Question 1

What is Cookietrace?

Accepted Answer

Cookietrace is an enterprise-grade Consent Management Platform (CMP) that keeps websites compliant with GDPR, KVKK, ePrivacy and CCPA. Built by Ezera Digital Technologies FZCO (Ezeratech Digital).

Question 2

Who uses Cookietrace?

Accepted Answer

E-commerce sites, fintech, SaaS, agencies, telecom and SMBs. Suitable for any size of website that needs KVKK in Türkiye, GDPR in the EU, CCPA in the US.

Question 3

How long does setup take?

Accepted Answer

3 minutes with a single-line script. No code changes or developer help required. Can also be added through a tag manager.

Question 4

How many languages does Cookietrace support?

Accepted Answer

The banner UI ships in 8 languages: Turkish, English, German, French, Spanish, Italian, Dutch and Polish. Custom language additions are available from the Pro plan.

Question 5

Which countries are covered?

Accepted Answer

Geo-targeting works worldwide. The banner shows the right regulation per country: KVKK for TR, GDPR for the EU, CCPA/CPRA for US states, LGPD for Brazil.

Question 6

Is Cookietrace compliant with the KVKK Authority's 2022 Cookie Guide?

Accepted Answer

Yes, 100%. Disclosure for essential cookies, plain-language requirement, equal-prominence Accept/Reject buttons, separate consent for cross-border transfer — all articles are applied by default.

Question 7

Is GDPR compliance not enough?

Accepted Answer

If you operate in Türkiye, GDPR alone is not enough. KVKK Art. 9 (cross-border transfer), the explicit consent definition and VERBİS obligations differ. Cookietrace is designed KVKK-native.

Question 8

Does it comply with the ePrivacy Directive?

Accepted Answer

Yes. Per the EU ePrivacy Directive (Cookie Law), all non-essential cookies are blocked before consent. No pre-ticked checkboxes, no dark patterns.

Question 9

Does Cookietrace block cookies before consent?

Accepted Answer

With Cookietrace's Prior Blocking setting enabled, non-essential cookies and trackers detected by the scan — whether loaded via GTM or embedded directly in the page — are not executed until the visitor makes a choice; if the visitor rejects, they never run, and if they accept, only the accepted categories load.

Question 10

Does it support California (CCPA/CPRA)?

Accepted Answer

Yes. For US users, the 'Do Not Sell My Personal Information' link, opt-out management and Global Privacy Control (GPC) signal are automatically supported.

Question 11

How are consent logs stored?

Accepted Answer

Each consent event is stored immutably with timestamp, IP hash, banner version and cryptographic hash. In an audit you can prove 'this user made this choice at this time'. Default retention is 3 years, extendable per plan.

Question 12

Does it help with VERBİS registration?

Accepted Answer

Cookietrace automatically lists your cookie inventory and data processing activities — you can use this as a reference in your VERBİS registration. Cookietrace is a software solution and does not provide legal advisory services. For the legal aspects of VERBİS registration, please consult your own legal counsel.

Question 13

Who is the data controller?

Accepted Answer

As the website owner, you are the data controller. Cookietrace acts as the data processor. A KVKK-compliant standard Data Processing Agreement (DPA) is included in all plans.

Question 14

What is the script weight?

Accepted Answer

Under 15 KB (gzip). With edge-cached delivery and async-defer loading the impact on Core Web Vitals is negligible. Test sites show no measurable change in LCP/CLS.

Question 15

Will it slow down my site?

Accepted Answer

No. The banner script, written with a modern stack, is non-blocking and loads async. There is no visible drop in your Lighthouse scores.

Question 16

What is automated cookie discovery?

Accepted Answer

The Deep Scan engine crawls your site weekly, automatically finds and categorizes newly added cookies and trackers. No manual updates needed.

Question 17

Does it support Single Page Applications (SPA)?

Accepted Answer

Yes. Fully compatible with React, Vue, Angular, Next.js and other SPA frameworks. Banner state persists across page transitions.

Question 18

Does it work on AMP pages?

Accepted Answer

Yes, we offer an AMP-compatible banner version. Included from the Pro plan and above.

Question 19

Is there a free plan?

Accepted Answer

There is no permanently free plan. Every plan starts with a 14-day trial that needs no credit card and includes the consent banner, tracker request blocking, audit logs, 8 languages, and Google Consent Mode v2.

Question 20

What is the contract length?

Accepted Answer

Cancel monthly. We offer 20% off for annual billing but there is no long-term lock-in.

Question 21

Is there an extra fee for multiple domains?

Accepted Answer

Pro includes 10 domains, Premium includes 100 domains and Enterprise is unlimited. Additional domains can be purchased modularly.

Question 22

How is my data secured?

