Consent Management (CMP)
Cookiebot
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Usercentrics A/S · www.cookiebot.com
Compare with CookieYes → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Cookiebot at a glance
- Vendor
- Usercentrics A/S
- Headquarters
- Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 29 Oct 2026
- Panel verdict
- The AI panel rates Cookiebot 3/5, the mean of 6 judges. Cookiebot, a consent management platform from Usercentrics A/S of Denmark (reg. how scores are made
- As of
- Vendor pages captured 29 Oct 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Cookiebot, a consent management platform from Usercentrics A/S of Denmark (reg. no. 34624607), scored highest on banner and choice at 7 to 8, with scanning and classification and standards and platforms each at 7, and lowest on sovereignty. Judges credit deep scanning of first- and third-party cookies, local storage, IndexedDB, pixel tags and dynamic cookies, monthly rescans with a daily option at +99 €/month, and signal coverage from Google Consent Mode v2 with Google-certified (Golden Badge) status to Microsoft UET, Clarity, Amazon signals and GPC. Sovereignty clustered at 4 despite a published data processing agreement and ISO 27001, ISO 27701 and SOC 2 Type 2 certifications: we found no public information on where the banner script is served or consent logs are stored, or on subprocessors, and the privacy policy names group companies including a US-incorporated Usercentrics Inc. The judges split by a point on prior blocking and pricing transparency (5 to 6 each), the lower scores citing undocumented embed and verification details for blocking and missing prices above Premium Lite (7 €/month).
Speaks for it
- banner and choice scored 7 to 8, documenting accept, reject and customize options, per-category toggles on both layers, withdrawal at any time via the cookie declaration, WCAG 2.2 accessibility, and 47+ languages with browser-language detection
- scanning and classification scored 7, with patented deep scanning of first- and third-party cookies, local storage, IndexedDB, pixel tags and dynamic cookies, and monthly rescans with a daily option at +99 €/month
- standards and platforms scored 7, documenting Google Consent Mode v2 with Google-certified (Golden Badge) CMP status, Microsoft UET and Clarity consent modes, Amazon consent signals, GPC, and plugins or apps for WordPress, Wix and Shopify
- consents are exportable as CSV including categories, retained up to 12 months, with a consent ID visitors can cite and cross-domain consent sharing
- the free tier is fully specified at one domain and 50 subpages, Premium Lite is 7 €/month with no minimum term, and the 14-day trial requires no credit card
Held against it
- sovereignty scored 4: we found no public information on where the banner script is served or consent logs are stored, or on subprocessors and their locations
- the privacy policy names group companies, including US-incorporated Usercentrics Inc., among those data is shared with
- we found no public prices for the tiers above Premium Lite (7 €/month), so the annual cost above the Lite band cannot be computed from the captured pages
- prior blocking scored 5 to 6: we found no public information on placeholders for embedded videos or maps, server-side tagging, or a documented way to verify nothing loads before consent
- the captured pages give different figures for the TCF version, naming both 2.3 and 2.4, and we found no public information on a registered IAB Europe CMP ID
Best for
- You run a small site within one domain and 50 subpages and want automatic scanning and blocking on the free tier
- Your ad measurement runs through Google and you need Consent Mode v2 from a Google-certified (Golden Badge) CMP
- You serve visitors across regions and languages and need per-region opt-in and opt-out rules with 47+ languages and browser-language detection
- You deploy through the WordPress plugin, the Wix or Shopify apps, or the Google Tag Manager template
Avoid if
- You must keep consent documentation beyond 12 months — documentation of consents runs up to 12 months
- You need IAB TCF at no extra cost — it is an optional integration, paid from the entry paid tier
- You must document hosting locations and subprocessors before signing — we found no public information on either, and the privacy policy names a US-incorporated group company among those data is shared with
- You need to compute the full annual cost for a site above 50 subpages before committing — only Premium Lite's price (7 €/month) is public and the subscription upgrades automatically when the scan finds more subpages
The scores
| Criterion | Panel median |
|---|---|
| Banner & choice architecture | 3.5 of 5 |
| Prior blocking & script control | 3 of 5 |
| Scanning & cookie classification | 3.5 of 5 |
| Consent records & proof | 3 of 5 |
| Frameworks, signals & platforms | 3.5 of 5 |
| European sovereignty | 2 of 5 |
| Pricing transparency | 3 of 5 |
Prior blocking & script control
Show reasoningHide reasoning
How this is scored
What happens before the visitor decides: automatic blocking of scripts, pixels, cookies and embedded content until consent is given, content blockers with placeholders for videos, maps and social embeds, integration with tag managers (Google Tag Manager, Matomo Tag Manager) and server-side tagging, consent passed to forms and plugins, and a documented way for the site owner to check that nothing loads too early.
