As of 30 Oct 2026, the panel rates Cookiebot 3/5 and CookieYes 3/5 in Consent Management (CMP). Weighted by what each judge cares about, 1 of the 6 judges picks Cookiebot and 4 pick CookieYes, 1 calls it a tie. Cookiebot scores higher on 5 of 7 criteria (Scanning & cookie classification, Banner & choice architecture, Frameworks, signals & platforms, plus 2 more). CookieYes scores higher on 2 of 7 criteria (Pricing transparency and Prior blocking & script control). Provenance — Cookiebot: EU-Made; CookieYes: UK / wider Europe. Ratings are the AI panel’s opinion, formed from public evidence: how scores are made.
The computed table splits the two along different criteria. Cookiebot leads banner and choice (7.2 vs 6.7, three leans, three ties), scanning and classification (7.0 vs 6.3, four leans to none), standards and platforms (7.0 vs 6.7), consent records (6.2 vs 6.0) and sovereignty (4.0 vs 3.8, five ties). CookieYes leads pricing transparency (7.5 vs 5.7, six leans to none) and prior blocking (6.5 vs 5.5, five leans to none). Weighted totals differ judge by judge: CookieYes ahead for four judges, Cookiebot for the data protection officer (6 vs 5.7), and the skeptic ties at 5.8. The verdicts cite CookieYes's four published tiers at $0, $10, $25 and $55 per month per domain and missing prices for Cookiebot above Premium Lite (7 €/month). Sovereignty attributes list Cookiebot's legal entity as DK with ownership, data residency and subprocessor exposure unknown; CookieYes lists each of its four as unknown.
Choose Cookiebot if
You need scanning that reaches cookies, local storage, IndexedDB, pixel tags and dynamic cookies — four judges lean Cookiebot on scanning and classification (7.0 vs 6.3).
You depend on Google Consent Mode v2 with Google-certified (Golden Badge) status, Microsoft UET, Clarity, Amazon signals and GPC — two judges lean Cookiebot on standards and platforms (7.0 vs 6.7).
You weigh banner and choice heaviest in your decision — three judges lean Cookiebot there (7.2 vs 6.7).
You must contract with an entity in Denmark — Cookiebot's sovereignty attributes list its legal entity jurisdiction as DK.
You sit in the data protection officer role — the weighted total runs Cookiebot 6 vs CookieYes 5.7.
Choose CookieYes if
You need published prices before you buy — six judges lean CookieYes on pricing transparency (7.5 vs 5.7), with tiers at $0, $10, $25 and $55 per month per domain.
You need third-party scripts blocked before consent — five judges lean CookieYes on prior blocking (6.5 vs 5.5).
You need a free starting tier and predictable overage — CookieYes publishes a $0 tier and overage at $0.30 per 1,000 extra pageviews.
Your team builds or maintains client sites — the agency developer's weighted total runs 6.5 vs 6.2 and the WordPress webmaster's 6.5 vs 6.2.
You run a publishing or marketing site — the publisher marketing lead's weighted total runs 6.6 vs 6.3.
Read this comparison as one judge. Each weighs the same scores by what they care about.
The Data Protection Officer
External DPO for a dozen mid-sized companies, two of which received a letter from a state supervisory authority about their cookie banner last year. Wants reject on the first layer, nothing loaded before the click, a consent log that shows which banner version each visitor saw, a cookie list that matches the site, and a DPA and subprocessor list that keep visitor data in the EU.
Cookiebot
This judge's pick
CookieYes
Criterion by criterion
Banner & choice architecture
Cookiebot
The banner is documented as a real choice: accept, reject and customize buttons with category toggles on the first and second layer, per-vendor choice through the IAB Ad Settings panel, withdrawal at any time via the cookie declaration, WCAG 2.2 with WAI-ARIA, more than 47 languages with automatic browser-language detection, and per-region opt-in or opt-out rules. The pages equally offer two-button and one-button banner versions, and we found no public information stating that reject carries the same weight as accept as a default. A/B testing and a consent-rate benchmark are named, but we found no public information on limits to what may be tested or on templates mapped to named regulator guidance.
