Consent Management (CMP)
Borlabs Cookie
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Borlabs GmbH · de.borlabs.io
Compare with Real Cookie Banner → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Borlabs Cookie at a glance
- Vendor
- Borlabs GmbH
- Headquarters
- Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 29 Oct 2026
- Starting price
- “From €49 30-day money-back guarantee Cancel anytime” (vendor’s words) source, captured 29 Oct 2026
- Panel verdict
- The AI panel rates Borlabs Cookie 3/5, the mean of 6 judges. Borlabs Cookie is a consent-management plugin for WordPress from Borlabs GmbH of Hamburg. how scores are made
- As of
- Vendor pages captured 29 Oct 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Borlabs Cookie is a consent-management plugin for WordPress from Borlabs GmbH of Hamburg. It scored highest on pricing transparency, 7 to 9, and prior blocking, 7 to 8. Published tiers run from €49 to 499 € per year for 99 websites, unlimited page views and subpages, every function in each tier; blocking rests on script, style and content blockers, a library of more than 370 vendor-maintained packages and an audit check for content that loads without consent. The weakest scores were consent records, 4 to 5, and scanning and classification, 4 to 6: no public information covers log retention, export or the banner version behind each consent, and the vendor states its scanner samples a subset of pages rather than every page, with scheduled rescans and a generated cookie declaration also undocumented. Sovereignty spread from 6 to 8: the self-hosted model — all data on the customer's own server, no visitor data reaching Borlabs — earns credit against a United Kingdom merchant of record, Paddle.com, and no public information on ownership or security certifications. Persona-weighted totals ranged from 5.6 to 6.8.
Speaks for it
- Prior blocking scored 7 to 8, on script, style and content blockers, a library of more than 370 vendor-maintained packages and an audit check that reports cookies or external content loading without consent.
- The price ladder is public — from €49 through 179 € per year for 10 websites to 499 € per year for 99 — with unlimited page views and subpages, prices excluding VAT, cancellation at any time and a 30-day money-back guarantee on the first purchase.
- The plugin runs on the customer's own server, the vendor states no visitor data is transmitted to Borlabs, and a data processing agreement is reachable through the customer portal.
- Google Consent Mode v2 is documented in basic and advanced mode with all consent types, alongside a Google Tag Manager template and local hosting of the GTM container.
- IAB TCF 2.4 is stated as certified with Global Vendor List handling and TC-string attachment, and Microsoft UET consent mode appears in every plan.
Held against it
- Consent records scored 4 to 5, with no public information on log retention, export, or each consent being tied to the banner version shown.
- The scanner deliberately samples a subset of pages — homepage, one older and one newer page per post type, archives, legal-notice and contact pages — leaving the rest of the site to manual checking.
- No public information covers scheduled rescans, alerts when trackers appear or change, or a cookie declaration generated from the scan.
- We found no public information on a registered IAB CMP ID number, GPP or Global Privacy Control signals, or iOS and Android SDKs, and the captured pages show a WordPress plugin.
- The captured pages do not state that reject sits on the first layer with the same weight as accept, and regional rules stop at an EU versus non-EU split.
Best for
- You run WordPress properties and want all consent data on your own server, with the vendor stating no visitor data is transmitted to Borlabs.
- You need to compute your annual cost from published prices — from €49 to 499 € per year for 99 websites with unlimited page views and subpages.
- You depend on Google Tag Manager and Google Ads — basic and advanced Consent Mode v2, a gallery template and local container hosting are documented.
- You manage many client sites — prior blocking scored 7 to 8 with more than 370 vendor-maintained packages and an audit check before handover.
Avoid if
- You must prove consents to a supervisory authority — ask the vendor: the public pages we read do not show it
- You expect every page of your site scanned — the vendor states the scanner intentionally scans a subset to save time and reduce costs.
- You need consent signals shared with native apps or other CMS platforms — the captured pages show a WordPress plugin and no app SDKs.
