# Borlabs Cookie — Consent Management (CMP)

Borlabs Cookie by Borlabs GmbH holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-10-30. Provenance: EU-Made; sovereignty: not determined.

- Vendor: Borlabs GmbH (https://de.borlabs.io/)
- Category: [Consent Management (CMP)](https://whats-best.ai/software/consent-management.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/consent-management/borlabs-cookie
- Alternatives: https://whats-best.ai/software/consent-management/borlabs-cookie/alternatives ([markdown](https://whats-best.ai/software/consent-management/borlabs-cookie/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-10-30 · oldest source captured 2026-10-29

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Borlabs GmbH
- Headquarters: Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 29 Oct 2026
- Starting price: “From €49 30-day money-back guarantee Cancel anytime” (vendor’s words) [S9]

## The panel's verdict

Borlabs Cookie is a consent-management plugin for WordPress from Borlabs GmbH of Hamburg. It scored highest on pricing transparency, 7 to 9, and prior blocking, 7 to 8. Published tiers run from €49 to 499 € per year for 99 websites, unlimited page views and subpages, every function in each tier; blocking rests on script, style and content blockers, a library of more than 370 vendor-maintained packages and an audit check for content that loads without consent. The weakest scores were consent records, 4 to 5, and scanning and classification, 4 to 6: no public information covers log retention, export or the banner version behind each consent, and the vendor states its scanner samples a subset of pages rather than every page, with scheduled rescans and a generated cookie declaration also undocumented. Sovereignty spread from 6 to 8: the self-hosted model — all data on the customer's own server, no visitor data reaching Borlabs — earns credit against a United Kingdom merchant of record, Paddle.com, and no public information on ownership or security certifications. Persona-weighted totals ranged from 5.6 to 6.8.

**Speaks for it:**
- Prior blocking scored 7 to 8, on script, style and content blockers, a library of more than 370 vendor-maintained packages and an audit check that reports cookies or external content loading without consent.
- The price ladder is public — from €49 through 179 € per year for 10 websites to 499 € per year for 99 — with unlimited page views and subpages, prices excluding VAT, cancellation at any time and a 30-day money-back guarantee on the first purchase.
- The plugin runs on the customer's own server, the vendor states no visitor data is transmitted to Borlabs, and a data processing agreement is reachable through the customer portal.
- Google Consent Mode v2 is documented in basic and advanced mode with all consent types, alongside a Google Tag Manager template and local hosting of the GTM container.
- IAB TCF 2.4 is stated as certified with Global Vendor List handling and TC-string attachment, and Microsoft UET consent mode appears in every plan.

**Held against it:**
- Consent records scored 4 to 5, with no public information on log retention, export, or each consent being tied to the banner version shown.
- The scanner deliberately samples a subset of pages — homepage, one older and one newer page per post type, archives, legal-notice and contact pages — leaving the rest of the site to manual checking.
- No public information covers scheduled rescans, alerts when trackers appear or change, or a cookie declaration generated from the scan.
- We found no public information on a registered IAB CMP ID number, GPP or Global Privacy Control signals, or iOS and Android SDKs, and the captured pages show a WordPress plugin.
- The captured pages do not state that reject sits on the first layer with the same weight as accept, and regional rules stop at an EU versus non-EU split.

**Best for:**
- You run WordPress properties and want all consent data on your own server, with the vendor stating no visitor data is transmitted to Borlabs.
- You need to compute your annual cost from published prices — from €49 to 499 € per year for 99 websites with unlimited page views and subpages.
- You depend on Google Tag Manager and Google Ads — basic and advanced Consent Mode v2, a gallery template and local container hosting are documented.
- You manage many client sites — prior blocking scored 7 to 8 with more than 370 vendor-maintained packages and an audit check before handover.

