The scanner-first CookieFirst alternative

CookieFirst is built in Amsterdam by Digital Data Solutions BV, which makes the Dutch DPA's recent posture especially relevant to its users. The Autoriteit Persoonsgegevens has moved cookies from guidance to active enforcement: a dedicated annual budget of around €500,000, a target of roughly 500 warning letters per year, and an April 2025 round in which 50 organizations were given three months to fix misleading banners or unlawful pre-consent tracking. This is not theoretical pressure; it is a regulator working through a list.

The decisive case is the €600,000 fine against AS Watson, operator of Kruidvat.nl. The violation was not a missing banner. It was that tracking cookies were placed the moment a visitor arrived, before they had interacted with the banner at all. A perfectly configured CMP does not protect you if a tag manager, a chat widget, or an embedded video fires its own cookie ahead of consent. That is precisely the gap CookieSentry is built to surface, independent of whatever banner you run.

CookieFirst, like any CMP, records the consent it collects. That answers one question: did the user click accept. It does not answer the question the Kruidvat fine turned on: did anything fire before that click. Those are different facts, and only the second one is what a scan can establish. A consent log is intent; a pre-consent scan is behavior.

CookieSentry loads your live page as a visitor would and captures what actually executes before any consent signal. Because the scan is independent of your CMP, it catches the cases CMPs routinely miss: scripts injected outside the consent gate, hardcoded pixels, third-party embeds that set cookies on load. Keep CookieFirst running the banner. Use CookieSentry to confirm, on a schedule, that the banner is genuinely holding everything back, and to produce the export that shows it.

This is not a rip-and-replace. If CookieFirst is your consent UI, leave it in place. Its banner, TCF 2.2 support, and Consent Mode integration are real strengths CookieSentry does not offer and is not trying to. What you add is the verification and documentation layer that sits beside the banner rather than inside it.

The one place CookieSentry genuinely substitutes is the audit half. If a team adopted CookieFirst mainly to scan and inventory cookies, CookieSentry covers that need with an independent, exportable, public-by-default scan plus national-law-aware GDPR documents, while CookieFirst continues to do what it does best at the banner. The result is separation of duties: the CMP manages consent, and an independent tool proves and documents compliance.