As of 30 Oct 2026, the panel rates Cookiebot 3/5 and CookieYes 3/5 in Consent Management (CMP). Weighted by what each judge cares about, 1 of the 6 judges picks Cookiebot and 4 pick CookieYes, 1 calls it a tie. Cookiebot scores higher on 5 of 7 criteria (Scanning & cookie classification, Banner & choice architecture, Frameworks, signals & platforms, plus 2 more). CookieYes scores higher on 2 of 7 criteria (Pricing transparency and Prior blocking & script control). Provenance — Cookiebot: EU-Made; CookieYes: UK / wider Europe. Ratings are the AI panel’s opinion, formed from public evidence: how scores are made.
The computed table splits the two along different criteria. Cookiebot leads banner and choice (7.2 vs 6.7, three leans, three ties), scanning and classification (7.0 vs 6.3, four leans to none), standards and platforms (7.0 vs 6.7), consent records (6.2 vs 6.0) and sovereignty (4.0 vs 3.8, five ties). CookieYes leads pricing transparency (7.5 vs 5.7, six leans to none) and prior blocking (6.5 vs 5.5, five leans to none). Weighted totals differ judge by judge: CookieYes ahead for four judges, Cookiebot for the data protection officer (6 vs 5.7), and the skeptic ties at 5.8. The verdicts cite CookieYes's four published tiers at $0, $10, $25 and $55 per month per domain and missing prices for Cookiebot above Premium Lite (7 €/month). Sovereignty attributes list Cookiebot's legal entity as DK with ownership, data residency and subprocessor exposure unknown; CookieYes lists each of its four as unknown.
Choose Cookiebot if
You need scanning that reaches cookies, local storage, IndexedDB, pixel tags and dynamic cookies — four judges lean Cookiebot on scanning and classification (7.0 vs 6.3).
You depend on Google Consent Mode v2 with Google-certified (Golden Badge) status, Microsoft UET, Clarity, Amazon signals and GPC — two judges lean Cookiebot on standards and platforms (7.0 vs 6.7).
You weigh banner and choice heaviest in your decision — three judges lean Cookiebot there (7.2 vs 6.7).
You must contract with an entity in Denmark — Cookiebot's sovereignty attributes list its legal entity jurisdiction as DK.
You sit in the data protection officer role — the weighted total runs Cookiebot 6 vs CookieYes 5.7.
Choose CookieYes if
You need published prices before you buy — six judges lean CookieYes on pricing transparency (7.5 vs 5.7), with tiers at $0, $10, $25 and $55 per month per domain.
You need third-party scripts blocked before consent — five judges lean CookieYes on prior blocking (6.5 vs 5.5).
You need a free starting tier and predictable overage — CookieYes publishes a $0 tier and overage at $0.30 per 1,000 extra pageviews.
Your team builds or maintains client sites — the agency developer's weighted total runs 6.5 vs 6.2 and the WordPress webmaster's 6.5 vs 6.2.
You run a publishing or marketing site — the publisher marketing lead's weighted total runs 6.6 vs 6.3.
Read this comparison as one judge. Each weighs the same scores by what they care about.
The Publisher Marketing Lead
Runs marketing for an ad-funded news site and an online shop in the same group, where every point of consent rate shows up in ad revenue and in Google Ads conversions. Wants a registered IAB TCF CMP, Google Consent Mode v2 in advanced mode, banner tests within what the law allows, consent shared between the site and the app, and a dashboard that shows where visitors drop off.
Cookiebot
CookieYes
This judge's pick
Criterion by criterion
Banner & choice architecture
Cookiebot
Deny, allow-all and customize sit on the banner with category toggles on both layers, visitors can withdraw at any time from the cookie declaration, and I get per-region opt-in versus opt-out rules, 47-plus languages with automatic browser-language detection, WCAG 2.2 accessibility and a vendor-level Ad Settings panel — that is the choice architecture I need for lawful banner work, and A/B testing plus a consent-rate benchmark are named. We found no public information on reject being stated to carry the same weight as accept by default, or on the limits of what may be tested.
CookieYes
The customisation and geo story is genuinely deep: three layouts with colour, content, behaviour, branding and CSS control, 30+ languages with auto-translation, per-country GDPR and US-state banner rules, a floating revisit button, configurable consent expiry and per-vendor TCF choices, plus a claimed WCAG accessibility certification. What I cannot find is anything on consent-rate analytics or A/B testing — where my ad revenue lives — and there is a documented close button that lets a visitor dismiss the banner without choosing.
Prior blocking & script control
Cookiebot
Non-necessary cookies are blocked automatically until consent, the scanner maps trackers so scripts fire only for consented functional groups, and there is a Google Tag Manager template with a consent-update trigger event — solid baseline control for a news site, already included on the free tier. We found no public information on placeholders for embedded videos, maps and social embeds, on server-side tagging, on consent passed to forms and plugins, or on instructions to verify in the browser that nothing loads before consent.
CookieYes
Automatic blocking of third-party scripts before consent, with strictly necessary cookies exempt, editable placeholder text over blocked YouTube and Vimeo embeds, a Google Tag Manager template with a custom consent-update trigger, and a documented Chrome DevTools check that nothing fires early. We found no public information on server-side tagging, consent passed to forms or CAPTCHAs, or an automated monitor that reports scripts set before consent on the live site.
Scanning & cookie classification
Cookiebot
Scanning is described in real depth: patented deep scanning of first- and third-party cookies and third-party requests, local storage, IndexedDB, pixel tags and even dynamic cookies set during interaction, monthly rescans with a daily paid option, automatic categorisation, and a cookie declaration in 47-plus languages generated from the scan with per-cookie providers and lifetimes. We found no public information on email alerts when new or changed trackers appear, on scan depth or page counts, or on a change history of the live site.