- You require zero tag activity before consent — the documentation states Advanced Consent Mode loads tags and sends limited pings before consent is granted.
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 3 of 5 |
| Prior blocking & script control | 3.5 of 5 |
| Scanning & cookie classification | 2.5 of 5 |
| Consent records & proof | 2 of 5 |
| Frameworks, signals & platforms | 3 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 4 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Script, style and content blockers stop specific JavaScript, CSS and embeds such as YouTube and Google Maps until consent, backed by a maintained library of more than 370 packages, per-service tag-manager events, and an audit check that reports whether the site sets cookies or loads external content without consent. Basic Consent Mode is described as loading tags only after consent and as the legally safest option, and the advanced mode's pre-consent pings and their unclear legal status are explained rather than hidden. Server-side tagging and alerts when a new tracker bypasses the banner are not documented. 2 11 13
The Agency Developer
This is exactly what I need for client sites: content blockers for YouTube and Google Maps with customisable design, texts and behaviour, script and style blockers, more than 370 vendor-maintained packages, a Google Tag Manager template in the official gallery plus a dedicated GTM4WP package, and a documented JavaScript API with a dedicated opt-in event per service. An audit scan checks whether the site sets cookies or loads external content without consent, which is the verification step I want before handing a site over. We found no public information on server-side tagging or on consent being passed to forms and CAPTCHAs by name. 2 11 13
The Publisher Marketing Lead
Content blockers come vendor-maintained for over 370 packages alongside a script and style blocker, an audit scan checks the site sets no cookies or external content without consent, and the Google Tag Manager path is documented in depth — template, per-service opt-in events, local container hosting and its stated limits. I found no public information on server-side tagging support. 2 11 13
The In-House Lawyer
Script and style blockers hold back specific JavaScript and CSS until consent, more than 370 vendor-maintained packages cover named services including YouTube and Google Maps, a Google Tag Manager template ships in the official gallery with a dedicated opt-in event per service and local hosting of the GTM container, and an audit check plus debug console let the site owner verify nothing loads before consent. We found no public information on server-side tagging or continuous monitoring that alerts when a new tracker bypasses the banner. 2 11 13
The WordPress Webmaster
This is what I care about most and it is documented in depth: content blockers hold YouTube and Google Maps until consent with over 370 vendor-maintained packages, a script and style blocker stops JavaScript and CSS before consent, an audit feature checks that the site sets no cookies or loads nothing external without a decision, and there is automatic cache clearing for third-party plugins plus a safe mode for botched updates. The Google Tag Manager documentation goes deep, with a gallery template, per-service opt-in events, local container hosting, and the limits of basic versus advanced consent mode spelled out. We found no public information on server-side tagging or Matomo Tag Manager. 2 11 13
The Skeptic
Script, style and content blockers are each described, backed by a vendor-maintained library of 370+ packages for named services, an audit feature checks whether the site sets cookies or loads external content without consent, and the Google Tag Manager container can even be served locally so its script never loads from Google. Credit for bluntness: the documentation admits Advanced Consent Mode loads tags and sends limited 'pings' before consent — the fully-blocked story only holds in Basic Mode. I found no public information on server-side tagging or consent passed into forms and CAPTCHAs. 2 11 13
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
An automatic scanner analyses the site for cookies, external resources and consent-requiring features, suggests packages from a library of over 370, can reach HTTP-protected areas and custom URLs, and cookie details with purpose, type and lifetime are supported. But the vendor itself states the scanner deliberately scans only a subset — homepage, one older and one newer page per post type, archives, imprint and contact page — and rescans on a schedule, a self-updating cookie declaration and alerts on new or changed trackers are not documented, so the cookie list matching the whole site is not assured. 2 12 13
