FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Consent management

CookieYes

Essential

CookieYes is a Consent Management Platform built by WebToffee, popular among WordPress and Shopify merchants for its low cost, simple setup and automatic cookie scanner. It supports the IAB TCF v2.2 framework, Google Consent Mode v2 and granular category controls compliant with GDPR, CCPA and LGPD.

Block CookieYes until consentScan my site
Overview

What does CookieYes do?

What is CookieYes?

CookieYes is a Consent Management Platform created by WebToffee, a software company headquartered in Cochin, India with an EU office in Nicosia, Cyprus. Launched in 2019, it has become one of the most widely deployed CMPs in the WordPress and Shopify ecosystems thanks to its free tier, simple setup and automatic cookie scanner. CookieYes supports the IAB TCF v2.2 framework, Google Consent Mode v2 and granular category controls compliant with GDPR, ePrivacy, CCPA, LGPD and the UK GDPR.

Cookies and data collected

CookieYes sets a single first party cookie called cookieyes-consent (12 months) which stores the user consent record: accepted or rejected categories, timestamp, consent version and a unique ID. When the IAB TCF integration is active, the euconsent v2 string is also stored. The consent proof is uploaded to AWS Frankfurt for EU customers and remains accessible from the CookieYes dashboard for audit purposes. No browsing behaviour, IP address or device fingerprint is collected.

GDPR and ePrivacy compliance

CookieYes is designed for privacy by design under Article 25 GDPR. It blocks non essential scripts before the accept click, offers granular category controls (necessary, functional, analytics, performance, advertisement, others), provides a reject button with equal visual weight, and is certified for IAB TCF v2.2 interoperability. The auto blocker prevents tags from firing until the relevant category is approved, which is the technical condition required by the CNIL and the EDPB.

Data transfers and hosting

EU customer consent records are stored on AWS Frankfurt (eu-central-1). However, WebToffee India and the Cyprus office may access the data for support and engineering purposes, which qualifies as a transfer to India under Schrems II. WebToffee signs the EU Standard Contractual Clauses (2021/914) and has appointed an EU representative in Cyprus. This needs to be reflected in the privacy notice and in the data processing addendum.

How to implement CookieYes correctly

Install the CookieYes WordPress plugin or paste the script in the head before any other tag, enable the auto blocker so non essential scripts wait for consent, activate granular categories and the equal weight reject button. Enable Google Consent Mode v2 in the integrations tab to forward the consent signals to GTM, configure the consent log retention to 12 to 24 months and pair the CMP with the CookieYes policy generator.

Compliance

CookieYes and the GDPR

Legal basis
Legitimate interest of the controller under Article 6(1)(f) GDPR combined with the legal obligation to demonstrate consent under Article 7(1) GDPR.
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive 2002/58/EC, French CNIL guidelines, German TDDDG, Spanish LSSI, Italian Codice Privacy, IAB TCF v2.2

Impact assessment (DPIA)

CookieYes is a low risk processor that only stores the consent record and the policy text. A full DPIA is generally not required, but document the legal basis (Article 6(1)(f) and 7(1) GDPR), the EU only data storage with technical access from India (covered by SCCs) and the 12 month retention of the consent record in the record of processing activities.

Sample text for your banner

This website uses CookieYes by WebToffee to manage your cookie preferences. CookieYes stores your consent record in the cookieyes-consent first party cookie for 12 months as proof under Article 7(1) GDPR. EU customer data is hosted in AWS Frankfurt.
Cookies and trackers

What CookieYes sets and contacts

Tracking method
JavaScript Consent Management Platform loaded from cdn-cookieyes.com. Sets a first party cookie cookieyes-consent (1 year) to record the consent decision. IAB TCF v2.2 supported via add on. Optional integration with Google Consent Mode v2 and an automatic cookie scanner.
Server location
European Union (AWS Frankfurt eu-central-1 for EU customer data) and India (CookieYes is built by WebToffee, headquartered in Cochin, India and Nicosia, Cyprus)
Data transferred outside the EU
CookieYes is operated by WebToffee Holdings Limited (Cyprus) and WebToffee India. EU customer consent records are stored in AWS Frankfurt, but the support team and some backend services are accessed from India. Standard contractual clauses are signed for the India access and an EU representative is appointed.

