CookieFirst

CookieFirst sets a single strictly necessary first party cookie called cookiefirst-id, valid for up to 12 months, plus a local storage entry that mirrors the visitor consent choices. No advertising or analytics cookie is set by CookieFirst itself; the platform only governs the cookies of other services on your site.

CookieFirst sets cookiefirst_consent (granular consent, 12 months), cookiefirst-id (anonymous identifier, 12 months) and, when IAB TCF is enabled, a cookiefirst_consent_string. No third party cookies are set by the CMP itself.

No. The cookies set by CookieFirst fall under the strictly necessary exemption of Article 5(3) of the ePrivacy Directive (recital 66), because they are essential to deliver the service explicitly requested by the user, namely recording their cookie choices. Consent is required for the downstream services that CookieFirst gates, not for the CMP banner itself.

No. The CMP is strictly necessary under Recital 30 of the ePrivacy Directive. It may be loaded before any consent decision, provided it then blocks every non essential script until the visitor accepts.

CookieFirst is deployed under legitimate interest pursuant to Article 6(1)(f) GDPR for the controller, combined with the legal obligation under Article 5(3) ePrivacy and Article 7(1) GDPR to obtain and document consent for any non essential trackers. The platform itself only processes the limited data needed to evidence that consent.

Legal obligation (Art. 6(1)(c) GDPR with Art. 7(1) to demonstrate consent) and legitimate interest (Art. 6(1)(f)) for the geo IP lookup that selects the right regulation.

No. Digital Data Solutions B.V. hosts all consent records on AWS infrastructure inside the European Union (Frankfurt and Amsterdam regions). The CDN that serves the banner script can route via Cloudflare edges but the consent payload itself stays in the EU, which removes the Schrems II exposure typical of US owned CMPs.

No. CookieFirst B.V. operates entirely from the Netherlands and stores all data on EU infrastructure. No transfer outside the European Economic Area.

A standalone Data Protection Impact Assessment is generally not required because CookieFirst processes only the minimum data necessary to record consent (truncated IP, hashed identifier, timestamp). If your overall stack triggers a DPIA, document CookieFirst inside it as the mitigation control that gates higher risk processors such as advertising pixels.

A DPIA is not required. CookieFirst is a privacy enhancing technology that processes only minimum data needed to prove consent.

Place the CookieFirst script in the head section before any non essential tag, enable script blocking by default and integrate Google Consent Mode v2 from the dashboard. Configure each vendor in the right category (necessary, preferences, statistics, marketing) and use the JavaScript API CookieFirst.consent to gate custom scripts. Test that no tracker fires before Accept is clicked.

Run the cookie scanner, categorise each script, configure equal weight accept/reject buttons, enable Google Consent Mode v2 if relevant, store the proof of consent and expose a persistent settings icon. Document the CMP in your Article 30 record.

Complianz (Netherlands), CookieHub (Iceland), Klaro (Germany, open source), Cookiebot (Denmark/Switzerland), Usercentrics (Germany), Axeptio (France), Didomi (France) and OneTrust (US).

Comparable consent management platforms include Cookiebot, OneTrust, Iubenda, Didomi, Sourcepoint, Usercentrics, Axeptio, Klaro and CookieHub. Cookiebot and CookieHub are the closest direct competitors on price and feature set; Didomi and Sourcepoint are better suited to large publisher portfolios because of their TCF v2.2 support and granular vendor management.

Enable the automated cookie declaration block from the CookieFirst dashboard and embed it on your privacy policy page using the provided script tag. CookieFirst rescans the site monthly (or weekly on paid plans) and republishes the updated declaration automatically. Review the change log before each release to catch newly introduced vendors.

CookieFirst regenerates the policy automatically based on the scanner. Schedule a monthly scan and review the policy after every theme or plugin change. Publish the new version date and inform users of material changes.