The Agency Developer
The scanner analyses the site automatically for cookies, external resources and consent-requiring functions and proposes matching packages, can be pointed at custom URLs, works behind HTTP authentication, and its scope is stated honestly: homepage, one older and one newer page per post type, plus archive, legal-notice and contact pages. Packages come from a maintained library with purposes, providers and cookie lifetimes. We found no public information on scheduled rescans, alerts when a new tracker appears on the site, or a cookie declaration generated and updated from the scan result. 2 12 13
The Publisher Marketing Lead
The scanner covers cookies, external resources and consent-requiring functions, reaches HTTP-Auth areas and custom URLs, and the vendor is transparent that it scans a defined subset — home page, one older and one newer page per post type, archives, legal notice and contact form. I found no public information on scheduled rescans, alerts on new trackers, or a cookie declaration that updates itself from the scan. 2 12 13
The In-House Lawyer
An automatic scanner analyses the site for cookies, external resources and consent-requiring functions, proposes matching library packages, can be pointed at custom URLs, reaches HTTP-protected areas, and the vendor states plainly that it samples a subset of pages rather than every page. We found no public information on scheduled rescans, a cookie declaration generated and kept current from the scan results, or alerts when new or changed trackers appear — so the list staying true over time rests on the site owner. 2 12 13
The WordPress Webmaster
An automatic scanner analyses the site for cookies, external resources and consent-requiring functions and suggests matching packages, and the documentation is frank about scope: it scans a subset (homepage, an older and a newer page per post type, archive pages, legal notice and contact form), accepts custom URLs, and can reach HTTP-auth protected areas. Cookie details such as purpose, type and lifetime are managed per service with provider information kept centrally. We found no public information on scheduled rescans, alerts when new trackers appear, or a cookie declaration generated from the scan. 2 12 13
The Skeptic
The scanner analyses the site for cookies, external resources and consent-requiring functions and matches them against a package library where services carry purpose, type and lifetime details; scanning behind HTTP authentication is supported and custom URLs can be added for unscanned pages. The vendor says plainly the scanner covers a subset — homepage, one older and one newer page per post type, archives, legal and contact pages — not every page, which I respect but note as coverage you must complete by hand. I found no public information on scheduled rescans, alerts when trackers appear or change, or a cookie declaration generated from the scan. 2 12 13
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
Consent logs are documented including changes over time, consent is requested again when services change, expiry is configurable, consents are shared across domains, and everything is stored on the customer's own server because no visitor data reaches the vendor. But nothing documents that each record is tied to the banner version shown, a retention period for the log, or an export of the log — and when an authority asks which banner a visitor saw, a log without versions is a log, not proof. 2 8
The Agency Developer
Consents are documented including their changes over time, evaluated per service and group, re-requested when services change, expire on configurable cookie lifetimes, and are shareable across domains and multisite installations — with all data stored on the customer's own server. We found no public information on a retention period for the consent log, export of the log, a consent ID the visitor can look up, or records tied to the exact banner version shown. 2 8
The Publisher Marketing Lead
Consent logs document consents including their changes over time, every byte sits on the customer's own server, consent is asked again when services change or after a configurable lifetime, and consent is shared across domains and multisite instances. I found no public information on retention for the log, an export format, a banner version per record, or a consent ID the visitor can look up — exactly what I would need to answer an authority. 2 8
The In-House Lawyer