Accepted Answer

All traffic runs over HTTPS, consent data is stored encrypted. Stored consent records are immutable — cannot be modified. Regular backups and access logs are maintained.

Question 23

Where is my data stored?

Accepted Answer

By default in an EU (Frankfurt) data center. Türkiye-based data residency is available on request — eliminating the KVKK Art. 9 cross-border transfer obligation.

Question 24

What happens in case of a data breach?

Accepted Answer

Our DPA includes a reasonable-time notification obligation. We notify the data controller per KVKK Art. 12 and GDPR Art. 33. All security events are automatically logged.

Question 25

Does it work with Google Tag Manager?

Accepted Answer

Yes, native GTM integration. Tags are automatically triggered or blocked based on consent state.

Question 26

Does it support Google Consent Mode v2?

Accepted Answer

Yes, out-of-the-box. The Consent Mode v2 signals required for Google Ads and GA4 to function properly in the EU and TR are sent automatically.

Question 27

Are there Shopify, WooCommerce, Wix integrations?

Accepted Answer

Yes, official one-click plugins/apps are available for all of them. There is also a universal script option that works with any CMS.

Question 28

Does it work with the programmatic ad ecosystem?

Accepted Answer

Yes. The banner is compatible with Google Ads, Meta Ads and other major ad-tech platforms. Ad scripts are automatically triggered or blocked based on consent state.

Question 29

Is there API and webhook access?

Accepted Answer

Yes, REST API and webhook access are included on all plans. You can stream consent events to your own data warehouse.

Question 30

When does EU AI Act Article 50 become enforceable?

Accepted Answer

2 August 2026 for systems placed on the market after that date. Systems already on the market before then have until 2 December 2026 — the grace period was shortened from 6 to 3 months by the 7 May 2026 Digital Omnibus agreement.

Question 31

Does the EU AI Act apply to my non-EU company?

Accepted Answer

Yes, if you have EU users or offer an AI system on the EU market. The Act's territorial scope mirrors GDPR — being established outside the EU does not exempt you.

Question 32

What are the 4 obligations of Article 50?

Accepted Answer

(1) Chatbot / AI interaction disclosure — tell users they are talking to AI. (2) AI-generated content marking — machine-readable watermark/metadata for synthetic text/image/video/audio. (3) Emotion recognition & biometric categorisation — inform exposed individuals. (4) Deepfake & public-interest content labelling — visible label.

Question 33

What are the penalties?

Accepted Answer

Article 50 violations can be fined up to €15 million or 3% of global annual turnover, whichever is higher. California SB 942 carries $5,000 per violation; Oregon SB 1546 grants $1,000 statutory damages per violation.

Question 34

I only use ChatGPT for support. Am I in scope?

Accepted Answer

Yes. Any user-facing AI interaction — including third-party chatbots — falls under Article 50(1). Colorado, Oregon and Washington have parallel rules.

Question 35

How do I 'machine-readable' mark AI-generated content?

Accepted Answer

The C2PA (Coalition for Content Provenance and Authenticity) standard is the de facto solution: cryptographically signed provenance metadata embedded in the media file. The Cookietrace AI Disclosure Module produces C2PA for image/video/audio.

Question 36

Is there a US federal AI transparency law?

Accepted Answer

No. The 11 December 2025 Trump executive order challenges state laws, but until courts decide, state laws such as California SB 942, Colorado AI Act, Texas TRAIGA (HB 149), Oregon SB 1546 and Washington HB 2225 remain in force.

Question 37

When does the Cookietrace AI Disclosure Module ship?

Accepted Answer

June 2026 — two months ahead of EU Article 50 enforcement. It shares the same loader as our CMP, no extra integration needed. Details: /ai-disclosure page.

Question 38

What happens when a visitor clicks "Reject All"?

Accepted Answer

Cookies already set by the rejected categories are deleted, providers with a consent API (Meta, Clarity, TikTok) are told to revoke, and — if you enable tracker request blocking — outgoing requests to known trackers are stopped before they leave the browser. Note that scripts already loaded are not removed from the page; what stops is their data transmission.

Question 39

Can you block trackers before the visitor makes a choice?

Accepted Answer

With Cookietrace's Prior Blocking setting enabled, non-essential cookies and trackers detected by the scan — whether loaded via GTM or embedded directly in the page — are not executed until the visitor makes a choice; if the visitor rejects, they never run, and if they accept, only the accepted categories load.

Question 40

Does Google Analytics collect data before consent?

Accepted Answer

With Google Consent Mode v2 the tags receive a "no consent" signal: GA does not write cookies and sends a cookieless ping instead. Once consent is given it switches to full measurement. If you also want that ping stopped, enable tracker request blocking with the before-consent option.