exportable evidence packs, so an audit file beyond consent proof still has to be assembled by hand. 3 5
The Skeptic
Consent registration records given, modified or deleted consent, and monthly reporting covers cookies, cookie changes and the consent log — a versioned core register with a recurring report generator. We found no public information on revision-safe change history, evidence packs, auditor roles or a point-in-time view; the audit clause in the DPA governs inspecting the vendor, not producing an audit file. 1 5
Integrations & automation
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether the platform feeds from the real IT estate — directory import, ticketing, API — and automates the recurring privacy work instead of re-typing it.
0 — A closed island: manual entry in, PDF out, no API.
3 — CSV/Excel import and export; no live connections, no API worth the name.
5 — Directory import (AD/Entra), a documented REST API for core objects, a handful of native connectors (ticketing or SSO); automation is reminders and recurrence.
8 — Real connector set (ticketing, HR or asset sources), webhooks, SSO/SCIM, workflow automation with delegation and escalation, useful AI assistance with human review.
10 — The platform behaves like infrastructure: API parity for the data model, event streams, bidirectional sync with the estate, and automation that measurably removes the recurring toil (reviews, attestations, evidence pulls) rather than renaming it.
The External DPO
Genuine automation of the recurring consent work: automated monthly rescans, ongoing scanning, consent-gated script execution, and a real connector set — the official WordPress plugin with Consent API support, Shopify, Shopware, React, Google Tag Manager with Consent Mode v2 and Microsoft Consent Mode. I found no public information on webhooks, SSO or SCIM, ticketing or directory connections, or an API beyond the consent layer; the reseller commission signals agency orientation without a visible multi-client console. 1 5 7 8
The In-House Counsel
This platform genuinely feeds from the live web estate: ongoing scans, Google Tag Manager and Consent Mode v2, Microsoft Consent Mode, an official WordPress-directory plugin with WordPress Consent API support, Shopify, Shopware and React connectors, plus a proprietary tag manager. The recurring work — monthly scans, declaration updates, automatic language detection — is automated; we found no public information on a documented general API, webhooks, or single sign-on for the management side. 1 5 7 8
The Drafted Generalist
This is the strong suit: native plugins for WordPress (with WordPress Consent API support), Shopify, Shopware and React, Google Tag Manager with Consent Mode v2, Microsoft Consent Mode, a proprietary tag manager, and automated periodic cookie scans that keep the declaration current so nobody re-types cookie lists. I found no public information on directory import, SSO/SCIM, webhooks or ticketing connections. 1 5 7 8
The Lead Auditor
The connector set for the web estate is broad — WordPress, Shopify, Shopware, React, tag managers, Google and Microsoft consent modes, the WordPress Consent API — and scans, declarations and policy text update themselves. We found no public information on a documented management API, webhooks, single sign-on, or workflow automation with delegation and escalation. 1 7 8
The IT Integrator
The website estate is genuinely wired in — Google Tag Manager with Consent Mode v2, Microsoft Consent Mode, WordPress, Shopify, Shopware and React plugins, WP Consent API cookie registration, and automated monthly rescans — and that is where the integration story ends. From my side of the house we found no public information on directory import, SSO, webhooks or a documented REST API over the data model; the only API in evidence is client-side consent signaling, so the compliance estate still feeds in by hand. 1 5 7 8
The Skeptic
The connectors are real and checkable — an official WordPress plugin directory listing with Consent API support, Shopify and Shopware apps, a React library, GTM templates, Google and Microsoft Consent Mode — and automated monthly scans with an auto-updating cookie statement remove genuine recurring toil. We found no public information on webhooks, SSO/SCIM or ticketing and directory connections, and the single API mention covers consent categories only, which keeps this short of infrastructure-grade. 1 5 7 8
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where the compliance record of the whole company actually lives and under whose law — entity, hosting, subprocessors, DPA. A platform that maps your processing is itself your most concentrated processing.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for the system holding your RoPA.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The External DPO
A Dutch B.V. with a chamber-of-commerce number under Dutch law and Amsterdam jurisdiction, consent data in OVH datacenters in Frankfurt with EEA-default processing and standard contractual clauses, and a public DPA carrying a TOMs appendix and a subprocessor overview with a 21-day objection right. I found no public information naming the subprocessors or stating the parent company's jurisdiction, so the chain is not documented end to end publicly. 2 4
The In-House Counsel
The contracting entity is a Dutch BV with a Chamber of Commerce number under Dutch law and Amsterdam jurisdiction, consent data sits in named OVH datacenters in Frankfurt with EU-only defaults and standard contractual clauses for transfers, and the published DPA carries a subprocessor appendix with a 21-day objection right and TOMs. The parent company's jurisdiction and the actual composition of the subprocessor list are not confirmed on the captured pages, and we found no public information on sovereign-cloud or on-premises options. 2 4 8
The Drafted Generalist
The chain looks European: a Dutch company in Amsterdam with a chamber-of-commerce number, consent data on OVH servers in Frankfurt, EU-default processing, and a public DPA with a subprocessor appendix, a TOMs appendix and standard contractual clauses. I could not verify the parent company's jurisdiction or the names on the subprocessor list, and the captured pages give different figures for which data centers are used — the service description names Frankfurt while the security appendix lists LIM3 and RBX8. 2 4
The Lead Auditor