Consents are documented including their changes over time, stored entirely on the customer's own server, aggregated across multisite installations and shared across domains, with re-consent triggered when services change and configurable consent expiry that brings the dialog back. We found no public information on a stated retention period, export of the consent log, a consent ID the visitor could look up, or the banner version being recorded with each consent — the pieces I would need to reconstruct the exact choice shown if a consumer group sued. 2 8
The WordPress Webmaster
Consents are documented in a log including changes over time, stored on my own server because the plugin transmits no visitor data to the vendor, and the dialog asks again when services change or when the configurable consent lifetime expires, with cross-domain and multisite history aggregated. We found no public information on retention periods for the log, exporting it, a consent ID visitors could look up, or records tied to the exact banner version shown. 2 8
The Skeptic
A consent log documents consents including changes over time, re-consent is forced when services change, expiry comes via configurable cookie lifetimes, and everything sits on the customer's own server with no visitor data reaching Borlabs. The dispute-grade parts are undocumented: I found no public information on what a single record contains, a stated retention period, export of the log, or a banner version bound to each consent — the things you need the day a supervisory authority writes. 2 8
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
TCF v2.4 is stated as certified with Global Vendor List handling, TC-string parameters and vendor configuration by purpose or ID list, Google Consent Mode v2 works in basic and advanced mode with all seven consent types documented, Microsoft UET consent mode is included, and agency tiers cover up to 99 websites. It is a WordPress plugin with a documented JavaScript API, WP-CLI and local tag-manager hosting; we found no public information on app SDKs, GPP or Global Privacy Control, and no registered CMP ID or REST configuration API is shown. 2 5 11 14
The Agency Developer
Signal depth is strong: certified IAB TCF 2.4 with vendor configuration and TC-string forwarding, Google Consent Mode v2 in basic and advanced mode with all seven consent types documented, Microsoft UET consent mode included in every plan, agency tiers for 25 or 99 websites, and configuration via WP-CLI. The captured pages show WordPress only, however, and a FAQ question about Shopify and Webflow whose answer was not shown; we found no public information on TYPO3 or Shopify plugins, iOS or Android SDKs, GPP or Global Privacy Control, or a registered CMP ID number. 2 5 11 15
The Publisher Marketing Lead
IAB TCF 2.4 is stated as certified with the Global Vendor List downloaded and the TC string attached to defined links, Consent Mode v2 works in basic and advanced mode with all consent types and default-denied documented, and Microsoft UET consent mode is listed as included — the core of my ad stack. The pages I read give no registered CMP ID number, no naming as a Google-certified CMP, and no public information on GPP or Global Privacy Control for US states or on iOS and Android SDKs, so consent shared between my site and an app is not evidenced. 2 5 11 14 15
The In-House Lawyer
Certified IAB TCF v2.4 with Global Vendor List handling and automatic TC-string attachment, Google Consent Mode v2 in both basic and advanced mode with basic mode enabled on install, and Microsoft UET consent mode in every plan, plus a documented JavaScript API, WP-CLI configuration, cross-domain consent and agency licences covering up to 99 websites. We found no public information on a registered CMP ID number, on GPP or GPC signals, on app SDKs, or on any platform beyond WordPress, which is a narrow footprint for anyone running native apps alongside the shops. 2 5 11 15
The WordPress Webmaster
As a WordPress plugin this is native to my stack, with certified IAB TCF 2.4 including Global Vendor List download and vendor management by ID and purpose, Google Consent Mode v2 in basic and advanced mode documented in depth, Microsoft UET consent mode listed as included, a JavaScript API, WP-CLI support, cross-domain consent and priced agency tiers. We found no public information on a registered IAB CMP ID number, GPP or Global Privacy Control, iOS or Android SDKs, a REST configuration API, or versions for other CMS platforms. 2 5 11 14
The Skeptic
TCF 2.4 is claimed certified with Global Vendor List handling, vendor configuration by ID or purpose and the TC string attached to defined links; Consent Mode v2 is documented in both Basic and Advanced modes with all consent types listed, and Microsoft UET consent mode appears as an included feature. But a 'certified' claim without the number leaves me cold: I found no public information on a registered IAB CMP ID, Google's CMP certification, GPP or Global Privacy Control for US states, or app SDKs — and this is WordPress only, with the FAQ on Shopify and Webflow not showing its answer. 2 5 11 15