**Avoid if:**
- You must prove consents to a supervisory authority — ask the vendor: the public pages we read do not show it
- You expect every page of your site scanned — the vendor states the scanner intentionally scans a subset to save time and reduce costs.
- You need consent signals shared with native apps or other CMS platforms — the captured pages show a WordPress plugin and no app SDKs.
- You require zero tag activity before consent — the documentation states Advanced Consent Mode loads tags and sends limited pings before consent is granted.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Data Protection Officer | The Agency Developer | The Publisher Marketing Lead | The In-House Lawyer | The WordPress Webmaster | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Banner & choice architecture | 3/5 | 3/5 | 3.5/5 | 3/5 | 3/5 | 3/5 |
| Prior blocking & script control | 3.5/5 | 4/5 | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 |
| Scanning & cookie classification | 2/5 | 2.5/5 | 3/5 | 2/5 | 2/5 | 3/5 |
| Consent records & proof | 2/5 | 2/5 | 2.5/5 | 2/5 | 2/5 | 2/5 |
| Frameworks, signals & platforms | 3/5 | 3/5 | 3.5/5 | 3/5 | 3/5 | 3/5 |
| European sovereignty | 4/5 | 3.5/5 | 3.5/5 | 3/5 | 3/5 | 3.5/5 |
| Pricing transparency | 4/5 | 4/5 | 4/5 | 3.5/5 | 4.5/5 | 4/5 |
| **Weighted verdict** | **3/5** | **3/5** | **3.5/5** | **3/5** | **3/5** | **3/5** |

### The judges

- **The Data Protection Officer** (v1.0): External DPO for a dozen mid-sized companies, two of which received a letter from a state supervisory authority about their cookie banner last year. Wants reject on the first layer, nothing loaded before the click, a consent log that shows which banner version each visitor saw, a cookie list that matches the site, and a DPA and subprocessor list that keep visitor data in the EU.
- **The Agency Developer** (v1.0): Lead developer at a web agency that maintains forty client sites on WordPress, TYPO3 and Shopify. Wants one account for every client, blocking that works without rewriting each theme, content blockers for YouTube and Maps, a Tag Manager template, a scanner that flags the tracker a client added on Friday, and a JavaScript API documented well enough that forms and plugins can ask for consent.
- **The Publisher Marketing Lead** (v1.0): Runs marketing for an ad-funded news site and an online shop in the same group, where every point of consent rate shows up in ad revenue and in Google Ads conversions. Wants a registered IAB TCF CMP, Google Consent Mode v2 in advanced mode, banner tests within what the law allows, consent shared between the site and the app, and a dashboard that shows where visitors drop off.
- **The In-House Lawyer** (v1.0): In-house counsel at a retailer with shops in Germany, France and Austria, who has read the court decisions on missing reject buttons and the regulators' banner guidance. Wants § 25 TDDDG and the GDPR mapped to concrete settings, equal-weight choices as the default, consent that can be withdrawn as easily as it was given, and records that would hold up if a competitor or a consumer group sued.
- **The WordPress Webmaster** (v1.0): Looks after the WordPress site of a mid-sized engineering company on top of the actual job, with Google Analytics, a YouTube channel, a Maps embed and a contact form with reCAPTCHA. Wants a plugin that finds these by itself, blocks them until the visitor agrees, survives the next plugin update and caching, and costs a known amount per site per year without a call to sales.
- **The Skeptic** (v1.0): Has opened the browser's network tab on sites with a "certified" banner and watched the ad pixels fire before anything was clicked. Reads "consent rate optimisation" as a hint that reject will be grey and small, "auto-blocking" as a claim until the test steps are published, and "EU hosting" next to a US script CDN — and asks what leaving would cost: the consent logs, and every visitor asked again.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- DPA access URL: https://service.borlabs.io/data-processing-addendum [S8]
- DPA not required: No visitor data is transmitted to Borlabs; all data stays on the customer's own server · no [S8]
- DPA support access: offered when support requires access to customer's WordPress or server with credentials · yes [S8]
- Response time: yes · 1 Monat [S7]

**Data**
- Data delete after retention: yes [S7]
- Processor list on request: yes [S7]
- Retain until purpose fulfilled: bis Zweck erfüllt, länger bei gesetzlicher Pflicht oder Einwilligung; danach Löschung [S7]

**Hosting**
- Company seat: Deutschland · yes [S2]
- Data location: customer's own server [S8]
- EU development: yes · yes [S6]
- Headquarters: Germany [S15]
- Merchant of record: customer service · returns · Paddle.com [S3]
- Merchant of record: Paddle.com [S2]
- Merchant of record: yes · Paddle.com · yes [S10]
- Merchant of record: Paddle.com [S14]
- Paddle merchant of record: yes · yes · Paddle.com [S5]
- Reseller: Paddle.com [S13]
- Reseller: Paddle.com [S15]
- Residency: Germany · EU [S3]
- Sold via paddle: Merchant of Record · Paddle.com [S12]

