As of 30 Oct 2026, the panel rates Cookiebot 3/5 and CookieYes 3/5 in Consent Management (CMP). Weighted by what each judge cares about, 1 of the 6 judges picks Cookiebot and 4 pick CookieYes, 1 calls it a tie. Cookiebot scores higher on 5 of 7 criteria (Scanning & cookie classification, Banner & choice architecture, Frameworks, signals & platforms, plus 2 more). CookieYes scores higher on 2 of 7 criteria (Pricing transparency and Prior blocking & script control). Provenance — Cookiebot: EU-Made; CookieYes: UK / wider Europe. Ratings are the AI panel’s opinion, formed from public evidence: how scores are made.
The computed table splits the two along different criteria. Cookiebot leads banner and choice (7.2 vs 6.7, three leans, three ties), scanning and classification (7.0 vs 6.3, four leans to none), standards and platforms (7.0 vs 6.7), consent records (6.2 vs 6.0) and sovereignty (4.0 vs 3.8, five ties). CookieYes leads pricing transparency (7.5 vs 5.7, six leans to none) and prior blocking (6.5 vs 5.5, five leans to none). Weighted totals differ judge by judge: CookieYes ahead for four judges, Cookiebot for the data protection officer (6 vs 5.7), and the skeptic ties at 5.8. The verdicts cite CookieYes's four published tiers at $0, $10, $25 and $55 per month per domain and missing prices for Cookiebot above Premium Lite (7 €/month). Sovereignty attributes list Cookiebot's legal entity as DK with ownership, data residency and subprocessor exposure unknown; CookieYes lists each of its four as unknown.
Choose Cookiebot if
You need scanning that reaches cookies, local storage, IndexedDB, pixel tags and dynamic cookies — four judges lean Cookiebot on scanning and classification (7.0 vs 6.3).
You depend on Google Consent Mode v2 with Google-certified (Golden Badge) status, Microsoft UET, Clarity, Amazon signals and GPC — two judges lean Cookiebot on standards and platforms (7.0 vs 6.7).
You weigh banner and choice heaviest in your decision — three judges lean Cookiebot there (7.2 vs 6.7).
You must contract with an entity in Denmark — Cookiebot's sovereignty attributes list its legal entity jurisdiction as DK.
You sit in the data protection officer role — the weighted total runs Cookiebot 6 vs CookieYes 5.7.
Choose CookieYes if
You need published prices before you buy — six judges lean CookieYes on pricing transparency (7.5 vs 5.7), with tiers at $0, $10, $25 and $55 per month per domain.
You need third-party scripts blocked before consent — five judges lean CookieYes on prior blocking (6.5 vs 5.5).
You need a free starting tier and predictable overage — CookieYes publishes a $0 tier and overage at $0.30 per 1,000 extra pageviews.
Your team builds or maintains client sites — the agency developer's weighted total runs 6.5 vs 6.2 and the WordPress webmaster's 6.5 vs 6.2.
You run a publishing or marketing site — the publisher marketing lead's weighted total runs 6.6 vs 6.3.
Read this comparison as one judge. Each weighs the same scores by what they care about.
The Skeptic
Has opened the browser's network tab on sites with a "certified" banner and watched the ad pixels fire before anything was clicked. Reads "consent rate optimisation" as a hint that reject will be grey and small, "auto-blocking" as a claim until the test steps are published, and "EU hosting" next to a US script CDN — and asks what leaving would cost: the consent logs, and every visitor asked again.
Cookiebot
CookieYes
This judge calls it a tie.
Criterion by criterion
Banner & choice architecture
Cookiebot
Deny, customize and allow-all are documented as banner choices, with per-category toggles on the first and second layers, withdrawal at any time via the cookie declaration, per-region opt-in and opt-out rules, 47+ languages with browser-language detection, and WCAG 2.2 / WAI-ARIA accessibility named. But no captured page states that reject and accept carry equal weight as a default — a one-button banner version is documented — and we found no public information on limits to what may be A/B tested.
