Cookie Seal

What Cookie Seal is

Cookie Seal, often searched as cookieseal, is a cookie consent management platform sold at cookieseal.com by Doğuş Bilgi İşlem ve Teknoloji Hizmetleri A.Ş. (Doğuş Teknoloji), the technology company of the Istanbul based Doğuş Group. It was designed first for the Turkish personal data law KVKK and is also marketed as compliant with the GDPR. Site owners subscribe monthly or yearly, receive installation code for their site and customise the banner through CSS; if the licence lapses, the site is suspended and consent recording stops.

The product groups cookies into four categories: strictly necessary, functional, performance and advertising or targeting. It shows a banner and a preference centre, keeps cookies the visitor allows, removes those they reject, and offers site owners consent statistics and reporting. Outside Turkey it has little public footprint, so independent reviews and detailed documentation are scarce.

Data and cookies it collects

The script cookie-seal.js is loaded from assets.cookieseal.com and fetches the site configuration from apinode.cookieseal.com. Analysis of the script shows it writes a first party cookie named CookieSealConsent holding the visitor's consent identifier and choice, and two local storage entries, CookieSealCookieCategories and CookieSealGTMConsentState, that remember accepted categories and the Google Consent Mode state. Each decision is posted to the Cookie Seal API together with a consent ID.

As with any server side consent log, the API request also exposes technical data such as the IP address and user agent. Cookie Seal does not publish the exact fields kept or the retention period, so ask for them in the processing agreement.

GDPR and ePrivacy implications

A consent banner is a compliance tool, not a tracker. Under Art. 5(3) of the ePrivacy Directive, storing the visitor's own choice is strictly necessary, and the CNIL explicitly lists consent cookies among exempt trackers; Germany's TDDDG § 25 and Spain's LSSI CE art. 22.2 lead to the same result. Under the GDPR, Art. 7(1) requires the controller to demonstrate consent, which is the purpose of Cookie Seal's consent log. The site owner remains controller and Cookie Seal acts as processor for those logs.

Consent requirements

Cookie Seal itself does not need consent. The real question is whether it collects valid consent for everything else: reject must be as easy as accept, no non essential script may fire before a choice, and categories must not be pre ticked, as required by CNIL, AEPD and German regulators. Check Google Consent Mode defaults too, so that Google tags start in denied state for EU visitors.

Data transfers outside the EEA

Doğuş Teknoloji is a Turkish company and its information notice refers to software whose servers are located abroad. Turkey has no adequacy decision from the European Commission, so sending consent logs there is a transfer under Chapter V GDPR that needs Standard Contractual Clauses (2021/914) and a transfer assessment in the spirit of Schrems II. The script and API hosts resolve to Google Cloud load balancers, but the storage region is not published.

Practical compliance steps

Place the Cookie Seal snippet as the first script in the page head and move every non essential tag behind its categories or Google Tag Manager consent triggers. Sign a processing agreement with Doğuş Teknoloji that covers the transfer to Turkey and the retention of consent logs. List CookieSealConsent and the two local storage keys as strictly necessary in your cookie policy. Finally, test reject all in a clean browser and confirm that no marketing or analytics request leaves the page.