CookieHub

Iceland · www.cookiehub.com · 22 vendors

CookieHub is a Consent Management Platform (CMP) that provides tools and services for managing cookies and online privacy. It helps website owners and publishers comply with global data privacy regulations such as GDPR, CCPA, and LGPD by offering features like cookie consent banners, automatic cookie scanning, and user preference management.

Resilience scores

Disruption prediction

CookieHub has an estimated 11% probability of disruption in the next 6 months.

12 of CookieHub's 22 vendors monitored for disruptions.

Technology vendors

Services catalogue

3 services in catalogue across 2 categories; runs on 22 sub-vendors.

Insights

Last updated 2026-07-30 · revision 1

22 direct vendors, 292 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 6/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

CookieHub exhibits a moderate level of migration readiness, scoring 60 out of 100. The company's modern internal tech stack, featuring Next.js, Prismic (headless CMS), and S3-compatible storage, provides a solid foundation for cloud migration. These technologies suggest a decoupled and potentially agile architecture that is well-suited for cloud-native environments. The use of AES-256-GCM encryption also indicates a focus on security, which is a critical aspect of cloud adoption. However, several significant unknowns limit a higher migration readiness score. The 'Vendor Lock-in Risk' is explicitly stated as unknown, which is a crucial factor for migration complexity and cost. The contradiction in vendor data ('Total Vendors: 0' versus 'Total Services: 11' with diverse vendor locations) makes it difficult to accurately assess vendor concentration and potential lock-in. Furthermore, the absence of information on the 'Regulatory Environment' and 'Data Residency Requirements' poses substantial challenges, as these factors can significantly dictate migration strategies, choice of cloud providers, and compliance efforts. The lack of financial stability data also means the company's capacity to fund a potentially costly migration is unassessed. While the tech stack is modern, explicit details on containerization or microservices adoption are not provided, which could further enhance readiness.

Compliance

9 in-scope frameworks identified; showing 3.

IAB TCF 2.3 — Compliant

CookieHub is formally certified under IAB TCF 2.3 by both IAB Europe and IAB Canada, as evidenced by the certification badge displayed on the website and explicit statements on the homepage. This is a formal third-party certification directly relevant to CookieHub's core business as a CMP. Risk is Low because formal certification has been obtained and is publicly displayed.

Evidence: https://www.cookiehub.com, https://www.cookiehub.com/iab-tcf-v23, https://iabeurope.eu/tcf-for-cmps/, https://iabcanada.com/tcf-canada/

ISAE 3000 (source) — Assessment Required

ISAE 3000 is relevant for companies that provide assurance reports to third parties (e.g., as part of SOC 2 or similar assurance engagements). CookieHub is a SaaS provider, not an assurance services firm. However, as a data processor for 30,000+ websites, enterprise customers may request ISAE 3000-based assurance reports (such as ISAE 3402 for service organizations) as part of their vendor due diligence. Risk is Low because ISAE 3000 is not legally mandated and CookieHub's ISO 27001 alignment provides an alternative assurance mechanism. The primary risk is commercial rather than regulatory.

Evidence: https://www.cookiehub.com/legal/data-processing-agreement, https://www.iaasb.org/publications/international-standard-assurance-engagements-isae-3000-revised-assurance-engagements-other-audits-or

Icelandic Act on Data Protection and the Processing of Personal Data — Compliant

Iceland implements GDPR through Act No. 90/2018 on Data Protection and the Processing of Personal Data, which transposes GDPR into Icelandic law. As CookieHub is headquartered in Iceland (Reykjanesbær), this national law is directly applicable. Risk is Low because: (1) CookieHub's GDPR compliance framework (Privacy Policy, DPA, SCCs) directly satisfies the requirements of Act No. 90/2018; (2) The Icelandic Data Protection Authority (Persónuvernd) is the supervisory authority; (3) The company's registered address and VAT number confirm Icelandic legal establishment.

Evidence: https://www.cookiehub.com/about, https://www.personuvernd.is/, https://www.althingi.is/lagas/nuna/2018090.html

Financials

Three-year financials

Financial Resilience Score: 6/10

CookieHub ehf. is a small, private Icelandic SaaS company operating in the Consent Management Platform (CMP) category. No filed financial statements were retrievable in this session, so no revenue, EBIT or equity figures are available. Resilience must therefore be assessed qualitatively. The company benefits from a recurring subscription SaaS model, high gross margins typical of software, a broad customer base of 30,000+ websites reducing single-customer concentration risk, and a strong regulatory tailwind as global privacy laws proliferate (GDPR, UK GDPR/DUAA, CCPA/CPRA, LGPD, DPDP, PIPL, APPI, PIPA, PDPL). Meaningful moats include ISO 27001 certification, Google-certified CMP partner status (important for EEA/UK publishers using Google's ad stack from January 2024), and IAB TCF v2.3 compliance. The company appears founder-owned and likely bootstrapped, with a small Iceland-based team implying a low fixed-cost base. However, competitive pressure from much larger, better-funded CMP players (OneTrust, Cookiebot/Usercentrics, Didomi, TrustArc, Iubenda, Osano, Termly, Ketch) creates persistent price-compression risk, particularly in the SMB tier. FX exposure (revenue in EUR/USD vs. costs partly in ISK), platform dependency on Google and IAB standards, and potential regulatory reversal (native browser consent handling) are additional risks. Financial opacity means resilience cannot be verified with numbers.

Key strengths: Recurring SaaS subscription revenue model with high gross margins, Broad customer base of 30,000+ websites reducing concentration risk, ISO 27001 certified and Google-certified CMP partner status, IAB TCF v2.3 and IAB Europe/Canada certifications, Strong regulatory tailwind from expanding global privacy laws, Low capital intensity with small Iceland-based team, Likely bootstrapped/founder-owned, no external VC dependency

Risk factors: Intense competition from larger CMP players (OneTrust, Cookiebot, Didomi, TrustArc, Iubenda), Price compression risk in the SMB tier, Tiny domestic market (Iceland ~390,000 population) forces reliance on exports, FX exposure between EUR/USD revenue and ISK costs, Platform dependency on Google Consent Mode, IAB TCF, Shopify, WordPress, Regulatory reversal risk if browsers embed native consent handling, No public audited financials—financial resilience must be taken on trust

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report