Question 1

What is Cookietrace?

Accepted Answer

Cookietrace is an enterprise-grade Consent Management Platform (CMP) that keeps websites compliant with GDPR, KVKK, ePrivacy and CCPA. Built by Ezera Digital Technologies FZCO (Ezeratech Digital).

Question 2

Who uses Cookietrace?

Accepted Answer

E-commerce sites, fintech, SaaS, agencies, telecom and SMBs. Suitable for any size of website that needs KVKK in Türkiye, GDPR in the EU, CCPA in the US.

Question 3

How long does setup take?

Accepted Answer

3 minutes with a single-line script. No code changes or developer help required. Can also be added through a tag manager.

Question 4

How many languages does Cookietrace support?

Accepted Answer

The banner UI ships in 8 languages: Turkish, English, German, French, Spanish, Italian, Dutch and Polish. Custom language additions are available from the Pro plan.

Question 5

Which countries are covered?

Accepted Answer

Geo-targeting works worldwide. The banner shows the right regulation per country: KVKK for TR, GDPR for the EU, CCPA/CPRA for US states, LGPD for Brazil.

Question 6

Is Cookietrace compliant with the KVKK Authority's 2022 Cookie Guide?

Accepted Answer

Yes, 100%. Disclosure for essential cookies, plain-language requirement, equal-prominence Accept/Reject buttons, separate consent for cross-border transfer — all articles are applied by default.

Question 7

Is GDPR compliance not enough?

Accepted Answer

If you operate in Türkiye, GDPR alone is not enough. KVKK Art. 9 (cross-border transfer), the explicit consent definition and VERBİS obligations differ. Cookietrace is designed KVKK-native.

Question 8

Does it comply with the ePrivacy Directive?

Accepted Answer

Yes. Per the EU ePrivacy Directive (Cookie Law), all non-essential cookies are blocked before consent. No pre-ticked checkboxes, no dark patterns.

Question 9

Does it support California (CCPA/CPRA)?

Accepted Answer

Yes. For US users, the 'Do Not Sell My Personal Information' link, opt-out management and Global Privacy Control (GPC) signal are automatically supported.

Question 10

How are consent logs stored?

Accepted Answer

Each consent event is stored immutably with timestamp, IP hash, banner version and cryptographic hash. In an audit you can prove 'this user made this choice at this time'. Default retention is 3 years, extendable per plan.

Question 11

Does it help with VERBİS registration?

Accepted Answer

Cookietrace automatically lists your cookie inventory and data processing activities — you can use this as a reference in your VERBİS registration. Cookietrace is a software solution and does not provide legal advisory services. For the legal aspects of VERBİS registration, please consult your own legal counsel.

Question 12

Who is the data controller?

Accepted Answer

As the website owner, you are the data controller. Cookietrace acts as the data processor. A KVKK-compliant standard Data Processing Agreement (DPA) is included in all plans.

Question 13

What is the script weight?

Accepted Answer

Under 15 KB (gzip). With edge-cached delivery and async-defer loading the impact on Core Web Vitals is negligible. Test sites show no measurable change in LCP/CLS.

Question 14

Will it slow down my site?

Accepted Answer

No. The banner script, written with a modern stack, is non-blocking and loads async. There is no visible drop in your Lighthouse scores.

Question 15

What is automated cookie discovery?

Accepted Answer

The Deep Scan engine crawls your site weekly, automatically finds and categorizes newly added cookies and trackers. No manual updates needed.

Question 16

Does it support Single Page Applications (SPA)?

Accepted Answer

Yes. Fully compatible with React, Vue, Angular, Next.js and other SPA frameworks. Banner state persists across page transitions.

Question 17

Does it work on AMP pages?

Accepted Answer

Yes, we offer an AMP-compatible banner version. Included from the Pro plan and above.

Question 18

Is there a free plan?

Accepted Answer

There is no permanently free plan. Every plan starts with a 14-day trial that needs no credit card and includes the consent banner, tracker request blocking, audit logs, 8 languages, and Google Consent Mode v2.

Question 19

What is the contract length?

Accepted Answer

Cancel monthly. We offer 20% off for annual billing but there is no long-term lock-in.

Question 20

Is there an extra fee for multiple domains?

Accepted Answer

Pro includes 10 domains, Premium includes 100 domains and Enterprise is unlimited. Additional domains can be purchased modularly.

Question 21

How is my data secured?

Accepted Answer

All traffic runs over HTTPS, consent data is stored encrypted. Stored consent records are immutable — cannot be modified. Regular backups and access logs are maintained.

Question 22

Where is my data stored?

Accepted Answer

By default in an EU (Frankfurt) data center. Türkiye-based data residency is available on request — eliminating the KVKK Art. 9 cross-border transfer obligation.

Question 23

What happens in case of a data breach?