**Integrations**
- Compatible with 2 0 template: Borlabs Cookie Consent Variable GTM template is compatible with Borlabs Cookie 2.0 [S11]
- Content blocker examples: AB Split Test, Accessibility by UserWay, ACF OpenStreetMap Field, ActiveCampaign, Acuity Scheduling, ADCELL Tracking, Adgang med tegn, Adobe Fonts - TypeKit, Advanced Custom Fields, Ally, Amazon - Ads, Amplitude Plugin, AnalyticsWP, Anchor… [S13]
- Gtm4wp package: Dedicated GTM4WP package required for the GTM4WP plugin [S11]
- Gtm service: Google Tag Manager Service recommended for complex setups [S14]
- Gtm template: yes · Borlabs Cookie Consent Variable [S11]
- Packages library: Packages for services such as Google Tag Manager and Google Analytics are installed from a Library [S11]

**Legal**
- Disclaimer: Borlabs GmbH provides no legal advice or representation [S3]
- Dispute resolution: no [S6]
- Entity: Borlabs GmbH · Borlabs Cookie [S3]
- Entity: Borlabs GmbH [S5]
- Entity: Borlabs GmbH [S2]
- Entity: Borlabs GmbH [S8]
- Entity: Borlabs GmbH [S12]
- Entity: Borlabs GmbH [S14]
- Entity: Borlabs GmbH [S13]
- Entity: Borlabs GmbH · Hamburger Str. 11, 22083 Hamburg, Germany [S7]
- Entity: Borlabs GmbH [S15]
- Entity: Borlabs GmbH · Germany [S11]
- Entity name: Borlabs GmbH · Hamburger Str. 11, 22083 Hamburg, Germany [S6]
- Headquarters: Germany [S8]
- Headquarters: Germany [S12]
- Headquarters: Germany [S14]
- Jurisdiction: Germany · within EU [S5]
- Jurisdiction: Germany [S13]
- Jurisdiction: Hamburg [S7]
- Last updated: 2026-09-25 [S7]
- Merchant of record: Paddle.com [S6]
- Merchant of record: handles order process, customer service requests and returns · Paddle.com [S8]
- No legal advice: no [S6]
- No legal advice: no [S5]
- No legal advice: no [S10]
- No legal advice: no [S13]
- No legal advice: no [S7]
- Paddle reseller: Paddle.com [S11]
- Register: 171030 · Amtsgericht Hamburg [S6]
- Register: HRB 171030 · Amtsgericht Hamburg [S7]
- Seat: Hamburg [S6]
- Trademarks: Borlabs · Borlabs Cookie [S5]
- VAT id: DE 347062761 [S6]
- VAT id: DE 347062761 [S7]

**Pricing**
- Agency: EUR · 99 · AGENCY · 499 · year [S5]
- Agency small: EUR · 25 · AGENCY - SMALL · 229 · year [S5]
- Business large: EUR · 10 · BUSINESS - LARGE · 179 · year [S5]
- Cancel anytime: yes [S9]
- Cancellation: yes [S1]
- Cancellation: yes [S13]
- Features included: 2.4 · email · yes · yes · yes [S5]
- Money back: 30 · yes [S5]
- Money back guarantee: 30 [S1]
- No discounts: No special discounts year-round [S5]
- Refund policy: 30 [S9]
- Refund policy: 30 [S13]
- Starting price: 49 · starting_from [S1]
- Starting price: 49 · 30 · yes [S2]
- Starting price: 49 [S9]
- Starting price: 49 [S13]
- Unlimited usage: yes · yes [S5]
- VAT: EUR · no [S3]
- VAT: EUR · no [S5]
- VAT: EUR · no [S11]
- VAT currency: EUR · no [S10]
- VAT excluded: excluded · EUR [S12]
- VAT excluded: EUR · no [S14]
- VAT excluded: EUR · no [S15]
- VAT exclusive: EUR · no [S6]
- VAT exclusive: EUR · no [S7]
- VAT note: EUR · no [S8]

