As of 30 Oct 2026, the panel rates Cookiebot 3/5 and CookieYes 3/5 in Consent Management (CMP). Weighted by what each judge cares about, 1 of the 6 judges picks Cookiebot and 4 pick CookieYes, 1 calls it a tie. Cookiebot scores higher on 5 of 7 criteria (Scanning & cookie classification, Banner & choice architecture, Frameworks, signals & platforms, plus 2 more). CookieYes scores higher on 2 of 7 criteria (Pricing transparency and Prior blocking & script control). Provenance — Cookiebot: EU-Made; CookieYes: UK / wider Europe. Ratings are the AI panel’s opinion, formed from public evidence: how scores are made.
The computed table splits the two along different criteria. Cookiebot leads banner and choice (7.2 vs 6.7, three leans, three ties), scanning and classification (7.0 vs 6.3, four leans to none), standards and platforms (7.0 vs 6.7), consent records (6.2 vs 6.0) and sovereignty (4.0 vs 3.8, five ties). CookieYes leads pricing transparency (7.5 vs 5.7, six leans to none) and prior blocking (6.5 vs 5.5, five leans to none). Weighted totals differ judge by judge: CookieYes ahead for four judges, Cookiebot for the data protection officer (6 vs 5.7), and the skeptic ties at 5.8. The verdicts cite CookieYes's four published tiers at $0, $10, $25 and $55 per month per domain and missing prices for Cookiebot above Premium Lite (7 €/month). Sovereignty attributes list Cookiebot's legal entity as DK with ownership, data residency and subprocessor exposure unknown; CookieYes lists each of its four as unknown.
Choose Cookiebot if
You need scanning that reaches cookies, local storage, IndexedDB, pixel tags and dynamic cookies — four judges lean Cookiebot on scanning and classification (7.0 vs 6.3).
You depend on Google Consent Mode v2 with Google-certified (Golden Badge) status, Microsoft UET, Clarity, Amazon signals and GPC — two judges lean Cookiebot on standards and platforms (7.0 vs 6.7).
You weigh banner and choice heaviest in your decision — three judges lean Cookiebot there (7.2 vs 6.7).
You must contract with an entity in Denmark — Cookiebot's sovereignty attributes list its legal entity jurisdiction as DK.
You sit in the data protection officer role — the weighted total runs Cookiebot 6 vs CookieYes 5.7.
Choose CookieYes if
You need published prices before you buy — six judges lean CookieYes on pricing transparency (7.5 vs 5.7), with tiers at $0, $10, $25 and $55 per month per domain.
You need third-party scripts blocked before consent — five judges lean CookieYes on prior blocking (6.5 vs 5.5).
You need a free starting tier and predictable overage — CookieYes publishes a $0 tier and overage at $0.30 per 1,000 extra pageviews.
Your team builds or maintains client sites — the agency developer's weighted total runs 6.5 vs 6.2 and the WordPress webmaster's 6.5 vs 6.2.
You run a publishing or marketing site — the publisher marketing lead's weighted total runs 6.6 vs 6.3.
Read this comparison as one judge. Each weighs the same scores by what they care about.
The WordPress Webmaster
Looks after the WordPress site of a mid-sized engineering company on top of the actual job, with Google Analytics, a YouTube channel, a Maps embed and a contact form with reCAPTCHA. Wants a plugin that finds these by itself, blocks them until the visitor agrees, survives the next plugin update and caching, and costs a known amount per site per year without a call to sales.
Cookiebot
CookieYes
This judge's pick
Criterion by criterion
Banner & choice architecture
Cookiebot
The banner comes in three-button, two-button and one-button versions with per-category toggles on both layers, visitors can change or withdraw at any time from the cookie declaration, and it is stated WCAG 2.2 and WAI-ARIA accessible, in more than 47 languages with automatic browser-language detection. Geolocation rules show a different banner per region and regulation, an IAB panel lets visitors pick purposes and vendors before consenting, and consent-rate statistics, a consent-rate benchmark and A/B testing are documented. What I could not find is a statement that reject sits equal to accept by default, or the limits on what may be A/B tested.
CookieYes
The customization documentation shows real depth — three layouts, colour themes, custom CSS, categories on the first layer and a floating button so visitors can change or withdraw consent later — plus 30+ languages with auto-translation, geo-targeting by region with GDPR and US-state consent templates, granular vendor-level consent in the TCF banner, and WCAG accessibility certification listed on the pricing page. We found no public information on consent-rate analytics or A/B testing, and nothing stating that reject carries the same weight as accept on the first layer.
Prior blocking & script control
Cookiebot
Automatic blocking of non-necessary cookies until consent, activating only the categories the visitor allowed, is documented, together with a Google Tag Manager template, a Standard Tag and a documented custom event for triggers, and the two-script setup is explained on the vendor's own pages. For my YouTube embeds and Maps block I found no public information on content-blocker placeholders, and nothing on passing consent to forms or reCAPTCHA, server-side tagging, or a documented way to verify in the browser that nothing fires before consent.
CookieYes
Automatic blocking of third-party scripts before consent is documented in the help centre, with editable placeholder text over blocked YouTube and Vimeo embeds, a Google Tag Manager template, consent-update events for tag managers and scripts, and Chrome DevTools steps to check that nothing loads before consent — exactly what I need for my Analytics and Maps embeds. We found no public information on a manual blocking mode with its limits, server-side tagging, or consent being passed to forms and CAPTCHAs, which matters with my reCAPTCHA contact form.
Scanning & cookie classification
Cookiebot
The scanner uses patented deep scanning to find first- and third-party cookies, local storage, pixel tags and even dynamic cookies set during interaction, classifies them automatically with providers and lifetimes shown in the declaration that lives on the site, and monthly rescans are standard with daily scans available. I found no public information on alerts when new or changed trackers appear, on scanning behind logins, or on a stated scan depth, so keeping the list true between scans is on me.