The chain is documented on the vendor's own pages: a Dutch company registered in Amsterdam, consent data hosted at named OVH facilities in Frankfurt with EU-only data centres, EEA-default processing, and a published processing agreement with subprocessor and security-measure appendices under Dutch law. Ownership is stated only as "an iubenda company" without jurisdiction, and the subprocessor appendix contents were not captured, so exposure beyond the named hosting cannot be verified. 2 4 8
The IT Integrator
The captured data processing agreement puts the entity in Amsterdam under Dutch law, consent data on OVH servers in Frankfurt with certified named datacenters, EEA processing as the default, and a subprocessor overview plus a security-measures appendix in the published DPA, with SCCs or BCRs for any transfer; ownership runs through iubenda, a European company. The summary attributes mark entity and residency as unconfirmed while the legal pages state them in plain text, the named subprocessor list itself is not in the captured pages, and no on-premises or sovereign-cloud option is evidenced — a notch under the top. 2 4 8
The Skeptic
The published DPA names a Dutch entity with a Chamber of Commerce number, OVH hosting in Frankfurt, EEA-default processing, a subprocessor appendix with a 21-day objection window and SCCs/BCRs for any transfers — most of a clean European chain. What holds it back: ownership stops at "an iubenda company" with no jurisdiction stated, the entity and hosting picture emerges only from the DPA while the vendor's main captured pages leave it unconfirmed, and the privacy policy discloses cross-brand marketing with team.blue as joint controllers — an unusual posture for a consent vendor. 2 4 7
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real invoice — per module, per entity, per year, with consulting unbundled — from public pages alone. Unpublished pricing is the B2B norm in this market, so this criterion describes rather than condemns; the benches weight it accordingly.
0 — No public prices at all; every configuration is a sales conversation.
3 — An entry price exists, but module add-ons, entity counts or bundled consulting make the real total incomputable.
5 — Most editions carry real numbers with billing period stated and software separated from services; at least one commonly needed module or scale step is unpriced.
8 — Every edition and module priced publicly with entity/user boundaries and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: modules, scale steps, service packages and renewal rules public, so the invoice for a 100-employee company and a 10-client consultancy is a two-minute exercise.
The External DPO
The only public numbers are a 14-day free trial with a free account option, and a reseller commission of 30% with pricing for numbers larger than 500 clients routed to a conversation. I found no public information on edition prices, billing periods, or per-domain scale steps, so a client's real invoice is not computable from public pages. 2 5 6
The In-House Counsel
The captured pages state a 14-day free trial, a free account and a 30% reseller commission, but we found no public prices for any edition and no per-domain, per-user or billing-period boundaries. The real invoice cannot be computed from what is published, so every paid configuration would be a sales conversation. 6 7 8
The Drafted Generalist
I found no public prices at all — no plan figures, no per-domain or per-entity boundaries — so the real invoice is unknowable without a sales conversation. The only public numbers are a 14-day free trial (or a free account) and a 30% reseller commission, which tells me nothing about what my company would pay. 6 7 8
The Lead Auditor
Only a 14-day free trial, a free account option and a 30 percent reseller commission are published. We found no public prices for any paid edition or scale, so the real invoice is a sales conversation throughout. 6 7 8
The IT Integrator
Public pages show a 14-day free trial, a free account tier and a 30% reseller commission, but we found no public prices for the paid editions, per-site scale steps or billing periods. Every real invoice is a sales conversation. 5 7 8
The Skeptic
We found a 14-day free trial, a free account option and a 30 percent reseller commission — and we found no public price for any paid edition, module or scale step, so a real invoice is a sales conversation. The only computable facts a buyer gets are that entry costs nothing and that reselling pays 30 percent. 5 7 8
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Questions about CookieFirst
Is CookieFirst European?
Not determined: the vendor’s pages as captured do not say where CookieFirst is based.
Where does CookieFirst store data?
The default storage location for customer data is not stated on the vendor’s pages as of 20 Oct 2026. The vendor’s pages mention Germany as hosting location, per the vendor’s page captured 20 Oct 2026.
Does CookieFirst have a free plan?
Not stated on the vendor’s pages as of 20 Oct 2026.
What are the best alternatives to CookieFirst?
As of 21 Oct 2026, the panel rates preeco | datenschutz (4/5), Dastra (3/5) and caralegal (3/5) highest among the other 41 Data Protection products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is preeco | datenschutz (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: CookieFirst alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 20 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Data residency, Subprocessors. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 14 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 11 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (8)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page cookiefirst.com Checked 20 Oct 2026 Details →
- 2 Legal notice — found from the homepage cookiefirst.com Checked 20 Oct 2026 Details →
- 3 Security / trust page — found from the homepage cookiefirst.com Checked 20 Oct 2026 Details →
- 4 Records & DPIA depth — found from sitemap cookiefirst.com Checked 20 Oct 2026 Details →
- 5 Privacy regime coverage — found from sitemap cookiefirst.com Checked 20 Oct 2026 Details →
- 6 Privacy regime coverage — found from sitemap cookiefirst.com Checked 20 Oct 2026 Details →
- 7 Integrations & automation — found from sitemap cookiefirst.com Checked 20 Oct 2026 Details →
- 8 Integrations & automation — found from sitemap cookiefirst.com Checked 20 Oct 2026 Details →