Accepted Answer

Our DPA includes a reasonable-time notification obligation. We notify the data controller per KVKK Art. 12 and GDPR Art. 33. All security events are automatically logged.

Question 24

Does it work with Google Tag Manager?

Accepted Answer

Yes, native GTM integration. Tags are automatically triggered or blocked based on consent state.

Question 25

Does it support Google Consent Mode v2?

Accepted Answer

Yes, out-of-the-box. The Consent Mode v2 signals required for Google Ads and GA4 to function properly in the EU and TR are sent automatically.

Question 26

Are there Shopify, WooCommerce, Wix integrations?

Accepted Answer

Yes, official one-click plugins/apps are available for all of them. There is also a universal script option that works with any CMS.

Question 27

Does it work with the programmatic ad ecosystem?

Accepted Answer

Yes. The banner is compatible with Google Ads, Meta Ads and other major ad-tech platforms. Ad scripts are automatically triggered or blocked based on consent state.

Question 28

Is there API and webhook access?

Accepted Answer

Yes, REST API and webhook access are included on all plans. You can stream consent events to your own data warehouse.

Question 29

When does EU AI Act Article 50 become enforceable?

Accepted Answer

2 August 2026 for systems placed on the market after that date. Systems already on the market before then have until 2 December 2026 — the grace period was shortened from 6 to 3 months by the 7 May 2026 Digital Omnibus agreement.

Question 30

Does the EU AI Act apply to my non-EU company?

Accepted Answer

Yes, if you have EU users or offer an AI system on the EU market. The Act's territorial scope mirrors GDPR — being established outside the EU does not exempt you.

Question 31

What are the 4 obligations of Article 50?

Accepted Answer

(1) Chatbot / AI interaction disclosure — tell users they are talking to AI. (2) AI-generated content marking — machine-readable watermark/metadata for synthetic text/image/video/audio. (3) Emotion recognition & biometric categorisation — inform exposed individuals. (4) Deepfake & public-interest content labelling — visible label.

Question 32

What are the penalties?

Accepted Answer

Article 50 violations can be fined up to €15 million or 3% of global annual turnover, whichever is higher. California SB 942 carries $5,000 per violation; Oregon SB 1546 grants $1,000 statutory damages per violation.

Question 33

I only use ChatGPT for support. Am I in scope?

Accepted Answer

Yes. Any user-facing AI interaction — including third-party chatbots — falls under Article 50(1). Colorado, Oregon and Washington have parallel rules.

Question 34

How do I 'machine-readable' mark AI-generated content?

Accepted Answer

The C2PA (Coalition for Content Provenance and Authenticity) standard is the de facto solution: cryptographically signed provenance metadata embedded in the media file. The Cookietrace AI Disclosure Module produces C2PA for image/video/audio.

Question 35

Is there a US federal AI transparency law?

Accepted Answer

No. The 11 December 2025 Trump executive order challenges state laws, but until courts decide, state laws such as California SB 942, Colorado AI Act, Texas TRAIGA (HB 149), Oregon SB 1546 and Washington HB 2225 remain in force.

Question 36

When does the Cookietrace AI Disclosure Module ship?

Accepted Answer

June 2026 — two months ahead of EU Article 50 enforcement. It shares the same loader as our CMP, no extra integration needed. Details: /ai-disclosure page.

Question 37

¿Qué ocurre cuando un visitante pulsa "Rechazar todo"?

Accepted Answer

Las cookies ya establecidas por las categorías rechazadas se eliminan, a los proveedores con API de consentimiento (Meta, Clarity, TikTok) se les comunica la revocación y —si activas el bloqueo de solicitudes— las peticiones salientes hacia rastreadores conocidos se detienen antes de salir del navegador. Los scripts ya cargados no se eliminan de la página; lo que se detiene es su transmisión de datos.

Question 38

¿Podéis bloquear rastreadores antes de que el visitante elija?

Accepted Answer

Sí, con una segunda opción facultativa. Cuando está activa, los rastreadores no esenciales se detienen hasta que el visitante elige, que es lo que esperan las reglas opt-in. Está desactivada por defecto porque reduce el tráfico medido y porque la decisión te corresponde como responsable del tratamiento. Una limitación: nuestro widget se carga de forma asíncrona, por lo que no puede deshacer una solicitud ya enviada en los primeros instantes de la primera visita. El efecto pleno se alcanza a partir de la siguiente visita.

Question 39

¿Google Analytics recoge datos antes del consentimiento?

Accepted Answer

Con Google Consent Mode v2 las etiquetas reciben una señal de "sin consentimiento": GA no escribe cookies y envía un ping sin cookies. Tras el consentimiento pasa a la medición completa. Si también quieres detener ese ping, activa el bloqueo de solicitudes con la opción previa al consentimiento.