CookieYes
The choice architecture is documented in real depth: three layouts, colour themes and custom CSS, 30+ languages with auto-translation, GDPR versus US-state templates with geo-targeting by country, category and vendor-level choice, and both a floating button and a call-back widget for withdrawal. I hold it below the top band because we found no public information on consent-rate analytics or A/B testing, no statement that reject carries the same weight as accept, a close button that lets a visitor dismiss the banner without choosing, and a documented option to load each category's cookies before consent that sits next to the vendor's own line that loading cookies prior to consent is not GDPR-compliant.
Prior blocking & script control
Cookiebot
Automatic blocking before consent is stated plainly — non-necessary cookies blocked until consent, then only consented categories activated — with individual per-cookie blocking, blocking into functional groups, and a Google Tag Manager template plus a documented consent event for custom triggers. We found no public information on placeholders for embedded videos or maps, server-side tagging, consent passed to forms or CAPTCHAs, or a documented way to test that nothing loads early — and 'automatic' stays a claim until those test steps are published.
CookieYes
Automatic blocking of third-party scripts and cookies before consent is claimed and the method is written up in the help pages, with editable placeholder text over blocked video embeds, a Google Tag Manager template, JavaScript events for consent updates, and published browser steps to check that only strictly necessary cookies exist before acceptance. It stops short of the deeper band: we found no public information on a manual blocking mode and its limits, server-side tagging, consent passed to forms or CAPTCHAs, or an automated monitor that reports early loads on the live site.
Scanning & cookie classification
Cookiebot
The scanner is documented in real depth: deep scanning of first- and third-party cookies and third-party requests, local storage, IndexedDB, pixel tags and beacons, dynamic cookies set during interaction, monthly rescans with a daily option priced at +99 €/month, automatic categorisation, and a cookie declaration published on the site in 47+ languages — their own declaration even shows an 'Unclassified (13)' bucket instead of hiding unknowns. We found no public information on stated scan depth or page count, scanning behind logins, or email alerts on new or changed trackers.
CookieYes
The scanner is scheduled monthly (weekly on the top tier) with a stated page count per plan (100 to 8,000 pages per scan), a database of 100,000+ pre-categorized cookies with descriptions, an instant free report without email, scan-behind-login on the top plan, and scan results feeding the banner and cookie policy. What keeps it from the top: we found no public information on alerts when new or changed trackers appear, scanning of local storage and pixels rather than cookies, or a declaration that updates itself in several languages.
Consent records & proof
Cookiebot
Consents are recorded and stored with an audit purpose stated, retention documented (up to 12 months), CSV export of all consents including categories, configurable consent expiry, a consent ID that visitors are asked to cite, and cross-domain consent sharing. We found no public information on records carrying the banner version and texts shown, withdrawal logged as its own event, or API access to search the log — exactly the things I would want in hand the day a supervisory authority writes.
CookieYes
Every consent is logged on the vendor's servers with a consent ID, consented domain, date and time in UTC, country, a pseudonymous IP with the last segment masked, overall and category-wise status, and a Proof of Consent exportable as PDF; expiry is configurable with a 365-day default, and customer data is returnable in machine-readable form free of charge within 30 days of termination. I still ask the audit questions: we found no public information tying each record to the banner version and texts shown, no stated retention period for the consent log itself, and no documented API search or open-format export of the log.
Frameworks, signals & platforms
Cookiebot
Signals are strong: Google Consent Mode v2 in basic and advanced mode with Google-certified (Golden Badge) CMP status, Microsoft UET and Clarity consent modes, Amazon consent signals, GPC, IAB TCF, and guides for a dozen named CMS systems plus WordPress, Wix, Shopify and Umbraco apps. But no registered IAB Europe CMP ID appears on any captured page, the captured pages give different figures for the TCF version (2.3 and 2.4), TCF is an optional integration paid from the entry paid tier, and we found no public information on documented iOS or Android SDKs or a REST configuration API.
