| TL;DR: Cookie consent often gets treated as a final website task, even though analytics, advertising tools, and third-party scripts may already be collecting data by then. Once that happens, the earlier activity cannot be fixed retroactively. CookieYes is closing that gap by moving consent into the workflows where websites are built and managed, through its Cloudways partnership and MCP server. It is also extending that approach to AI-assisted workflows, where software may increasingly act on a user’s behalf. |
A website can launch with a lot of broken things. However, there’s one thing that can’t be fixed once you go live – cookie consent.
You see, if a site starts non-essential tracking data before a visitor makes a choice, you cannot go back later and collect consent for that earlier visit. You end up violating the requirement for prior consent under privacy laws such as the GDPR and the ePrivacy Directive.
CookieYes says it has seen this pattern repeatedly. And the problem often starts with how websites are built. Developers often think about adding analytics, advertising tools, chat widgets, and plugins. However, consent, though critical, often gets handled after everything else is already in place.
CookieYes is trying to help solve this problem. In July, the company became the exclusive consent management partner for Cloudways, a managed cloud hosting platform, bringing its WordPress plugin into the website setup process.
However, getting consent in place at launch solves only one part of the workflow problem. Websites continue to change after they go live, and consent has to be managed alongside those changes.
That’s why, in August, the company launched an MCP server for managing consent through AI assistants.
Before we dig in, let’s talk a bit more about consent management.
Consent Has to Be There Before the Data Tracking Starts
There is something unusual about cookie consent when compared to most other website problems. A bad landing page can be rewritten, a slow page can be optimized, and a broken form can be fixed after launch.
However, consent has a different problem: the first few visits can matter just as much as everything that comes after them.
Shreya Nambiar, who heads marketing at CookieYes, put it plainly:
Cookie enforcement increasingly looks at what happened before a visitor made that choice.
For instance, France’s CNIL fined SHEIN’s Irish subsidiary €150 million in September 2025. One of the reasons was the placement of advertising cookies before users had provided consent.
The problem, then, is not simply that a website needs a consent banner. There can be a period between going live and putting the right controls in place, and businesses cannot clean up everything that happened during the period.
For the company, that raises a more practical question: why should that period exist in the first place?
Consent Gaps Often Start in the Website Workflow
CookieYes is now used on more than two million websites. Over time, that scale gave the company a view of what happens when businesses actually look closely at everything running on their sites.
Nambiar said one pattern kept appearing:
The surprise is often not that a business has tracking. It is just how much of it arrived indirectly. She further explained: “A common surprise is how many cookies and scripts have been added indirectly. A business may knowingly install an analytics tool, video embed, chat widget or advertising plugin without realising that these services can introduce additional cookies and third-party scripts across the website.”
CookieYes scans the site and builds an inventory of what it finds. Known cookies are categorized, while others are flagged for review.
For newly detected cookies, its AI Cookie Classifier can analyze how they are being used and suggest a category with a confidence level. Companies can then decide whether high-confidence classifications should be published automatically or reviewed manually.
The scan, in other words, does more than just check whether a banner exists. It can show businesses which cookies and scripts are being detected on their site, including ones they may not have added directly.
Cloudways Moves Consent Into Website Setup
That is what makes CookieYes’ Cloudways partnership more interesting than a standard distribution announcement.
The company became the exclusive consent management partner for Cloudways this July.
Cloudways had studied plugin usage across more than 100,000 WordPress applications while building its Partner Hub. CookieYes now sits inside that setup process, allowing businesses to add consent management while they are building their WordPress site.
Now, instead of waiting until the site is live and then checking what needs to be fixed, businesses can put consent controls in place before public traffic begins.
The MCP Server Brings Consent Into Another Existing Workflow
In August, CookieYes extended that workflow-first approach into AI assistants. Its new MCP server lets people use Claude and other compatible assistants to work with their CookieYes setup.
Who does it benefit?
Enterprises and agencies. To give an example, an agency managing several client websites can ask which domains have an active banner or when each site was last scanned. It can also retrieve installation code or trigger a new scan without opening each account manually.
The platform exposes ten tools through the MCP server. Seven of them can retrieve information, while three tools can make changes post explicit approval.
In other words, the tool can help manage the consent system without getting access to the underlying records of what individual visitors chose.
Nambiar described the goal this way:
Cloudways moves consent into website setup. MCP moves it into the tools teams use to manage those websites afterward. CookieYes also connects those consent choices with tools such as Google Consent Mode, Google Tag Manager, and Microsoft Clarity. Those integrations let advertising, analytics, and behavioral tools actually respond to the choices visitors make.
AI Agents Create a Different Consent Question
The MCP server puts AI on the business side of the consent interaction. Whereas browser agents put it on the visitor side. An AI agent can browse websites, click buttons, fill forms, and complete actions on someone’s behalf. However, it raises the question: can it also provide cookie consent for that person?
CookieYes says an automated click should not automatically be treated as valid consent. Current European Data Protection Board guidance still requires consent to be specifically given.
To give an example, someone might tell an agent to find a hotel in Paris and book the best option under $300. That gives the agent authority to make the booking, but not necessarily to make privacy decisions along the way.
The company recommends testing websites in both request-only environments and full browser-agent sessions to see what trackers load and how consent mechanisms behave. There is no settled industry standard here yet. The question is whether an agent can make a privacy choice that legally belongs to the person it represents.
Consent Was Already Moving Toward Machines
Europe had been considering another version of this problem before browser agents entered the conversation.
The EU’s Digital Omnibus proposed making consent preferences machine-readable at the browser level. Instead of responding to similar banners repeatedly, people could potentially communicate certain choices through browser settings that websites would recognize.
The Council removed that provision in June 2026, although the legislative process is still ongoing.
That provision is out of the Council’s position for now, but the problem it was trying to solve has not disappeared. Browsers can communicate preferences, AI assistants can manage consent software, and browser agents can act on behalf of users.
Consent infrastructure is increasingly being built to communicate with software, not just the people sitting behind it.
CookieYes Is Trying to Get Closer to Where the Decision Happens
CookieYes’ recent moves point to a broader shift in consent management. Their work is moving closer to the places where websites are built, changed, and managed, instead of sitting at the end as a separate compliance task.
As more browsing and online activity gets handed to agents, consent systems may need to account for more than whether a choice was technically made. They may also need to understand who made it, on whose behalf, and with what authority.
CookieYes has started raising that question early. As more online activity gets handed to agents, the harder question may not be whether they can make a choice, but which choices they are actually allowed to make for us.
