# CookieYes - **Type:** Software product - **Website:** https://www.cookieyes.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) Cookie-consent software that a website owner installs and runs: a consent banner and consent log, priced per domain, from a UK company. ## CookieYes scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 3/5 CookieYes documents a built-in consent-log/audit-trail feature (pseudonymised IP, country, consent status, timestamp, downloadable) explicitly marketed as evidence for regulatory cookie-consent reviews, but discloses no named case of actually supporting a client through an ICO investigation or enforcement action. ### Qualifications of the people who do the work: 4/5 Reframed for software as the vendor's own disclosed security certifications: SOC 2 Type I and Type II audits are disclosed as completed, alongside claimed IAB TCF v2.3, Google CMP Partner and PCI DSS status, though the underlying reports are not published and its ISO/IEC 27001 status is stated as 'compliant' rather than as a verifiable accredited certificate. ### What it publishes about fees: 5/5 A full pricing table is published on the public site: Free, $10, $25 and $55/month tiers per domain, explicit overage rates, an annual-billing discount and tax treatment, with no 'contact sales' gate below the Enterprise tier. ### Knowledge of your sector: 3/5 Breadth over depth: CookieYes documents support for a wide set of jurisdictions and regulations (UK/EU GDPR, CCPA/CPRA and other US state laws, LGPD, PIPEDA, POPIA, nFADP) rather than tailored modules or named specialists for particular industry sectors. ### Independence from what it sells: 3/5 Reframed for software as whether the vendor's compliance claims about its own product are independently audited versus self-declared: SOC 2 Type I/II are genuine third-party audits, a real independent check, but the report is gated under NDA rather than published, and the paired ISO/IEC 27001:2022 'compliant' claim could not be confirmed as an accredited certificate, so independent verification is partial rather than complete. ### Who carries the risk if the advice is wrong: 2/5 No professional-indemnity-style insurance is disclosed and no SLA/uptime percentage was found published; standard partner/customer terms cap total liability at 100% of fees paid in the prior 12 months with only statutory carve-outs (fraud, death, personal injury, wilful misconduct), a standard SaaS liability cap rather than a stated commitment to stand behind the client through an incident. ## Sources for CookieYes Every line carries the page it was read on and the date it was checked. - CookieYes Limited is registered with Companies House and shown as an active company, headquartered in Milton Keynes, UK. - Source: https://find-and-update.company-information.service.gov.uk/company/13074037 - Checked: 2026-09-19 - CookieYes publishes transparent, per-domain pricing across four self-serve tiers plus a free plan, with overage rates and annual-billing terms disclosed. - Source: https://www.cookieyes.com/pricing/ - Checked: 2026-09-19 - CookieYes discloses SOC 2 Type I and SOC 2 Type II audits as completed and states it is ISO/IEC 27001:2022 compliant, though the SOC 2 report itself is released only under NDA on request. - Source: https://trustcenter.cookieyes.com/compliance - Checked: 2026-09-19 - CookieYes discloses its own use of AI within the product: an 'AI Cookie Classifier' that auto-categorises unknown cookies, gated by a confidence threshold and a manual-review queue, on paid plans. - Source: https://www.cookieyes.com/documentation/enable-and-configure-ai-cookie/ - Checked: 2026-09-19 - CookieYes states its web application is hosted on AWS, and its privacy policy says customer/visitor personal data may be processed in any country where CookieYes or its sub-processors operate, without naming specific regions. - Source: https://www.cookieyes.com/documentation/where-is-data-collected-by-cookieyes-hosted/ - Checked: 2026-09-19 - CookieYes holds a 4.8/5 rating on G2 from 281 reviews; support is the most-praised attribute (~51 mentions) while cookie-scanner detection accuracy (missed cookies requiring manual audits) is the most-cited con. - Source: https://www.g2.com/products/cookieyes/reviews - Checked: 2026-09-20 - CookieYes holds a 4.7/5 rating on Capterra from 45 reviews; a minority of reviewers reported the consent banner slowing page load and scrolling on mobile. - Source: https://www.capterra.com/p/183974/CookieYes/reviews/ - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Published - Client results: Published - How it uses AI: Published ## Strengths - Genuinely UK-headquartered and Companies House-verified (registered office in Milton Keynes; active since incorporation on 9 December 2020), matching the brief's claim. - Fully published, worked pricing across four tiers plus a free plan, with overage rates, multi-currency options and tax treatment all disclosed up front, no 'book a call' wall below Enterprise. - SOC 2 Type I and Type II audits completed, giving at least one genuine third-party-audited security credential rather than a self-declared claim alone. - Discloses its own in-product AI use (the AI Cookie Classifier) publicly in its documentation, including a confidence-based human-review safeguard, rather than staying silent on the feature. - Consistently high, high-volume customer ratings (4.7-4.8/5 across Trustpilot, G2 and Capterra) with named enterprise customers (e.g. Novartis, Sony, Intuit, KPMG) published as social proof. ## Things to check Each one carries the factual basis it rests on. - The ISO/IEC 27001:2022 claim is stated as the vendor being 'compliant' rather than presented as a UKAS-accredited or IAF CertSearch-listed certificate, so a buyer cannot independently verify the certification's scope or issuing body from public information. - Basis: trustcenter.cookieyes.com/compliance describes CookieYes as 'ISO/IEC 27001:2022 compliant'; no certificate number, accreditation body, or CertSearch listing was found in public sources. - The SOC 2 report itself is not published; it is released only on request under an NDA, so the audit's scope, exceptions and testing period cannot be checked without contacting the vendor directly. - Basis: Vendor trust-center content states confidential documents such as SOC 2 are 'available upon request via support@cookieyes.com under Non-Disclosure Agreement (NDA)'. - CookieYes does not name the AI model or third-party provider behind its AI Cookie Classifier, nor does its documentation state whether scanned cookie/website data is sent to an external AI vendor for classification. - Basis: cookieyes.com/documentation/enable-and-configure-ai-cookie/ describes the feature's confidence tiers and review workflow but does not identify the underlying AI model, provider, or data-transmission path. - Data-residency disclosure is broad rather than specific: CookieYes names AWS as its host but its privacy policy allows personal data to be processed 'in any country where we have operations', without a public list of hosting regions or an EU/UK-only residency guarantee. - Basis: cookieyes.com/documentation/where-is-data-collected-by-cookieyes-hosted/ names only 'AWS data centre'; cookieyes.com/privacy-policy states data 'may be stored and processed in any country where we have operations, our staff are located'. ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [Which data protection, AI governance and cyber security providers publish a price?](https://theassurancedesk.com/lists/providers-that-publish-a-price) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.