CookieYes
The documentation goes well beyond basics: three layouts with per-layout positions, colour themes, GDPR and US-state consent templates, geo-targeting with an auto-translated banner in 30+ languages, granular consent per vendor and purpose, and a floating button for changing or withdrawing a choice later. What I could not find is a statement that reject sits on the first layer with the same weight as accept, a named WCAG level rather than a bare "WCAG Accessibility Certified" badge, or any consent-rate analytics; the help centre also documents a close button that lets a visitor browse without answering and an option to load cookies before consent, which the vendor itself notes is not a GDPR-compliant practice.
Prior blocking & script control
Cookiebot
Prior blocking is documented in both an automatic and a manual mode: non-necessary cookies are blocked until consent with only consented categories activated afterwards, the scanner's category groups are what the scripts enforce, individual cookies and trackers can be blocked, and manual control runs through a Google Tag Manager template with a named custom-event trigger for consent updates. We found no public information on placeholders for embedded videos and maps, server-side tagging, consent signals passed to forms or CAPTCHAs, or any documented method for the site owner to verify on the live site that nothing loads before the click.
CookieYes
Automatic script blocking is documented in depth: third-party scripts and their cookies stay blocked until consent, only strictly necessary cookies should be present beforehand, embedded YouTube and Vimeo videos get editable placeholder text, and consent state is exposed through JavaScript events and a Google Tag Manager trigger. The help centre gives the site owner browser steps to verify nothing loads early. We found no public information on server-side tagging or on blocking that covers local storage, pixels or fingerprinting rather than cookies.
Scanning & cookie classification
Cookiebot
The scanner is documented in depth: patented deep scanning of first- and third-party cookies and third-party requests, coverage of HTML5 local storage, IndexedDB, pixel tags and ultrasound beacons, dynamic cookies set during interaction, monthly scans with a daily option, and a cookie declaration populated automatically in more than 47 languages. The declaration shown on the vendor's own site carries an unclassified section alongside the classified counts. We found no public information on scanning behind logins or per region, a stated scan depth, or email alerts when trackers change.
CookieYes
Scanning is concrete and tiered: 100 to 8,000 pages per scan depending on the plan, monthly or weekly scheduled rescans, scanning behind logins and from a static IP on the top plan, classification against a database of 100,000+ pre-categorised cookies with descriptions, and a cookie-policy generator. We found no public information on alerts when a new or changed tracker appears, on scanning local storage or pixels, or on a declaration that updates itself automatically from the scan.
Consent records & proof
Cookiebot
Consent choices are recorded and securely stored for future visits and in the event of an audit by data protection authorities, documentation of consents runs up to 12 months with end-user data deleted after 12 months, all consents export as CSV including categories, visitors receive a consent ID and date to cite, consent expiry is configurable, and cross-domain consent sharing is documented. For answering a supervisory authority the gaps matter: we found no public information tying each record to the banner version and texts the visitor actually saw, no withdrawal recorded as its own event, and no export through an API.
CookieYes
Every consent is logged on the server with a consent ID, date and time in UTC, country, a pseudonymised IP with the last segment masked, and overall and category-wise status including cookie names, purposes and durations; a PDF "Proof of Consent" export exists and expiry is configurable at 365 days by default. For my files the gap is decisive: we found no public information tying each record to the banner version and texts the visitor saw, on how long consent logs are kept, on withdrawal recorded as its own event, or on export through an API.
Frameworks, signals & platforms
Cookiebot
Signal coverage is broad: Google Consent Mode v2 including advanced mode with the Google Gold Tier certification, Microsoft UET and Clarity consent modes, Amazon consent signals, Global Privacy Control, and IAB TCF with the captured pages giving different figures, 2.3 and 2.4. Plugins or guides cover a dozen CMS and shop systems including WordPress, Wix and Shopify, alongside a Google Tag Manager template, multi-domain configuration and a partner programme. We found no public information on a registered IAB Europe CMP ID, the Global Privacy Platform, platform-specific iOS or Android SDKs beyond a generic API-and-SDK mention, or a REST API for configuration.
