CookieHub

CookieHub sets a single first party cookie family (cookiehub) that stores the categories accepted and a unique consent identifier. Server side, a truncated IP and a timestamp are kept as proof of consent.

CookieHub sets a single strictly necessary first party cookie called cookiehub, valid for 12 months by default. It contains the granular consent decisions and a configuration hash. No advertising or analytics cookies are placed by CookieHub itself; the platform governs the cookies of other services on your site.

No. CookieHub is treated as strictly necessary under Article 5(3) ePrivacy. The trackers it manages still require valid consent.

No. The cookiehub cookie falls under the strictly necessary exemption of Article 5(3) ePrivacy because it stores the visitor consent decision that has been explicitly requested. Consent is required only for the third party services governed by CookieHub.

Legitimate interest and the proof of consent obligation under Article 7(1) GDPR. Underlying services rely on consent.

CookieHub is deployed under legitimate interest pursuant to Article 6(1)(f) GDPR for the controller, combined with the legal obligation under Article 5(3) ePrivacy and Article 7(1) GDPR to obtain and document consent for any non essential trackers. The platform only processes the data necessary to evidence that consent.

No in standard configuration. CookieHub is operated from Iceland and stores data in AWS EU regions, so the CMP layer is unaffected by Schrems II.

No. CookieHub ehf hosts the consent records on infrastructure inside the EEA (Iceland and Ireland). Iceland is part of the EEA and is covered by the GDPR, which removes the Schrems II exposure typical of US owned CMPs. The CDN may use Cloudflare points of presence, but the consent payload stays within the EEA.

Usually no. A DPIA may still be triggered by the third party trackers controlled through CookieHub when they involve large scale profiling or transfers.

A standalone DPIA is generally not required because CookieHub processes only the minimum data necessary to record consent (truncated IP, hashed identifier, timestamp, browser metadata). If the overall stack triggers a DPIA, document CookieHub inside it as the consent layer that mitigates the risk of higher risk processors such as advertising pixels.

Insert the loader in the head, run the auto scanner, classify each script, block non essential tags before consent, mirror the visual weight of accept and reject, and expose a preference link in the footer.

Place the CookieHub script in the head section before any non essential tag, enable default deny on all categories, activate Google Consent Mode v2 from the dashboard, embed the automated cookie declaration on your privacy policy page and configure the script to rescan weekly. Use the cookiehub global object (cookiehub.hasConsented) to gate custom scripts.

Comparable consent management platforms include Cookiebot, OneTrust, Iubenda, Didomi, Sourcepoint, Usercentrics, Axeptio, CookieFirst and Klaro. Cookiebot and CookieFirst are the closest direct competitors on price and feature set; Didomi and Sourcepoint are better suited to large publishers because of their TCF v2.2 support.

Cookiebot, CookieFirst, Axeptio, Didomi, Complianz, OneTrust, Klaro. Choose on hosting, TCF support and price.

Use the auto scan to keep the inventory current, document every cookie purpose and duration, and version the policy.

Enable the automated cookie declaration block in the CookieHub dashboard and embed it on your privacy policy page using the provided script tag. CookieHub rescans the site automatically on a weekly basis and republishes the updated declaration. Review the change log before each release to catch newly introduced vendors.