CookieYes
Scans are scheduled monthly (weekly on the top tier) with stated depth — 100 pages per scan on free up to 8,000 on Ultimate — plus scan-behind-login and static-IP scanning options, all classified against a database of 100,000+ pre-categorised cookies, with cookie and privacy policy generators to publish the result. We found no public information on local storage and pixel detection, alerts on new or changed trackers, or a declaration that updates itself automatically in several languages.
Consent records & proof
Cookiebot
Consent logs with retention up to 12 months, CSV export including categories, a consent ID the visitor can quote when complaining, configurable consent expiry up to 12 months and cross-domain consent sharing are all documented — enough for the basic proof an auditor asks of my shop. We found no public information on each record being tied to the banner version and texts shown, on withdrawal recorded as its own event, on re-consent when the configuration changes, or on API access to the log.
CookieYes
The log records consent ID, date and UTC time, country, a pseudonymous IP with the last segment masked, and per-category status with cookie names, purposes and durations; there is a PDF proof-of-consent export, the consent ID is also readable in the visitor's own cookie, expiry is configurable (365 days by default) and subdomain consent sharing starts on Pro. We found no public information on records tied to the banner version shown, withdrawal recorded as its own event, or exporting the log through an API.
Frameworks, signals & platforms
Cookiebot
Google lists it as a certified CMP with the Golden Badge, Consent Mode v2 activates automatically with advanced mode, conversion modeling and the new ad user data and ad personalization signals — the part that protects my Google Ads conversions — alongside Microsoft UET, Microsoft Clarity and Amazon consent signals and Global Privacy Control. The captured pages give different figures for the TCF version, citing both 2.3 and 2.4; we found no public information on a registered IAB CMP ID number, iOS or Android SDKs, GPP, or a documented REST API.
CookieYes
This hits my must-haves on paper: a Google-certified CMP with Consent Mode v2 on all plans, IAB TCF v2.4 with an IAB-approved banner showing the Global Vendor List and Google's ATP list (though TCF sits on Pro and Ultimate only), Google Additional Consent Mode, a genuinely detailed Microsoft UET consent mode section with ad storage behaviour, GPC from Pro, and WordPress, Shopify and Wix apps. We found no public information on a registered CMP ID number, the split between basic and advanced Consent Mode, GPP, iOS or Android SDKs, or a REST API — so the one-consent-across-site-and-app story I need is undocumented.
European sovereignty
Cookiebot
The contracting entity is Usercentrics A/S in Copenhagen with a published registration number, a data processing agreement, ISO 27001, ISO 27701 and SOC 2 Type 2 stated, EU standard contractual clauses for third-country transfers, and a data copy available before cancellation — a good start on the chain. We found no public information on where the banner script, consent logs and scan results are hosted or on the subprocessors involved; the privacy policy names group companies, including a US-incorporated one, that data is shared with.
CookieYes
The contracting entity is UK-registered CookieYes Limited in Milton Keynes, with an EU representative in Ireland and a published DPA relying on SCCs, but the picture stops there: subprocessors are named (Stripe, Intercom, Zendesk, Sendgrid among others) without locations, hosting is AWS with no region stated, and the privacy policy says personal data may be stored and processed in any country where the company has operations. For a script that loads on every page and sees every one of my visitors, this chain cannot be shown to be European from what is published.
Pricing transparency
Cookiebot
The free tier's limits are public — one domain, 50 subpages, with scanning and blocking included — Premium Lite is 7 €/Monat, scaling runs on domains and subpages with automatic upgrades when the scanner finds more pages, the daily-scan add-on is +99 €/Mon., and VAT treatment, the no-contract terms and the 14-day trial without credit card are all stated. We found no public information on the prices of the tiers above Lite or on the cost of additional domains beyond the package minimum, so I cannot compute a full annual cost for my two properties from these pages.
CookieYes
Prices are fully public — free, Basic at $10 /month /domain, Pro at $25 /month /domain, Ultimate at $55 /month /domain, each with pageview limits (5,000 on free up to unlimited) and overage at $0.30 per 1,000 extra pageviews, two months free on annual billing, VAT treatment stated, and feature gating documented tier by tier including TCF from Pro. Enterprise sits on custom contracts and the agency partner programme publishes no fee terms, so a full annual cost for an agency setup or a large multi-domain estate cannot be computed from public pages alone.
Sovereignty, side by side
Dimension
Cookiebot
CookieYes
Legal entity
Not determined
Not determined
Hosting location
Not determined
Not determined
Hosting options
Not determined
Not determined
Open source
Not determined
Not determined
Data processing agreement
Not determined
Not determined
Transfer impact assessment
Not determined
Not determined
Facts, side by side
Only facts both products carry under the same definition — anything else would not be a fair row.
As of 30 Oct 2026, the panel rates both 3/5. Weighted by what each judge cares about, 1 of the 6 judges picks Cookiebot and 4 pick CookieYes, 1 calls it a tie. Which one fits depends on the criteria that matter to you; the table on this page shows both side by side, and each judge’s reading has its own page. Both were scored by the same AI bench under the same rubric, from public evidence only, as the methodology describes.
Is Cookiebot or CookieYes European?
Cookiebot is European (EU-Made). CookieYes is European (UK / wider Europe). Provenance is read from each company’s own legal pages: who builds it and who owns it.
Do Cookiebot and CookieYes have a free plan?
As of 30 Oct 2026, both vendors’ own pages state a free plan. Each product page links the pricing page it was read from.