As of 30 Oct 2026, the panel rates Cookiebot 3/5 and CookieYes 3/5 in Consent Management (CMP). Weighted by what each judge cares about, 1 of the 6 judges picks Cookiebot and 4 pick CookieYes, 1 calls it a tie. Cookiebot scores higher on 5 of 7 criteria (Scanning & cookie classification, Banner & choice architecture, Frameworks, signals & platforms, plus 2 more). CookieYes scores higher on 2 of 7 criteria (Pricing transparency and Prior blocking & script control). Provenance — Cookiebot: EU-Made; CookieYes: UK / wider Europe. Ratings are the AI panel’s opinion, formed from public evidence: how scores are made.
The computed table splits the two along different criteria. Cookiebot leads banner and choice (7.2 vs 6.7, three leans, three ties), scanning and classification (7.0 vs 6.3, four leans to none), standards and platforms (7.0 vs 6.7), consent records (6.2 vs 6.0) and sovereignty (4.0 vs 3.8, five ties). CookieYes leads pricing transparency (7.5 vs 5.7, six leans to none) and prior blocking (6.5 vs 5.5, five leans to none). Weighted totals differ judge by judge: CookieYes ahead for four judges, Cookiebot for the data protection officer (6 vs 5.7), and the skeptic ties at 5.8. The verdicts cite CookieYes's four published tiers at $0, $10, $25 and $55 per month per domain and missing prices for Cookiebot above Premium Lite (7 €/month). Sovereignty attributes list Cookiebot's legal entity as DK with ownership, data residency and subprocessor exposure unknown; CookieYes lists each of its four as unknown.
Choose Cookiebot if
You need scanning that reaches cookies, local storage, IndexedDB, pixel tags and dynamic cookies — four judges lean Cookiebot on scanning and classification (7.0 vs 6.3).
You depend on Google Consent Mode v2 with Google-certified (Golden Badge) status, Microsoft UET, Clarity, Amazon signals and GPC — two judges lean Cookiebot on standards and platforms (7.0 vs 6.7).
You weigh banner and choice heaviest in your decision — three judges lean Cookiebot there (7.2 vs 6.7).
You must contract with an entity in Denmark — Cookiebot's sovereignty attributes list its legal entity jurisdiction as DK.
You sit in the data protection officer role — the weighted total runs Cookiebot 6 vs CookieYes 5.7.
Choose CookieYes if
You need published prices before you buy — six judges lean CookieYes on pricing transparency (7.5 vs 5.7), with tiers at $0, $10, $25 and $55 per month per domain.
You need third-party scripts blocked before consent — five judges lean CookieYes on prior blocking (6.5 vs 5.5).
You need a free starting tier and predictable overage — CookieYes publishes a $0 tier and overage at $0.30 per 1,000 extra pageviews.
Your team builds or maintains client sites — the agency developer's weighted total runs 6.5 vs 6.2 and the WordPress webmaster's 6.5 vs 6.2.
You run a publishing or marketing site — the publisher marketing lead's weighted total runs 6.6 vs 6.3.
Read this comparison as one judge. Each weighs the same scores by what they care about.
The In-House Lawyer
In-house counsel at a retailer with shops in Germany, France and Austria, who has read the court decisions on missing reject buttons and the regulators' banner guidance. Wants § 25 TDDDG and the GDPR mapped to concrete settings, equal-weight choices as the default, consent that can be withdrawn as easily as it was given, and records that would hold up if a competitor or a consumer group sued.
Cookiebot
CookieYes
This judge's pick
Criterion by criterion
Banner & choice architecture
Cookiebot
Accept, decline and manage-preferences options are documented across three-button, two-button and one-button banner versions, with category toggles on the first and second layers, IAB purposes and vendors selectable by the end user, withdrawal at any time via the cookie declaration, geolocation-based regional banners, browser-language detection with more than 47 languages, and accessibility named at WCAG 2.2 with WAI-ARIA. What I would need before a court or the DSK is missing from the captures: we found no public information on a stated equal-weight default for reject versus accept, or on the limits of what the A/B testing and consent-rate analytics may vary.
CookieYes
The choice is documented in real depth: granular consent per vendor and purpose, geo-targeting so only selected regions see the banner, thirty-plus languages, customisation down to CSS, a floating button so visitors can change or withdraw consent later, and a WCAG certification claim on every plan. We found no public statement that reject and accept carry equal weight as a default, and no consent-rate analytics; the documentation also describes an optional close button that lets visitors browse without any choice, and settings to load categories before consent or hide them alongside the vendor's own warning that those practices are not GDPR-compliant.
Prior blocking & script control
Cookiebot
Automatic blocking of non-necessary cookies until consent, with only the consented categories activated afterwards, individual blocking of single cookies and trackers, scripts blocking trackers into functional groups, and a Google Tag Manager template driven by a consent-update trigger event are all documented. We found no public information on placeholders for embedded videos and maps, server-side tagging, consent hand-off to forms and CAPTCHAs, or a documented self-check that nothing loads before consent.
CookieYes
Automatic blocking of third-party scripts and cookies until consent, with only strictly necessary cookies beforehand, placeholder text over embedded videos, a Google Tag Manager template, a consent-update trigger event, and a documented Chrome DevTools procedure to verify nothing loads early. We found no public information on a manual blocking mode, server-side tagging, or an automated monitor that reports pre-consent trackers on the live site. The documented verification is a manual self-test, which is workable but not systematic proof.
Scanning & cookie classification
Cookiebot
A patented deep scanner detecting first- and third-party cookies, third-party requests, HTML5 local storage, IndexedDB, pixel tags and dynamic cookies, monthly automatic scans with a priced daily option, automatic classification into named purposes together with providers, and a cookie declaration generated from the scan and published on the site in over 47 languages. We found no public information on email alerts when trackers change, on a stated scan depth, or on scanning behind logins or from different regions.