CookieYes
The signal chain is broad and documented: Google-certified CMP status with Consent Mode v2 enabled by default and Additional Consent Mode, IAB TCF v2.4 with vendor-list configuration options, Microsoft UET consent mode written up down to what a denied ad storage does, Global Privacy Control from the Pro plan, WordPress, Shopify and Wix plugins, GTM triggers and JavaScript events. We found no public information on iOS or Android SDKs, connected TV, the Global Privacy Platform, a REST API, or the difference between basic and advanced Consent Mode behaviour.
European sovereignty
Cookiebot
The contracting entity is documented and European (Usercentrics A/S, Denmark, reg. no. 34624607), a data processing agreement is published, ISO 27001, ISO 27701 and SOC 2 Type 2 are stated, and EU standard contractual clauses are named as safeguards — while data is shared within a group that includes a US entity, Usercentrics Inc. We found no public information on where the banner script is served from or consent logs are stored, and no subprocessor list with locations; for a script running on every page of the customer's site, that is the part I want named before signing.
CookieYes
The contracting entity is UK-registered with an Irish EU representative and supervisory authorities named for the EU, UK and Switzerland; a DPA is published, subprocessors are named (Google, Hotjar, Stripe, Sendgrid, SendinBlue, Getresponse, Intercom, Zendesk) with SCC-based transfer safeguards, and hosting runs on AWS with ISO 27001 and SOC 2 attested data centres. I still do not know where my consent logs sit: the hosting region is unstated, the privacy policy says personal data may be stored in any country where the company has operations, and we found no public information on where the banner script is served from or who owns the vendor.
Pricing transparency
Cookiebot
The free tier's limits are public (one domain, 50 subpages, one language), Premium Lite is 7 €/month, the scaling basis is explained (domains plus subpages, tiers by subpage count, automatic upgrade when the scan finds more subpages, subdomains billed separately), VAT treatment is stated, there is no minimum term, and the daily-scan add-on is priced at +99 €/month. But we found no public prices for the tiers above Lite, none for the Audience Survey or consent-rate benchmark add-ons or the enterprise tier, and no agency or reseller terms — so a buyer above 50 subpages cannot compute their annual cost from these pages alone.
CookieYes
A buyer can compute most of the bill: $0, $10, $25 and $55 per month per domain with pageview limits (5,000 / 100,000 / 300,000 / unlimited), a published overage of $0.30 per 1,000 extra pageviews, scan page counts per tier, two months free on annual billing, VAT stated as charged in addition, and the terms defining each fully qualified domain as a separate licence. The gaps: Enterprise is custom contracts, the minimum term length is not published, the 14-day trial auto-converts to a paid subscription with no refunds on early termination, and agency or reseller fees are not priced.
Sovereignty, side by side
Dimension
Cookiebot
CookieYes
Legal entity
Not determined
Not determined
Hosting location
Not determined
Not determined
Hosting options
Not determined
Not determined
Open source
Not determined
Not determined
Data processing agreement
Not determined
Not determined
Transfer impact assessment
Not determined
Not determined
Facts, side by side
Only facts both products carry under the same definition — anything else would not be a fair row.
As of 30 Oct 2026, the panel rates both 3/5. Weighted by what each judge cares about, 1 of the 6 judges picks Cookiebot and 4 pick CookieYes, 1 calls it a tie. Which one fits depends on the criteria that matter to you; the table on this page shows both side by side, and each judge’s reading has its own page. Both were scored by the same AI bench under the same rubric, from public evidence only, as the methodology describes.
Is Cookiebot or CookieYes European?
Cookiebot is European (EU-Made). CookieYes is European (UK / wider Europe). Provenance is read from each company’s own legal pages: who builds it and who owns it.
Do Cookiebot and CookieYes have a free plan?
As of 30 Oct 2026, both vendors’ own pages state a free plan. Each product page links the pricing page it was read from.