As of 30 Oct 2026, the panel rates Cookiebot 3/5 and CookieYes 3/5 in Consent Management (CMP). Weighted by what each judge cares about, 1 of the 6 judges picks Cookiebot and 4 pick CookieYes, 1 calls it a tie. Cookiebot scores higher on 5 of 7 criteria (Scanning & cookie classification, Banner & choice architecture, Frameworks, signals & platforms, plus 2 more). CookieYes scores higher on 2 of 7 criteria (Pricing transparency and Prior blocking & script control). Provenance — Cookiebot: EU-Made; CookieYes: UK / wider Europe. Ratings are the AI panel’s opinion, formed from public evidence: how scores are made.
The computed table splits the two along different criteria. Cookiebot leads banner and choice (7.2 vs 6.7, three leans, three ties), scanning and classification (7.0 vs 6.3, four leans to none), standards and platforms (7.0 vs 6.7), consent records (6.2 vs 6.0) and sovereignty (4.0 vs 3.8, five ties). CookieYes leads pricing transparency (7.5 vs 5.7, six leans to none) and prior blocking (6.5 vs 5.5, five leans to none). Weighted totals differ judge by judge: CookieYes ahead for four judges, Cookiebot for the data protection officer (6 vs 5.7), and the skeptic ties at 5.8. The verdicts cite CookieYes's four published tiers at $0, $10, $25 and $55 per month per domain and missing prices for Cookiebot above Premium Lite (7 €/month). Sovereignty attributes list Cookiebot's legal entity as DK with ownership, data residency and subprocessor exposure unknown; CookieYes lists each of its four as unknown.
Choose Cookiebot if
You need scanning that reaches cookies, local storage, IndexedDB, pixel tags and dynamic cookies — four judges lean Cookiebot on scanning and classification (7.0 vs 6.3).
You depend on Google Consent Mode v2 with Google-certified (Golden Badge) status, Microsoft UET, Clarity, Amazon signals and GPC — two judges lean Cookiebot on standards and platforms (7.0 vs 6.7).
You weigh banner and choice heaviest in your decision — three judges lean Cookiebot there (7.2 vs 6.7).
You must contract with an entity in Denmark — Cookiebot's sovereignty attributes list its legal entity jurisdiction as DK.
You sit in the data protection officer role — the weighted total runs Cookiebot 6 vs CookieYes 5.7.
Choose CookieYes if
You need published prices before you buy — six judges lean CookieYes on pricing transparency (7.5 vs 5.7), with tiers at $0, $10, $25 and $55 per month per domain.
You need third-party scripts blocked before consent — five judges lean CookieYes on prior blocking (6.5 vs 5.5).
You need a free starting tier and predictable overage — CookieYes publishes a $0 tier and overage at $0.30 per 1,000 extra pageviews.
Your team builds or maintains client sites — the agency developer's weighted total runs 6.5 vs 6.2 and the WordPress webmaster's 6.5 vs 6.2.
You run a publishing or marketing site — the publisher marketing lead's weighted total runs 6.6 vs 6.3.
Read this comparison as one judge. Each weighs the same scores by what they care about.
The Agency Developer
Lead developer at a web agency that maintains forty client sites on WordPress, TYPO3 and Shopify. Wants one account for every client, blocking that works without rewriting each theme, content blockers for YouTube and Maps, a Tag Manager template, a scanner that flags the tracker a client added on Friday, and a JavaScript API documented well enough that forms and plugins can ask for consent.
Cookiebot
CookieYes
This judge's pick
Criterion by criterion
Banner & choice architecture
Cookiebot
The three-button banner documents accept, reject and manage-preferences on the first layer with category toggles on both layers, withdrawal at any time via the cookie declaration, opt-in versus opt-out rules set per region, WCAG 2.2 and WAI-ARIA named, and 47+ languages with automatic browser detection, plus a consent-rate benchmark add-on. Vendor-level choice only appears inside the IAB Ad Settings panel, and we found no public information on keeping every banner version for reconstruction or which dark patterns are prevented. Close to what I need for client rollouts, but not regulator-proof depth.