**Product**
- Accessibility wcag: yes [S2]
- Adsense purposes: 1 · 2 · 3 · 1 · 2 · 3 · 4 · 7 · 9 · 10 · 1 · 2 · 1 · 2 [S3]
- Adsense recommended purposes: 1 · 2 · 3 · 4 · 7 · 9 · 10 [S15]
- Adsense tcf stub file: borlabs-cookie-tcf-stub.min.js [S15]
- Advanced consent mode: unclear · yes [S11]
- Animation control: yes [S2]
- Audit scan: yes [S2]
- Auto detect imprint privacy: yes [S2]
- Automatic cache clearing: yes [S2]
- Automatic translation: yes [S2]
- Basic consent mode: yes · yes · yes [S11]
- Bot crawler handling: yes [S2]
- Bulk installation: yes [S2]
- Color assistant wcag: yes [S2]
- Compatibility patch: Compatibility Patch [S13]
- Composer integration: yes [S2]
- Consent logs: yes [S2]
- Consent mode basic default: yes [S14]
- Consent mode cookieless: yes [S11]
- Consent mode default denied: Denied [S11]
- Consent mode enabled: Enable Consent Mode · yes [S11]
- Consent mode group mapping: Consent Mode consent types are mapped to Service Groups, not individual services [S11]
- Consent mode service group active required: Selected Service Groups must have at least one active Service [S11]
- Consent mode v2 packages: Consent Mode v2 usable via Google Analytics/Google Ads Services or Google Tag Manager Service, installable as packages from Borlabs Cookie 3.0 Library [S14]
- Consent statistics: yes [S2]
- Consent types: Ad Storage · Ad User Data · Ad Personalization · Analytics Storage · Functionality Storage · Personalization Storage · Security Storage [S11]
- Consent without dialog: yes [S2]
- Content blocker: yes [S2]
- Cookie details: yes [S2]
- Cookie lifetimes: yes [S2]
- Cookie versioning: yes [S2]
- Cross domain consent: yes [S2]
- Custom services: yes [S2]
- Debug console: yes [S2]
- Dialog design options: 150 [S2]
- Dialog layouts: bar · box [S2]
- Dialog positions: 9 [S2]
- Disable code execution: prevent service code blocks executing directly when GTM delivers code · yes [S11]
- Do not track: yes [S2]
- DSGVO consent requirements: DSGVO-compliant consent management with granular choices down to service level [S5]
- Geo restriction: yes [S2]
- Google analytics package: Tracking ID · yes [S11]
- Google consent mode: yes · yes [S2]
- Gtm local behavior: Borlabs Cookie downloads the GTM container JavaScript and serves it locally [S11]
- Gtm local hosting: yes · 1.39.23 · Essential [S11]
- Gtm local pre consent: tags within container must be configured to fire only after consent · yes [S11]
- Gtm local setup: Google Tag Manager can be set up locally in Borlabs Cookie 3.0 [S14]
- Gtm local sync: Local GTM container changes are not auto-synced; Save Settings in the GTM Service applies them [S11]
- Gtm zones unsupported local: no [S11]
- Hide dialog pages: yes [S2]
- Http auth scan: yes [S2]
- Iab tcf compact layout: Compact Layout (BETA) option available [S15]
- Iab tcf gvl download: Global Vendor List (GVL) is downloaded and status shown in settings [S15]
- Iab tcf support: yes [S3]
- Iab tcf support: yes [S15]
- Import export: yes [S2]
- Javascript API: yes [S2]
- Kiosk mode: yes [S2]
- Legacy importer: yes [S2]
- Legal advice disclaimer: no [S14]
- Library packages: 370 [S2]
- Library purpose: Library lets users check whether their plugins, themes, and services are already supported [S13]
- License upgrade: addressed in FAQ (answer not shown) [S5]
- Logging system: yes [S2]
- Login page dialog: yes [S2]
- Meta box custom code: yes [S2]
- Multilingual compat: WPML · Polylang · TranslatePress · Weglot [S2]
- Multisite aggregation: yes [S2]
- No legal advice: no [S2]
- Opt in event naming: borlabs-cookie-opt-in- + Service ID [S11]
- Opt in event once per page: yes [S11]
- Optout essential services: yes [S2]
- Package count: page states 'More than 370 packages' · 370 [S13]
- Package types: Content Blocker [S13]
- Platform: WordPress [S1]
- Platform: addressed in FAQ (answer not shown) [S5]
- Professional translations: 8 · Dänisch · Deutsch · Englisch · Französisch · Italienisch · Niederländisch · Polnisch · Spanisch [S2]
- Provider management: yes [S2]
- Safe mode: yes [S2]
- Scanner: automatischer Scanner für Cookies, externe Ressourcen und einwilligungspflichtige Funktionen [S2]
- Scanner custom urls: A "Custom" option lets users add specific URLs for the Scanner to analyze. [S12]
- Scanner partial scan: The Scanner does not scan every page; it intentionally scans a subset because many pages are very similar. [S12]
- Scanner selection scope: "Selection of sites per post type" option scans homepage, one older and one newer page of each post type, corresponding archive pages, plus attempts to identify legal notice page and contact form page. [S12]
- Script blocker: yes [S2]
- Script blocker: Script Blocker [S13]
- Script blocker no race conditions: yes [S2]
- Script style scanner: yes [S2]

