How This Briefing Works
This dossier opens with key findings, then maps the gap between what CookieYes discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 34 sites
vendor fires before consent
1 CRIT · 2 HIGH
Briefing
CookieYes is a UK-based consent management platform (CMP) founded in 2018, claiming GDPR and CCPA compliance. However, BLACKOUT analysis reveals a critical credibility gap: the vendor has a 55.6% pre-consent tracking rate across 26 monitored sites, and their own website deploys 5 tracking vendors (Clarity, DoubleClick, Google Ads, Google Analytics 4, Slack) before obtaining user consent. Additionally, 8+ vendors detected on their site are not disclosed in their official subprocessor list, including advertising platforms like DoubleClick, Google Ads, and Bing Ads. A consent management platform that cannot manage consent on its own properties represents a fundamental trust violation.
What This Means For You
YOUR consent management is handled by a platform that cannot manage its own consent. YOUR visitors' consent choices are processed by CookieYes while CookieYes itself runs advertising platforms pre-consent on its own site. YOUR compliance posture depends entirely on CookieYes functioning correctly, yet their 55.6% pre-consent rate across monitored sites demonstrates systemic consent architecture failures. If YOUR CookieYes implementation mirrors their own site behavior, more than half YOUR vendors may fire before consent — turning YOUR CMP into compliance theater rather than actual protection.
Risk Channel Breakdown
As a CMP, CookieYes influences consent collection across 1.5M+ claimed websites. If their own consent implementation is flawed (55.6% pre-consent tracking), the measurement of valid consent across their entire customer base is corrupted. Attribution and conversion data collected under invalid consent is legally unusable.
CookieYes positions itself as privacy infrastructure, but their website sends behavioral data to undisclosed advertising platforms (DoubleClick, Google Ads, Bing Ads). This creates a broker risk where a trusted consent vendor is actually feeding the advertising ecosystem it claims to control.
The gap between disclosed subprocessors and actual vendor deployment (8+ undisclosed) creates supply chain opacity. Organizations trusting CookieYes for compliance inherit hidden data flows to Microsoft (Clarity), Google advertising stack, and other third parties not in their vendor risk assessments.
CookieYes claims GDPR/CCPA/IAB TCF compliance while demonstrating pre-consent tracking on their own site. This consent divergence exposes their customers to regulatory risk if auditors discover the CMP vendor itself violates consent requirements. The optics of a consent vendor with consent violations is particularly damaging.
Threat Indicators
Runtime-observed (BTI-C)
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
PII deanonymization
Container/loader (neutral)
Claims-vs-Reality (BTI-X)
Not in privacy policy
Hidden data recipients
Behavior contradicts marketing
False certification claims
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed CookieYes's public claims against observed runtime behavior and identified 3 contradictions.
"GDPR/CCPA compliant consent management"
55.6% pre-consent tracking rate across monitored sites. 5 vendors loading pre-consent on own website
2 more gaps — with regulatory citations and evidence pointers — available with subscription.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
4 for current users · 4 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Claims 14, observed 14
googletagmanager, googleanalytics4, metapixel…
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →