We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

CookieYes review

Software product

Cookie-consent software that a website owner installs and runs: a consent banner and consent log, priced per domain, from a UK company.

Relevant if you want a self-serve cookie banner with published monthly prices and a free plan to start

Price Published
Indemnity cover Not published
How it uses AI Published
Facts last checked

Not published means we did not find it on the firm's own pages.

CookieYes scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 3/5
Qualifications of the people who do the work 4/5
What it publishes about fees 5/5
Knowledge of your sector 3/5
Independence from what it sells 3/5
Who carries the risk if the advice is wrong 2/5

What CookieYes offers, and what it publishes

You get software, not advice: a cookie-consent banner and a downloadable consent log for your own website. Its documentation covers UK and EU GDPR, US state laws and several other countries' rules. It says it has completed SOC 2 Type I and Type II audits, and names customers including Novartis, Sony, Intuit and KPMG.

CookieYes publishes its prices: a free plan up to 5,000 pageviews a month, then $10, $25 or $55 a month per domain; extra pageviews cost $0.30 per 1,000. It does not publish its SOC 2 report; you must ask, under a non-disclosure agreement. It does not publish an uptime commitment.

CookieYes says it is 'ISO/IEC 27001:2022 compliant' but gives no certificate number. It does not name the AI model or provider behind its AI Cookie Classifier. Its privacy policy says personal data may be processed 'in any country where we have operations'. Trustpilot shows 4.8 out of 5 from 380 reviews.

Strengths

  • Genuinely UK-headquartered and Companies House-verified (registered office in Milton Keynes; active since incorporation on 9 December 2020), matching the brief's claim.
  • Fully published, worked pricing across four tiers plus a free plan, with overage rates, multi-currency options and tax treatment all disclosed up front, no 'book a call' wall below Enterprise.
  • SOC 2 Type I and Type II audits completed, giving at least one genuine third-party-audited security credential rather than a self-declared claim alone.
  • Discloses its own in-product AI use (the AI Cookie Classifier) publicly in its documentation, including a confidence-based human-review safeguard, rather than staying silent on the feature.
  • Consistently high, high-volume customer ratings (4.7-4.8/5 across Trustpilot, G2 and Capterra) with named enterprise customers (e.g. Novartis, Sony, Intuit, KPMG) published as social proof.

Things to check

  • The ISO/IEC 27001:2022 claim is stated as the vendor being 'compliant' rather than presented as a UKAS-accredited or IAF CertSearch-listed certificate, so a buyer cannot independently verify the certification's scope or issuing body from public information.
  • The SOC 2 report itself is not published; it is released only on request under an NDA, so the audit's scope, exceptions and testing period cannot be checked without contacting the vendor directly.
  • CookieYes does not name the AI model or third-party provider behind its AI Cookie Classifier, nor does its documentation state whether scanned cookie/website data is sent to an external AI vendor for classification.
  • Data-residency disclosure is broad rather than specific: CookieYes names AWS as its host but its privacy policy allows personal data to be processed 'in any country where we have operations', without a public list of hosting regions or an EU/UK-only residency guarantee.

Common questions

Does CookieYes publish its prices?

Yes. A free plan covers up to 5,000 pageviews a month. Paid plans cost $10, $25 or $55 a month per domain, and on annual billing you pay for 10 months and get 2 free.

Is CookieYes ISO 27001 certified?

Not that we could verify. Its trust centre says it is 'ISO/IEC 27001:2022 compliant'. It gives no certificate number or accreditation body, and we found no IAF CertSearch listing.

Can I see its SOC 2 report?

Only on request. CookieYes says it has completed SOC 2 Type I and Type II audits, but it releases the report only under a non-disclosure agreement, through its support team.

Does it use AI in the product?

Yes. Paid plans include an AI Cookie Classifier that sorts unknown cookies. Low-confidence results go to manual review. CookieYes does not name the AI model or provider behind it.