**Subprocessors**
- Firstpromoter: FirstPromoter (Igil Webs SRL) · Romania · Affiliate-/Referral-Marketing [S7]
- Helpspace: HelpSpace GmbH · Support- und Kontaktanfragen [S7]
- Paddle merchant of record: Paddle.com · yes [S7]
- Recaptcha: Google Ireland Limited · SPAM- und Bots-Schutz [S7]

**Support**
- Language: English · German · English · German [S5]
- Privacy email: datenschutz@borlabs.io [S7]
- Ticket system only: Support requests must go through the support ticket system; the listed email is not answered for requests [S7]

20 more facts on the canonical page: https://whats-best.ai/software/consent-management/borlabs-cookie

## Questions

### Is Borlabs Cookie European?

Yes. whats-best.ai classifies Borlabs Cookie as EU-Made.

### Where does Borlabs Cookie store data?

Not stated on the vendor’s pages as of 29 Oct 2026.

### Does Borlabs Cookie have a free plan?

Not stated on the vendor’s pages as of 29 Oct 2026.

### What are the best alternatives to Borlabs Cookie?

As of 3 Nov 2026, the panel rates [Usercentrics CMP (3.5/5)](https://whats-best.ai/software/consent-management/usercentrics), [Didomi (3.5/5)](https://whats-best.ai/software/consent-management/didomi) and [CCM19 (3.5/5)](https://whats-best.ai/software/consent-management/ccm19) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Usercentrics CMP](https://whats-best.ai/software/consent-management/usercentrics) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Borlabs Cookie alternatives](https://whats-best.ai/software/consent-management/borlabs-cookie/alternatives).

## Head-to-head

- [Borlabs Cookie vs Real Cookie Banner](https://whats-best.ai/compare/borlabs-cookie-vs-real-cookie-banner.md)

## What this page leaves out

- 32 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 8 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 8 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://de.borlabs.io/ (checked 2026-10-29)
- [S2] Features page: https://de.borlabs.io/borlabs-cookie/funktionen/ (checked 2026-10-29)
- [S3] Documentation (IAB TCF): https://de.borlabs.io/docs/iab-tcf-einrichten-google-adsense-konfiguration/ (checked 2026-10-29)
- [S4] Documentation (Google Consent Mode v2): https://de.borlabs.io/docs/google-consent-mode-v2/ (checked 2026-10-29)
- [S5] Pricing page: https://de.borlabs.io/borlabs-cookie/preise/ (checked 2026-10-29)
- [S6] Legal notice: https://de.borlabs.io/impressum/ (checked 2026-10-29)
- [S7] Privacy policy: https://de.borlabs.io/datenschutzerklaerung/ (checked 2026-10-29)
- [S8] Data processing agreement (dpa): https://de.borlabs.io/docs/auftragsverarbeitungsvertrag-avv-adv/ (checked 2026-10-29)
- [S9] Banner & choice architecture — found from sitemap: https://borlabs.io/borlabs-cookie/for-agencies-web-designers/ (checked 2026-10-29)
- [S10] Prior blocking & script control — found from sitemap: https://borlabs.io/docs/backdrop-disabled-background-remains-blocked/ (checked 2026-10-29)
- [S11] Prior blocking & script control — found from sitemap: https://borlabs.io/docs/set-up-google-tag-manager-local-in-borlabs-cookie-3-0/ (checked 2026-10-29)
- [S12] Scanning & cookie classification — found from sitemap: https://borlabs.io/docs/scanner-does-not-scan-all-pages/ (checked 2026-10-29)
- [S13] Scanning & cookie classification — found from sitemap: https://borlabs.io/borlabs-cookie/features/library/ (checked 2026-10-29)
- [S14] Frameworks, signals & platforms — found from sitemap: https://borlabs.io/docs/google-consent-mode-v2/ (checked 2026-10-29)
- [S15] Frameworks, signals & platforms — found from sitemap: https://borlabs.io/docs/setup-iab-tcf-google-adsense-configuration/ (checked 2026-10-29)

---

Cite as: whats-best.ai, "Borlabs Cookie — Consent Management (CMP)", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/consent-management/borlabs-cookie

Corrections: https://whats-best.ai/correct/1153?target=page