Cookies set (2)

NameTypeDurationPurpose
cookieyes-consentfirst_party12 monthsStores the user consent record for the CookieYes CMP: categories accepted or rejected, timestamp, consent version and unique ID. Required to apply the user choice on every page load.
euconsent-v2first_party12 monthsStandard IAB TCF v2.2 consent string, set when the TCF integration is active. Required for interoperability with the European programmatic advertising ecosystem.

Third-party domains contacted (3)

  • cdn-cookieyes.com
  • log.cookieyes.com
  • app.cookieyes.com
Questions

Frequently asked questions about CookieYes

Can't find your question? Write to us, we answer fast.

Which cookies does CookieYes set?

CookieYes sets a single first party cookie called cookieyes-consent (12 months) which contains the consent record (accepted or rejected categories, timestamp, version, ID). When IAB TCF integration is active, the euconsent v2 string is also stored. No browsing behaviour or fingerprint is collected.

Do users have to consent to CookieYes itself?

No. The cookieyes-consent cookie is strictly necessary under Article 5(3) ePrivacy Directive: it is required to record and prove the consent choice. CookieYes loads before the user clicks accept, in line with CNIL, AEPD and TTDSG guidance.

What is the legal basis for using CookieYes?

CookieYes relies on the legitimate interest of the controller under Article 6(1)(f) GDPR combined with the legal obligation to demonstrate consent under Article 7(1) GDPR. The website operator is the controller, CookieYes the processor.

Does CookieYes transfer data to the United States?

Not to the United States, but EU customer data may be accessed by WebToffee staff in India. This qualifies as a transfer to India under Schrems II. WebToffee signs the EU SCCs (2021/914) and has appointed an EU representative in Cyprus. The data itself is stored on AWS Frankfurt.

Is a DPIA required for CookieYes?

No. CookieYes is a low risk processor. A full DPIA is not required; document the legal basis, the EU hosting with technical access from India (covered by SCCs) and the 12 month retention of the consent record in the record of processing activities.

How do I implement CookieYes correctly?

Install the CookieYes WordPress plugin or paste the script in the head before any other tag, enable the auto blocker, activate granular categories and the equal weight reject button, enable Google Consent Mode v2 and pair the CMP with the CookieYes policy generator.

What are the alternatives to CookieYes?

EU based alternatives: Axeptio (France), Cookiebot (Denmark), Usercentrics (Germany), Iubenda (Italy), CookieFirst (Netherlands), Didomi (France). Open source: Klaro, Orejime, Tarteaucitron and CookieConsent by Orest Bida.

How do I keep my cookie policy up to date with CookieYes?

CookieYes includes an automatic cookie scanner that detects new vendors monthly and updates the cookie policy text. Enable email notifications, review the categorisation and reflect any change in the privacy notice when new processors are added.

Same category

More services: Consent management

See the whole category

CookieFirst

CookieFirst is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. CookieFirst supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, CookieFirst ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Essential

CrownPeak Universal Consent Platform

CrownPeak Universal Consent Platform is a consent management platform (CMP) that helps websites comply with GDPR, CCPA, and global privacy regulations. It provides customizable cookie consent banners, preference centers, and automated compliance scanning. CrownPeak Universal Consent Platform manages user consent across tracking technologies, generates compliance reports, and integrates with tag management systems. With geo-targeted policies and TCF 2.0 support, CrownPeak Universal Consent Platform.

Essential

KIProtect

Kiprotect is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Kiprotect supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Kiprotect ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Essential

Qooqie

Qooqie is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Qooqie integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Qooqie helps organizations maintain robust websites that meet user expectations and technical requirements.

Essential

Osano

Osano is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Osano supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Osano ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Essential

Gravito

Gravito is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Gravito supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Gravito enables informed decisions that improve experience and drive results.

Analytics

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site