CookieYes
The banner is documented in real depth — three layouts with positions and colour themes, categories on the first layer for one layout, a floating button and callback widget to change or withdraw consent later, thirty-plus languages with auto-translation, GDPR versus US-state templates and geo-targeting by country. Consent per vendor and purpose comes through the TCF banner and the pricing page lists WCAG accessibility certification; we found no public information on a reject button of equal weight on the first layer, consent-rate analytics or A/B testing, or which WCAG level the certification covers.
Prior blocking & script control
Cookiebot
Automatic blocking of non-necessary cookies until consent, blocking mapped into functional groups by the scanner, and a Google Tag Manager template with a documented cookie consent update custom event for triggers are all public. We found no public information on placeholder content blockers for YouTube and Maps embeds, a JavaScript API that forms and plugins can call, server-side tagging, or instructions to verify in the browser that nothing fires before consent. The auto-blocking and GTM story is real; the embeds and API documentation are exactly what I would still need.
CookieYes
Automatic blocking of third-party scripts and cookies before consent has its own documentation page, embedded YouTube and Vimeo videos get a placeholder with editable text, there is a Google Tag Manager implementation route, documented consent events a plugin can listen to, and a step-by-step Chrome DevTools check that nothing loads early. We found no public information on a manual blocking mode with its limits, server-side tagging, or consent passed to forms and CAPTCHAs.
Scanning & cookie classification
Cookiebot
The scanner is documented broadly: patented deep scanning of first- and third-party cookies plus third-party requests, covering local storage, IndexedDB, pixel tags and even ultrasound beacons, monthly rescans with a daily option at +99 € /Mon., automatic categorisation into named categories, and a cookie declaration published on the site that even carries an Unclassified bucket rather than hiding unknowns. We found no public information on email alerts for new or changed trackers, a stated scan depth or page count, or scanning behind logins. A tracker a client added on Friday gets caught at the next monthly pass, or daily if they pay for the add-on.
CookieYes
The scanner is scheduled — monthly on Pro, weekly on Ultimate — with pages-per-scan limits per tier from 100 to 8,000, scan-behind-login and static IP scanning on the top plan, and classification against a database of 100,000+ pre-categorised cookies. For an agency like mine the gap is alerting: we found no public information on alerts when a new or changed tracker appears, on scanning local storage and pixels, or on a declaration that updates itself in several languages.
Consent records & proof
Cookiebot
Consent documentation runs with a stated retention of up to 12 months, CSV export of all consents including categories, configurable expiry (up to 1 month free, up to 12 months premium), a consent ID visitors are asked to cite, cross-domain consent sharing, and a data copy available before cancellation. We found no public information on records tied to the exact banner version and texts shown, withdrawal logged as its own event, or searching the log through an API. Good enough for client audits, not dispute-grade.
CookieYes
The consent log records consent ID, domain, date and time in UTC, country, a pseudonymised IP, and overall and category-wise status, a Proof of Consent can be generated as a PDF, consent expiry is configurable with a 365-day default, and the DPA covers retention for the duration of the agreement with deletion within 60 days of termination. We found no public information on records tied to the banner version and texts shown, withdrawal recorded as its own event, or search and export of the log through an API.
Frameworks, signals & platforms
Cookiebot
Google certification (Gold Tier, Golden Badge) with Consent Mode v2 in basic and advanced mode, Microsoft UET and Clarity consent modes, Amazon consent signals and GPC are all documented, alongside TCF support — the captured pages give different figures for the TCF version, 2.3 on the features page and 2.4 on the IAB and pricing pages — a WordPress plugin, Wix and Shopify apps, guides for TYPO3 and nine other systems, multi-domain management and a partner/reseller programme. We found no public information on a registered IAB CMP ID, GPP, dedicated iOS or Android SDKs, or a REST API for configuration. It covers the three systems I run; the app and API side stays vague.