CookieYes
The scanner delivers an instant report without sign-up, scheduled monthly scanning (weekly on the top tier) with stated scan depths per plan from 100 up to 8,000 pages, scan-behind-login and static-IP scanning on the top tier, and classification against a database of 100,000+ pre-categorized cookies with descriptions, feeding a cookie policy generator and the banner. We found no public information on scanning local storage or pixels, email alerts when new or changed trackers appear, or the declaration updating automatically in several languages.
Consent records & proof
Cookiebot
Consent logs with a consent ID and date, retention up to 12 months, configurable consent expiry (one month free, up to twelve paid), CSV export of all consents including categories, and cross-domain consent sharing are all documented, and the consent is stored for audits by data protection authorities. I found no public information on records tied to the banner version and texts shown, withdrawal recorded as its own event, or searching the log through an API.
CookieYes
The consent log records consent ID, date and time, country, overall and category-wise status and a pseudonymous IP, viewable in the dashboard, with a Proof of Consent PDF export and the visitor's consent ID findable in their browser cookie; consent expiry is configurable (365 days by default) and the data processing agreement retains data for the duration of the agreement. We found no public information on records being tied to the banner version shown, withdrawal recorded as its own event, or search and export of the log through an API.
Frameworks, signals & platforms
Cookiebot
Google Consent Mode v2 with Gold Tier certification, IAB TCF 2.4 as an optional add-on, Microsoft UET and Clarity consent modes, Amazon consent signals and GPC are all documented, alongside a WordPress plugin, Wix and Shopify apps, an Umbraco app, guides for a dozen CMSs, multi-domain configuration and a partner/reseller programme. I found no public information on a registered IAB CMP ID number, GPP, documented iOS and Android SDKs, or a REST API, so app and connected-TV coverage stays open.
CookieYes
CookieYes is documented as a Google-certified CMP with Consent Mode v2 enabled by default on all plans, Google Additional Consent Mode, IAB TCF v2.4 with the Global Vendor List and Google's ad tech provider list, and Microsoft UET consent mode via Tag Manager or custom script; there are WordPress, Shopify and Wix apps plus any-CMS installation, Global Privacy Control from Pro, and an agency partner programme. We found no public information on the registered CMP ID number, GPP support, iOS or Android SDKs, or a REST API for configuration — and IAB TCF sits only on the Pro and Ultimate plans.
European sovereignty
Cookiebot
The contracting entity is Usercentrics A/S, registered in Denmark with a Copenhagen address, a data processing agreement is published, and ISO 27001, ISO 27701 and SOC 2 Type 2 are stated, with EU standard contractual clauses covering data shared with group companies including a US entity. We found no public information on where the banner script is served from, where consent logs and scan results are stored, or which subprocessors sit behind hosting, CDN, geolocation and support, so most of the chain a CMP sees on every pageview remains unverified.
CookieYes
The contracting entity is CookieYes Limited, a UK company in Milton Keynes, with a published data processing agreement naming AWS hosting (region unstated), a sub-processor list with 30-day change notice, and suppliers such as Stripe, Zendesk, Intercom and Sendgrid named in the privacy policy; an Irish EU representative and EU standard contractual clauses under Irish law are in place. We found no public information on where the banner script is served or the consent logs stored, on EU hosting, or on the company's ownership — so the chain behind a script that loads on every page of my site stays partly dark.
Pricing transparency
Cookiebot
The free tier is fully specified (one domain, 50 subpages, with automatic scanning and blocking), the entry price is Premium Lite at 7€ /Monat, and the scaling by domains and subpages, automatic upgrade when the scanner finds more pages, separate subdomain billing, no-contract cancellation, VAT treatment and the daily-scan add-on at +99 € /Mon. are all public. But only the Lite price is published — the Small to Extra Large tiers show subpage limits without prices — and agency programme terms and the survey and benchmark add-ons carry no public figures, so I cannot compute the annual cost for a site of several hundred pages without asking.
CookieYes
All four tiers are published per domain per month — Free at $0, Basic at $10, Pro at $25, Ultimate at $55 — with pageview allowances per tier, extra pageviews at $0.30 per 1,000, scan limits per tier, an annual "2 months free" discount, VAT charged in addition, a 14-day trial that auto-converts to a paid subscription, and termination on 30 days notice. What keeps it short of full computability for me is the Enterprise tier on custom contracts and no published agency or reseller terms, though subdomains counting as separate domains is clearly defined.
Sovereignty, side by side
Dimension
Cookiebot
CookieYes
Legal entity
Not determined
Not determined
Hosting location
Not determined
Not determined
Hosting options
Not determined
Not determined
Open source
Not determined
Not determined
Data processing agreement
Not determined
Not determined
Transfer impact assessment
Not determined
Not determined
Facts, side by side
Only facts both products carry under the same definition — anything else would not be a fair row.
As of 30 Oct 2026, the panel rates both 3/5. Weighted by what each judge cares about, 1 of the 6 judges picks Cookiebot and 4 pick CookieYes, 1 calls it a tie. Which one fits depends on the criteria that matter to you; the table on this page shows both side by side, and each judge’s reading has its own page. Both were scored by the same AI bench under the same rubric, from public evidence only, as the methodology describes.
Is Cookiebot or CookieYes European?
Cookiebot is European (EU-Made). CookieYes is European (UK / wider Europe). Provenance is read from each company’s own legal pages: who builds it and who owns it.
Do Cookiebot and CookieYes have a free plan?
As of 30 Oct 2026, both vendors’ own pages state a free plan. Each product page links the pricing page it was read from.