CookieYes
A scanner runs against a database of 100,000+ pre-categorised cookies, with scheduled monthly or weekly rescans, stated page depths per tier (600, 4,000 and 8,000 pages), behind-login and static-IP scanning on the top tier, and policy generators plus scan results flowing into the banner. We found no public information on alerts when new or changed trackers appear, scanning of local storage or pixels, or exportable scan reports. For my shops I would still re-check the declaration manually after every release.
Consent records & proof
Cookiebot
Consent documentation is kept up to twelve months, exportable as a CSV including the categories chosen, with a consent ID the visitor can cite when making contact, configurable expiry from one to twelve months, cross-domain consent sharing, and storage described as being available for an audit by data protection authorities. For a dispute I would still want more: we found no public information on each record being tied to the exact banner version and texts shown, on withdrawal being recorded as its own event, or on tamper-evidence of the log, though a data copy can be requested before cancellation.
CookieYes
Each consent is logged with a consent ID, UTC timestamp, country, pseudonymous IP address and category-level choices, exportable as a proof-of-consent PDF, with expiry configurable at a 365-day default and retention stated as the duration of the agreement in the data processing agreement. We found no public information tying each record to the banner version and texts the visitor actually saw, no withdrawal recorded as its own event, and no API-based export of the log. If a competitor or a consumer group sued, I could not reconstruct from this documentation exactly what the visitor was shown.
Frameworks, signals & platforms
Cookiebot
Google Consent Mode v2 with Google-certified CMP status and automatic activation, an optional IAB TCF integration (the captured pages give different figures for the version, naming 2.3 and 2.4), Microsoft UET and Clarity consent modes, Amazon consent signals, Global Privacy Control, plugins for WordPress, Wix and Shopify plus CMS guides for twelve further systems, multi-domain and cross-device consent, and a reseller programme are all documented. We found no public information on a registered IAB Europe CMP ID, on the Global Privacy Platform, or on named iOS and Android SDKs.
CookieYes
The IAB TCF v2.4 certification and Google Consent Mode v2 certification are documented, Microsoft UET consent mode is explained down to the granted and denied behaviour of ad storage, Global Privacy Control arrives from the Pro plan, and WordPress, Shopify and Wix plugins plus a GTM trigger and JavaScript events cover the web estate. We found no public information on iOS or Android SDKs, GPP, or a REST configuration API, and TCF support sits behind the paid tiers. The UET documentation notes that with no default set, granted applies — a default I would override for European traffic.
European sovereignty
Cookiebot
The legal notice and privacy policy name Usercentrics A/S, registered in Denmark with a company registration number and a Copenhagen address, publish a data processing agreement in the footer, and state EU standard contractual clauses plus binding internal rules for transfers to third countries, alongside ISO 27001, ISO 27701 and SOC 2 Type 2 certifications. The load-bearing links of the chain are unproven for a tool that sees every visitor: we found no public information on where the banner script and the consent logs are hosted, or on the subprocessors and their locations.
CookieYes
The contracting entity is CookieYes Limited, registered in the UK, the data processing agreement cites AWS hosting without a region, and the privacy policy itself says personal data may be stored and processed in any country where the company has operations. Several US providers are named in the privacy policy, but the service's own sub-processor list is available only on request; the Irish-law standard contractual clauses and the Irish EU representative are the only European anchors, with a published DPA. For shops in Germany, France and Austria I would not sign before seeing the hosting region and the full sub-processor list.
Pricing transparency
Cookiebot
The free plan's limits are public — one domain, up to fifty subpages — Premium Lite is priced at 7 € per month, the billing basis in domains and subpages with automatic upgrade when the scanner finds more subpages is explained, VAT treatment and the no-contract, anytime-cancellation terms are stated, and the daily scan add-on costs +99 € per month. We found no public information on the prices of the Small, Medium, Large and Extra Large tiers, on per-domain pricing, or on the optional TCF integration, so the real annual cost above Lite cannot be computed.
CookieYes
Every tier is public with its per-domain monthly price, its pageview allowance, overage at $0.30 per 1,000 extra pageviews, scan limits, VAT charged in addition, an annual discount of two months free, 30-day termination notice, and free machine-readable export of customer data within 30 days of termination. Agency partner types are listed but unpriced, and we found no public information on setup fees. A buyer can compute the real annual cost for a given number of domains and traffic from the public pages alone.
Sovereignty, side by side
Dimension
Cookiebot
CookieYes
Legal entity
Not determined
Not determined
Hosting location
Not determined
Not determined
Hosting options
Not determined
Not determined
Open source
Not determined
Not determined
Data processing agreement
Not determined
Not determined
Transfer impact assessment
Not determined
Not determined
Facts, side by side
Only facts both products carry under the same definition — anything else would not be a fair row.
As of 30 Oct 2026, the panel rates both 3/5. Weighted by what each judge cares about, 1 of the 6 judges picks Cookiebot and 4 pick CookieYes, 1 calls it a tie. Which one fits depends on the criteria that matter to you; the table on this page shows both side by side, and each judge’s reading has its own page. Both were scored by the same AI bench under the same rubric, from public evidence only, as the methodology describes.
Is Cookiebot or CookieYes European?
Cookiebot is European (EU-Made). CookieYes is European (UK / wider Europe). Provenance is read from each company’s own legal pages: who builds it and who owns it.
Do Cookiebot and CookieYes have a free plan?
As of 30 Oct 2026, both vendors’ own pages state a free plan. Each product page links the pricing page it was read from.