CookieYes
The signal chain is broad for the web: IAB TCF v2.4 with IAB and Google CMP certification, Google Consent Mode v2 enabled by default plus Additional Consent Mode, Microsoft UET consent mode via Tag Manager or a custom script, Global Privacy Control from the Pro plan, WordPress, Shopify and Wix apps, and documented JavaScript events. We found no public information on a registered CMP ID number, the Global Privacy Platform, iOS or Android SDKs, connected TV, or a REST API for configuration; agency use appears only as a partner programme.
European sovereignty
Cookiebot
The contracting entity is proven European: Usercentrics A/S, registered in Denmark with a Copenhagen address, and a data processing agreement is published alongside ISO 27001, ISO 27701 and SOC 2 Type 2, with EU standard contractual clauses or binding internal rules stated for transfers and a data copy available before termination. The chain beyond the entity is undocumented: the captured pages state no hosting location for the banner script and consent logs, name no subprocessors with locations, and list group companies including a US-incorporated Usercentrics Inc. among those data is shared with.
CookieYes
The contracting entity is CookieYes Limited, registered in the United Kingdom; hosting is on AWS with no region stated, and the privacy policy says personal data may be stored and processed in any country where the company has operations. Subprocessors are named — Google, Hotjar, Stripe, Intercom, Zendesk, Sendgrid among them — but without their locations, and a published data processing agreement with EU standard contractual clauses and an EU representative in Ireland are the stated safeguards. We found no public information on EU hosting, where the banner script is served from, or where consent logs and scan results sit.
Pricing transparency
Cookiebot
The billing model is public: prices based on the number of domains and subpages, a free plan limited to one domain and 50 subpages, Premium Lite at 7€ /Monat with its features named, tier boundaries from 50 up to more than 7,000 subpages, automatic upgrades when the scanner finds more subpages, subdomains billed separately, a daily-scan add-on at +99 € /Mon., VAT treatment by customer location, and no minimum term. A buyer still cannot compute the real annual cost from the captured pages: the prices of the tiers above Lite and the per-domain cost are not shown, and agency or reseller terms are not priced.
CookieYes
A buyer can compute most of the annual cost from public pages: $0, $10, $25 and $55 per domain per month with stated page-view limits per tier, overage at $0.30 per 1,000 extra pageviews, scan depth per plan, 2 months free on annual billing, VAT stated as charged in addition, and terms covering advance billing, 30-day termination notice and the trial converting automatically to a paid subscription. Not computable from public pages: the Enterprise tier with its custom contracts and any agency or reseller fee.
Sovereignty, side by side
Dimension
Cookiebot
CookieYes
Legal entity
Not determined
Not determined
Hosting location
Not determined
Not determined
Hosting options
Not determined
Not determined
Open source
Not determined
Not determined
Data processing agreement
Not determined
Not determined
Transfer impact assessment
Not determined
Not determined
Facts, side by side
Only facts both products carry under the same definition — anything else would not be a fair row.
As of 30 Oct 2026, the panel rates both 3/5. Weighted by what each judge cares about, 1 of the 6 judges picks Cookiebot and 4 pick CookieYes, 1 calls it a tie. Which one fits depends on the criteria that matter to you; the table on this page shows both side by side, and each judge’s reading has its own page. Both were scored by the same AI bench under the same rubric, from public evidence only, as the methodology describes.
Is Cookiebot or CookieYes European?
Cookiebot is European (EU-Made). CookieYes is European (UK / wider Europe). Provenance is read from each company’s own legal pages: who builds it and who owns it.
Do Cookiebot and CookieYes have a free plan?
As of 30 Oct 2026, both vendors’ own pages state a free plan. Each product page links the pricing page it was read from.