Borlabs Cookie vs Real Cookie Banner

Borlabs Cookie

Consent is granular down to the individual service alongside service groups, the banner is stated to meet WCAG 2.1 level AA with a colour assistant, there are eight professional translations with automatic translation of custom services, an EU versus non-EU visitor rule, a freely positionable settings icon for changing choices later, and consent statistics by service and group. However, the captured pages never state that reject sits on the first layer with the same weight as accept, the regional rule stops at an EU/non-EU distinction rather than per-country banners, and A/B testing is not documented — and the first-layer reject question is precisely what an authority letter asks first.

Real Cookie Banner

The choice architecture is documented in real depth: consent per service group and per TCF vendor, more than twenty design templates with over two hundred options, nineteen languages, per-country geo restriction computed locally with MaxMind, and WCAG 2.2 Level AA with keyboard and screen-reader support plus an accessibility score in the customizer. What I miss when answering a supervisory authority: I found no public statement that reject sits on the first layer with the same weight as accept, and no public information on A/B testing and the limits on what may be tested.

Borlabs Cookie

Script, style and content blockers stop specific JavaScript, CSS and embeds such as YouTube and Google Maps until consent, backed by a maintained library of more than 370 packages, per-service tag-manager events, and an audit check that reports whether the site sets cookies or loads external content without consent. Basic Consent Mode is described as loading tags only after consent and as the legally safest option, and the advanced mode's pre-consent pings and their unclear legal status are explained rather than hidden. Server-side tagging and alerts when a new tracker bypasses the banner are not documented.

Real Cookie Banner

Blocking before consent is the product's core: the service and content-blocker templates block data processing until the choice is given, embeds are lazy-loaded only after consent, external fonts can be blocked granularly, and the documentation describes how to test in the browser that cookies really fire only after consent. Tag-manager integration is documented for Google and Matomo, and a developer API covers custom bypass mechanisms. I found no public information on server-side tagging or consent passed specifically to forms and CAPTCHAs.

Borlabs Cookie

An automatic scanner analyses the site for cookies, external resources and consent-requiring features, suggests packages from a library of over 370, can reach HTTP-protected areas and custom URLs, and cookie details with purpose, type and lifetime are supported. But the vendor itself states the scanner deliberately scans only a subset — homepage, one older and one newer page per post type, archives, imprint and contact page — and rescans on a schedule, a self-updating cookie declaration and alerts on new or changed trackers are not documented, so the cookie list matching the whole site is not assured.

Real Cookie Banner

The vendor is unusually candid: it offers a service scanner, explicitly not a cookie scanner, does not promise to find everything, states its limitations (unknown plugins, services loaded later via JavaScript), and recommends manual checking of the website in every article. The scanner crawls the sitemap, detects iframes, script and link tags, font embeds and installed plugins, and suggests manually researched templates — but I found no public information on scheduled rescans, cookie-level classification of the live site, or alerts on new trackers. For my clients this means the cookie declaration rests on templates plus manual work rather than continuous verification against the running site.

Borlabs Cookie

Consent logs are documented including changes over time, consent is requested again when services change, expiry is configurable, consents are shared across domains, and everything is stored on the customer's own server because no visitor data reaches the vendor. But nothing documents that each record is tied to the banner version shown, a retention period for the log, or an export of the log — and when an authority asks which banner a visitor saw, a log without versions is a log, not proof.

Real Cookie Banner

Each record carries a server-generated pseudonymous UUID and a revision hash that identifies which banner settings — texts, colours, services, service groups, content blockers — were in force when the choice was made, and any change to those settings triggers re-consent; records sit in the customer's own WordPress database, are deleted automatically after the retention period, and can be viewed and exported in the backend. That is close to what an authority asks to see. I found no public information on a consent ID the visitor could look up, withdrawal recorded as its own event, or tamper-proof logging.

Borlabs Cookie

TCF v2.4 is stated as certified with Global Vendor List handling, TC-string parameters and vendor configuration by purpose or ID list, Google Consent Mode v2 works in basic and advanced mode with all seven consent types documented, Microsoft UET consent mode is included, and agency tiers cover up to 99 websites. It is a WordPress plugin with a documented JavaScript API, WP-CLI and local tag-manager hosting; we found no public information on app SDKs, GPP or Global Privacy Control, and no registered CMP ID or REST configuration API is shown.

Real Cookie Banner

TCF support is deep — automatic weekly Global Vendor List updates, a vendor management tab, non-conforming options hidden when TCF is on — and Google Consent Mode v2 is documented down to additional consent types, ad-data redaction and per-country region signals, alongside JavaScript and REST APIs and multisite or multilingual operation. The captured pages give different figures for Google CMP certification — one page names certification by Google and IAB Europe, others state the product is not part of the Partner Program — and I found no registered CMP ID. The product is WordPress-only; I found no public information on app SDKs, connected TV, GPP or Microsoft signals.

Borlabs Cookie

Borlabs GmbH is registered in Hamburg with a German VAT ID, the plugin runs entirely on the customer's own server where all data stays and no visitor data is transmitted to the vendor, a data processing agreement is published and another is offered whenever support needs credentials, and processors are named with countries including HelpSpace in Germany and Google Ireland for spam protection. This is effectively the self-hosted end of the chain; ownership and security certifications are not documented, the sales chain runs through Paddle.com as Merchant of Record, and the vendor's own privacy policy names Amazon SES for email with the product-related scope left open.

Real Cookie Banner

The whole product runs on the customer's own server: the banner is served from the customer's webspace with nothing loaded from vendor servers for visitors, consents are processed and stored there, and the vendor states it has no access to settings or documented consents — the strongest posture a consent tool can have for keeping visitor data in the EU. The contracting entity is the devowl.io GmbH in Grafling, Germany, registered at Amtsgericht Deggendorf. The residual chain — license activation on license.devowl.io and assets.devowl.io, Global Vendor List downloads from rcb.devowl.io, and telemetry including the number of documented consents of the last thirty days — comes with no subprocessor list, no certification, and no data processing agreement for operation, which the vendor declines to offer on the stated ground that it is not a processor; an agreement is offered for support access.

Borlabs Cookie

Tiers are public with prices per website count — from €49 up through 179 €/year for 10 websites, 229 €/year for 25 and 499 €/year for 99 — with unlimited page views and subpages so no traffic overage exists, all functions including TCF and Consent Mode in every tier, VAT treatment stated as excluded, cancellation anytime and a 30-day money-back guarantee. Setup fees and the tiers between the captured ones are not shown on the pages I read, which keeps the annual figure from being fully derivable for every website count.

Real Cookie Banner

All five tiers are public with their price and website count — from 59 € Brutto pro Jahr for one website to 299 € Brutto pro Jahr for twenty-five — each including all features, updates and premium support, with VAT treatment stated, cancellation at any time without notice, and staging licences matching the site count; no traffic or consent limits are documented, so there is no overage to price. Above twenty-five websites the Enterprise offer is unpriced, and the expert setup service carries no stated fee.