CookieYes
The signal story is strong: registered IAB TCF v2.4 certification, Google-certified for Consent Mode v2 including Additional Consent Mode, a full documentation page on Microsoft UET consent mode with granted and denied behaviour, Global Privacy Control from Pro, WordPress, Shopify and Wix apps, a Google Tag Manager trigger event, and an agency partner programme. We found no public information on a REST configuration API, iOS or Android SDKs, GPP, or a published CMP ID number — and TCF itself sits behind the Pro and Ultimate plans.
European sovereignty
Cookiebot
The contracting entity is clearly European — Usercentrics A/S, Havnegade 39, Copenhagen, with the company registration number stated — and a data processing agreement plus ISO 27001, ISO 27701 and SOC 2 Type 2 certifications are published, with EU standard contractual clauses named as the safeguard for transfers inside a group that includes Usercentrics Inc. We found no public information on where the banner script is served from, where consent logs and scan results are stored, or any named subprocessors such as CDN, geolocation or scanner infrastructure. Entity and safeguards are proven; the rest of the chain is not, which matters when the script sits on every page of every client site.
CookieYes
The contracting entity is CookieYes Limited, registered in the UK with company number 13074037, an EU representative in Ireland is named, a DPA is published using SCCs, and subprocessors including Stripe, Intercom, Zendesk and Sendgrid are named in the privacy policy, though without their locations. Hosting is on AWS covered by ISO 27001 and SOC 2 data-centre attestations, but no region is stated and the privacy policy says personal data may be stored and processed in any country where they have operations — the weak link when a client asks where every visitor's consent sits.
Pricing transparency
Cookiebot
The scaling basis is public — price per domain plus subpages, tier bands at under 50, 350, 3,500 and 7,000 subpages, automatic upgrade when the monthly scan finds more pages — with Premium Lite at 7€ /Monat, a daily-scan add-on at +99 € /Mon., VAT treatment, no minimum term, and a free tier limited to one domain and 50 subpages. We found no public prices for the Small through Extra-Large bands, extra domains, TCF licensing beyond "paid from the entry paid tier", or agency and reseller terms. I can price a single small site; I cannot compute the annual cost for a forty-domain portfolio from these pages alone.
CookieYes
From public pages alone I can quote a client: $0, $10, $25 and $55 per month per domain with pageview limits from 5,000 to unlimited, overage at $0.30 per 1,000 extra pageviews, pages-per-scan limits per tier, two months free on annual billing, VAT charged in addition, and subdomains counting as separate domains. Enterprise is custom contracts, and we found no public information on agency or reseller terms, separately priced add-ons, or the minimum term length.
Sovereignty, side by side
Dimension
Cookiebot
CookieYes
Legal entity
Not determined
Not determined
Hosting location
Not determined
Not determined
Hosting options
Not determined
Not determined
Open source
Not determined
Not determined
Data processing agreement
Not determined
Not determined
Transfer impact assessment
Not determined
Not determined
Facts, side by side
Only facts both products carry under the same definition — anything else would not be a fair row.
As of 30 Oct 2026, the panel rates both 3/5. Weighted by what each judge cares about, 1 of the 6 judges picks Cookiebot and 4 pick CookieYes, 1 calls it a tie. Which one fits depends on the criteria that matter to you; the table on this page shows both side by side, and each judge’s reading has its own page. Both were scored by the same AI bench under the same rubric, from public evidence only, as the methodology describes.
Is Cookiebot or CookieYes European?
Cookiebot is European (EU-Made). CookieYes is European (UK / wider Europe). Provenance is read from each company’s own legal pages: who builds it and who owns it.
Do Cookiebot and CookieYes have a free plan?
As of 30 Oct 2026, both vendors’ own pages state a free plan. Each product page links the pricing page it was read from.