Evidence for each CookieYes score

Show our working

Notes behind each thing to check

  • The ISO/IEC 27001:2022 claim is stated as the vendor being 'compliant' rather than presented as a UKAS-accredited or IAF CertSearch-listed certificate, so a buyer cannot independently verify the certification's scope or issuing body from public information. (trustcenter.cookieyes.com/compliance describes CookieYes as 'ISO/IEC 27001:2022 compliant'; no certificate number, accreditation body, or CertSearch listing was found in public sources.)
  • The SOC 2 report itself is not published; it is released only on request under an NDA, so the audit's scope, exceptions and testing period cannot be checked without contacting the vendor directly. (Vendor trust-center content states confidential documents such as SOC 2 are 'available upon request via support@cookieyes.com under Non-Disclosure Agreement (NDA)'.)
  • CookieYes does not name the AI model or third-party provider behind its AI Cookie Classifier, nor does its documentation state whether scanned cookie/website data is sent to an external AI vendor for classification. (cookieyes.com/documentation/enable-and-configure-ai-cookie/ describes the feature's confidence tiers and review workflow but does not identify the underlying AI model, provider, or data-transmission path.)
  • Data-residency disclosure is broad rather than specific: CookieYes names AWS as its host but its privacy policy allows personal data to be processed 'in any country where we have operations', without a public list of hosting regions or an EU/UK-only residency guarantee. (cookieyes.com/documentation/where-is-data-collected-by-cookieyes-hosted/ names only 'AWS data centre'; cookieyes.com/privacy-policy states data 'may be stored and processed in any country where we have operations, our staff are located'.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 3/5 CookieYes documents a built-in consent-log/audit-trail feature (pseudonymised IP, country, consent status, timestamp, downloadable) explicitly marketed as evidence for regulatory cookie-consent reviews, but discloses no named case of actually supporting a client through an ICO investigation or enforcement action.
Qualifications of the people who do the work 4/5 Reframed for software as the vendor's own disclosed security certifications: SOC 2 Type I and Type II audits are disclosed as completed, alongside claimed IAB TCF v2.3, Google CMP Partner and PCI DSS status, though the underlying reports are not published and its ISO/IEC 27001 status is stated as 'compliant' rather than as a verifiable accredited certificate.
What it publishes about fees 5/5 A full pricing table is published on the public site: Free, $10, $25 and $55/month tiers per domain, explicit overage rates, an annual-billing discount and tax treatment, with no 'contact sales' gate below the Enterprise tier.
Knowledge of your sector 3/5 Breadth over depth: CookieYes documents support for a wide set of jurisdictions and regulations (UK/EU GDPR, CCPA/CPRA and other US state laws, LGPD, PIPEDA, POPIA, nFADP) rather than tailored modules or named specialists for particular industry sectors.
Independence from what it sells 3/5 Reframed for software as whether the vendor's compliance claims about its own product are independently audited versus self-declared: SOC 2 Type I/II are genuine third-party audits, a real independent check, but the report is gated under NDA rather than published, and the paired ISO/IEC 27001:2022 'compliant' claim could not be confirmed as an accredited certificate, so independent verification is partial rather than complete.
Who carries the risk if the advice is wrong 2/5 No professional-indemnity-style insurance is disclosed and no SLA/uptime percentage was found published; standard partner/customer terms cap total liability at 100% of fees paid in the prior 12 months with only statutory carve-outs (fraud, death, personal injury, wilful misconduct), a standard SaaS liability cap rather than a stated commitment to stand behind the client through an incident.

Sources for CookieYes

  • CookieYes Limited is registered with Companies House and shown as an active company, headquartered in Milton Keynes, UK. (Company no. 13074037; incorporated 9 December 2020; status: Active; registered office: 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes MK12 5NW) (Companies House, checked 19 September 2026)
  • CookieYes publishes transparent, per-domain pricing across four self-serve tiers plus a free plan, with overage rates and annual-billing terms disclosed. (Free $0 (5,000 pageviews/mo); Basic $10/mo; Pro $25/mo; Ultimate $55/mo (unlimited pageviews); overage $0.30 per 1,000 extra pageviews; annual billing = pay for 10 months, get 2 free) (cookieyes.com, checked 19 September 2026)
  • CookieYes discloses SOC 2 Type I and SOC 2 Type II audits as completed and states it is ISO/IEC 27001:2022 compliant, though the SOC 2 report itself is released only under NDA on request. (SOC 2 Type I & Type II completed; ISO/IEC 27001:2022 'compliant'; confidential documents available via support@cookieyes.com under NDA) (trustcenter.cookieyes.com, checked 19 September 2026)
  • CookieYes discloses its own use of AI within the product: an 'AI Cookie Classifier' that auto-categorises unknown cookies, gated by a confidence threshold and a manual-review queue, on paid plans. (AI Cookie Classifier, available on Basic, Pro and Ultimate plans; high-confidence results can auto-publish, low-confidence results route to manual review) (cookieyes.com, checked 19 September 2026)
  • CookieYes states its web application is hosted on AWS, and its privacy policy says customer/visitor personal data may be processed in any country where CookieYes or its sub-processors operate, without naming specific regions. (App (app.cookieyes.com) hosted on 'AWS data centre'; personal data 'may be stored and processed in any country where we have operations, our staff are located'; sub-processor list available on request) (cookieyes.com, checked 19 September 2026)
  • CookieYes holds a 4.8/5 rating on G2 from 281 reviews; support is the most-praised attribute (~51 mentions) while cookie-scanner detection accuracy (missed cookies requiring manual audits) is the most-cited con. (4.8/5 (281 reviews)) (g2.com, checked 20 September 2026)
  • CookieYes holds a 4.7/5 rating on Capterra from 45 reviews; a minority of reviewers reported the consent banner slowing page load and scrolling on mobile. (4.7/5 (45 reviews)) (capterra.com, checked 20 September 2026)
  • Trustpilot: CookieYes holds a 4.8/5 Trustpilot rating from 380 reviews on a claimed business profile (claimed since April 2024); reviews concentrate on fast, knowledgeable customer support and quick/easy setup, with only 4-6% of ratings below 4 stars and no material recurring complaint beyond minor free-plan restrictions (e.g. one website limit on the free WordPress plan). (Trustpilot, checked 20 September 2026)

SOC 2 Type I audit completed, a genuine third-party audit, but the full report is withheld and released only on request under NDA (stated on trustcenter.cookieyes.com/compliance, checked 2026-09-19). SOC 2 Type II audit completed, a genuine third-party audit, but the full report is withheld and released only on request under NDA (stated on trustcenter.cookieyes.com/compliance, checked 2026-09-19). Self-declared IAB TCF v2.3, Google CMP Partner and PCI DSS status, a vendor claim, with no independent verification found (per trustcenter.cookieyes.com/compliance, checked 2026-09-19).

First DPO or AI policy

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.