CookieHub Due Diligence

Run due diligence on CookieHub: check compliance and get alerts when suppliers change.

Iceland · www.cookiehub.com · 21 vendors

CookieHub is a Consent Management Platform (CMP) that provides tools and services for managing cookies and online privacy. It helps website owners and publishers comply with global data privacy regulations such as GDPR, CCPA, and LGPD by offering features like cookie consent banners, automatic cookie scanning, and user preference management.

Resilience scores

Technology vendors

Services catalogue

3 services in catalogue across 2 categories; runs on 21 sub-vendors.

Insights

Last updated 2026-07-30 · revision 1

21 direct vendors, 228 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

9 in-scope frameworks identified; showing 3.

Icelandic Act on Data Protection and the Processing of Personal Data — Evidence found

Evidence: https://www.cookiehub.com/about, https://www.personuvernd.is/, https://www.althingi.is/lagas/nuna/2018090.html

ISAE 3000 (source) — No public evidence

Evidence: https://www.cookiehub.com/legal/data-processing-agreement, https://www.iaasb.org/publications/international-standard-assurance-engagements-isae-3000-revised-assurance-engagements-other-audits-or

ePrivacy Directive — Evidence found

Evidence: https://www.cookiehub.com, https://www.cookiehub.com/gdpr, https://www.cookiehub.com/iab-tcf-v23, https://iabeurope.eu/tcf-for-cmps/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32002L0058

Financials

Three-year financials

Financial Resilience Score: 6/10

CookieHub ehf. is a small, private Icelandic SaaS company operating in the Consent Management Platform (CMP) category. No filed financial statements were retrievable in this session, so no revenue, EBIT or equity figures are available. Resilience must therefore be assessed qualitatively. The company benefits from a recurring subscription SaaS model, high gross margins typical of software, a broad customer base of 30,000+ websites reducing single-customer concentration risk, and a strong regulatory tailwind as global privacy laws proliferate (GDPR, UK GDPR/DUAA, CCPA/CPRA, LGPD, DPDP, PIPL, APPI, PIPA, PDPL). Meaningful moats include ISO 27001 certification, Google-certified CMP partner status (important for EEA/UK publishers using Google's ad stack from January 2024), and IAB TCF v2.3 compliance. The company appears founder-owned and likely bootstrapped, with a small Iceland-based team implying a low fixed-cost base. However, competitive pressure from much larger, better-funded CMP players (OneTrust, Cookiebot/Usercentrics, Didomi, TrustArc, Iubenda, Osano, Termly, Ketch) creates persistent price-compression risk, particularly in the SMB tier. FX exposure (revenue in EUR/USD vs. costs partly in ISK), platform dependency on Google and IAB standards, and potential regulatory reversal (native browser consent handling) are additional risks. Financial opacity means resilience cannot be verified with numbers.

Key strengths: Recurring SaaS subscription revenue model with high gross margins, Broad customer base of 30,000+ websites reducing concentration risk, ISO 27001 certified and Google-certified CMP partner status, IAB TCF v2.3 and IAB Europe/Canada certifications, Strong regulatory tailwind from expanding global privacy laws, Low capital intensity with small Iceland-based team, Likely bootstrapped/founder-owned, no external VC dependency

Risk factors: Intense competition from larger CMP players (OneTrust, Cookiebot, Didomi, TrustArc, Iubenda), Price compression risk in the SMB tier, Tiny domestic market (Iceland ~390,000 population) forces reliance on exports, FX exposure between EUR/USD revenue and ISK costs, Platform dependency on Google Consent Mode, IAB TCF, Shopify, WordPress, Regulatory reversal risk if browsers embed native consent handling, No public audited financials—financial resilience must be taken on trust

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report