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
Borlabs GmbH is registered in Hamburg with a German VAT ID, the plugin runs entirely on the customer's own server where all data stays and no visitor data is transmitted to the vendor, a data processing agreement is published and another is offered whenever support needs credentials, and processors are named with countries including HelpSpace in Germany and Google Ireland for spam protection. This is effectively the self-hosted end of the chain; ownership and security certifications are not documented, the sales chain runs through Paddle.com as Merchant of Record, and the vendor's own privacy policy names Amazon SES for email with the product-related scope left open. 6 7 8
The Agency Developer
The product runs as a WordPress plugin on the customer's own server, keeps all data there and, in the vendor's words, transmits no visitor information to Borlabs — with a data processing agreement available through the customer portal — which makes the consent chain about as sovereign as it gets. Borlabs GmbH is seated in Hamburg with a German VAT number, EU development is stated, and named processors (Paddle for orders, HelpSpace for support, Google Ireland for spam protection, FirstPromoter in Romania) appear in the privacy policy with a current list available on request. Ownership is unknown, no ISO 27001 or SOC 2 certification is stated, the order process runs through Paddle.com as merchant of record, and we found no public information on where the scanner and package-update infrastructure is hosted. 2 6 7 8
The Publisher Marketing Lead
The contracting entity is Borlabs GmbH in Hamburg with registry court, register number and German VAT ID published, the plugin keeps all data on the customer's own server and transmits no visitor data to the vendor, and subprocessors are named with their countries together with a data processing agreement available for support access. I found no public information on security certifications or on the ownership behind the company, and the Amazon SES mention in the website privacy policy is not separated from product-related email. 6 7 8
The In-House Lawyer
Borlabs GmbH is registered at the Hamburg court with a full address and VAT ID, the plugin runs on the customer's own server and the vendor states no visitor data reaches them, and the privacy policy names Paddle (United Kingdom), HelpSpace (Germany), Google Ireland and FirstPromoter (Romania) with a current processor list available on request and a data processing agreement reachable through the customer portal. We found no public information on where the licence, library and scanner services are hosted, on ownership or any parent company, or on security certifications, and orders are processed by a UK merchant of record. 2 6 7 8
The WordPress Webmaster
Borlabs GmbH is registered in Hamburg with a commercial register number and VAT ID, the product is developed in the EU, and everything runs on my own server — the banner, consent logs and data stay there, with a data processing addendum accessible in the customer portal and one offered whenever support needs credentials. The order and customer-service process runs through Paddle as merchant of record, the privacy policy names Amazon SES and a current processor list is available on request. We found no public information on ownership, where the update and library infrastructure runs, or security certifications such as ISO 27001. 2 6 7 8
The Skeptic
The strongest posture a consent tool can take: a self-hosted plugin where all data stays on the customer's own server and no visitor information is transmitted to Borlabs, sold by a Hamburg GmbH with registry number and VAT ID published and a data processing agreement reachable through the customer portal. The edges are what I always check: I found no public information on ownership or ISO 27001/SOC 2 certification, Paddle in the UK is merchant of record on every order, and the privacy policy names Amazon SES, Google reCAPTCHA and HelpSpace while the full processor list is only available on request. 6 7 8
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
Tiers are public with prices per website count — from €49 up through 179 €/year for 10 websites, 229 €/year for 25 and 499 €/year for 99 — with unlimited page views and subpages so no traffic overage exists, all functions including TCF and Consent Mode in every tier, VAT treatment stated as excluded, cancellation anytime and a 30-day money-back guarantee. Setup fees and the tiers between the captured ones are not shown on the pages I read, which keeps the annual figure from being fully derivable for every website count. 5 9 10 13
The Agency Developer
The ladder is public and lets me compute a portfolio's cost without a sales call: from €49, then €179 per year for 10 websites, €229 for 25 and €499 for 99, with unlimited pageviews and subpages, all functions including TCF and Consent Mode in every plan, a 30-day money-back guarantee on the first purchase, cancellation at any time, and prices stated in euros excluding VAT. The one gap is that the FAQ answer on licence upgrades was not shown in the captures. 5 7 13
The Publisher Marketing Lead
Plans scale publicly by website count with euro prices — from €49, then 179 € per year for 10 sites up to 499 € per year for 99 — with unlimited pageviews and subpages, TCF and Consent Mode included in the plans, VAT treatment stated as prices excluding VAT, cancel anytime and a 30-day money-back guarantee. The captured pages do not itemise the tiers between the entry price and the 10-website plan, so the annual cost for a single small property is only partly computable. 5 7 13
The In-House Lawyer
Tiers are public from €49 per year with unlimited page views and subpages, all functions including TCF 2.4, Consent Mode v2 and Microsoft UET in every plan, prices stated in euros excluding VAT, a 30-day money-back guarantee, cancellation at any time, and agency bundles for 25 and 99 websites at 229 € and 499 € per year. Site counts between the published tiers and beyond 99 websites, any setup fee, and data-return terms on exit are not priced or described publicly, so the annual cost is computable only at the published bundle sizes. 5 7 13
The WordPress Webmaster
I can compute my annual cost from the pricing page alone: from €49, with 10 websites at 179 € per year, 25 at 229 € and 99 at 499 €, unlimited page views and subpages so there is no traffic arithmetic, and every function including TCF, Google Consent Mode and Microsoft UET in every plan; prices are stated excluding VAT, cancellation is anytime and a 30-day money-back guarantee applies to the first purchase. We found no public information on setup fees or data-return terms on cancellation. 5 7 13
The Skeptic
The annual cost is largely computable from public pages: 'From €49' up to '499 € / Jahr' for 99 websites, unlimited pageviews and subpages, all functions including TCF 2.4 and Consent Mode v2 in every tier, prices 'Alle Preise in Euro exkl. USt.', a 30-day money-back guarantee on the first purchase and 'Cancel anytime'. What blocks full computability: I found no public information on licence upgrade pricing — the FAQ entry exists but shows no answer — nor on data-return terms when a customer cancels. 5 7 13
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined ⚠ unverified | — | uncited Report an error |
Questions about Borlabs Cookie
Is Borlabs Cookie European?
Yes. whats-best.ai classifies Borlabs Cookie as EU-Made.
Where does Borlabs Cookie store data?
Not stated on the vendor’s pages as of 29 Oct 2026.
Does Borlabs Cookie have a free plan?
Not stated on the vendor’s pages as of 29 Oct 2026.
What are the best alternatives to Borlabs Cookie?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Borlabs Cookie alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Transfer impact assessment, Legal entity, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 32 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (15)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage de.borlabs.io Checked 29 Oct 2026 Details →
- 2 Features page de.borlabs.io Checked 29 Oct 2026 Details →
- 3 Documentation (IAB TCF) de.borlabs.io Checked 29 Oct 2026 Details →
- 4 Documentation (Google Consent Mode v2) de.borlabs.io Checked 29 Oct 2026 Details →
- 5 Pricing page de.borlabs.io Checked 29 Oct 2026 Details →
- 6 Legal notice de.borlabs.io Checked 29 Oct 2026 Details →
- 7 Privacy policy de.borlabs.io Checked 29 Oct 2026 Details →
- 8 Data processing agreement (dpa) de.borlabs.io Checked 29 Oct 2026 Details →
- 9 Banner & choice architecture — found from sitemap borlabs.io Checked 29 Oct 2026 Details →
- 10 Prior blocking & script control — found from sitemap borlabs.io Checked 29 Oct 2026 Details →
- 11 Prior blocking & script control — found from sitemap borlabs.io Checked 29 Oct 2026 Details →
- 12 Scanning & cookie classification — found from sitemap borlabs.io Checked 29 Oct 2026 Details →
- 13 Scanning & cookie classification — found from sitemap borlabs.io Checked 29 Oct 2026 Details →
- 14 Frameworks, signals & platforms — found from sitemap borlabs.io Checked 29 Oct 2026 Details →
- 15 Frameworks, signals & platforms — found from sitemap borlabs.io Checked 29 Oct 2026 Details →