0 — No blocking of any kind; the product only shows a banner and leaves every script running.
3 — Blocking by hand: the site owner changes script tags or tag-manager triggers using the consent state; automatic blocking, embeds and testing are basic or not described.
5 — Automatic blocking of known scripts and cookies before consent, placeholders for embedded videos and maps, a Google Tag Manager template or integration, and the blocking method documented in the help centre.
8 — Blocking described in depth: an auto-blocking mode and a manual mode with their limits explained, content blockers for named services that the vendor maintains, consent passed to forms, CAPTCHAs and plugins through a JavaScript API or events, server-side tagging supported, and instructions to test in the browser or a tag-manager preview that nothing loads before consent.
10 — Prior blocking the site owner can verify: an automated check or monitor that reports scripts and cookies set before consent on the live site, alerts when a new tracker bypasses the banner, blocking covering local storage, fingerprinting and pixels as well as cookies, and the method published so an auditor can follow it.
The Data Protection Officer
Prior blocking is documented in both an automatic and a manual mode: non-necessary cookies are blocked until consent with only consented categories activated afterwards, the scanner's category groups are what the scripts enforce, individual cookies and trackers can be blocked, and manual control runs through a Google Tag Manager template with a named custom-event trigger for consent updates. We found no public information on placeholders for embedded videos and maps, server-side tagging, consent signals passed to forms or CAPTCHAs, or any documented method for the site owner to verify on the live site that nothing loads before the click. 2 5 10 11
The Agency Developer
Automatic blocking of non-necessary cookies until consent, blocking mapped into functional groups by the scanner, and a Google Tag Manager template with a documented cookie consent update custom event for triggers are all public. We found no public information on placeholder content blockers for YouTube and Maps embeds, a JavaScript API that forms and plugins can call, server-side tagging, or instructions to verify in the browser that nothing fires before consent. The auto-blocking and GTM story is real; the embeds and API documentation are exactly what I would still need. 2 10 11 5 9
The Publisher Marketing Lead
Non-necessary cookies are blocked automatically until consent, the scanner maps trackers so scripts fire only for consented functional groups, and there is a Google Tag Manager template with a consent-update trigger event — solid baseline control for a news site, already included on the free tier. We found no public information on placeholders for embedded videos, maps and social embeds, on server-side tagging, on consent passed to forms and plugins, or on instructions to verify in the browser that nothing loads before consent. 2 5 10 11 15
The In-House Lawyer
Automatic blocking of non-necessary cookies until consent, with only the consented categories activated afterwards, individual blocking of single cookies and trackers, scripts blocking trackers into functional groups, and a Google Tag Manager template driven by a consent-update trigger event are all documented. We found no public information on placeholders for embedded videos and maps, server-side tagging, consent hand-off to forms and CAPTCHAs, or a documented self-check that nothing loads before consent. 2 5 10 11
The WordPress Webmaster
Automatic blocking of non-necessary cookies until consent, activating only the categories the visitor allowed, is documented, together with a Google Tag Manager template, a Standard Tag and a documented custom event for triggers, and the two-script setup is explained on the vendor's own pages. For my YouTube embeds and Maps block I found no public information on content-blocker placeholders, and nothing on passing consent to forms or reCAPTCHA, server-side tagging, or a documented way to verify in the browser that nothing fires before consent. 2 10 11 15 5
The Skeptic
Automatic blocking before consent is stated plainly — non-necessary cookies blocked until consent, then only consented categories activated — with individual per-cookie blocking, blocking into functional groups, and a Google Tag Manager template plus a documented consent event for custom triggers. We found no public information on placeholders for embedded videos or maps, server-side tagging, consent passed to forms or CAPTCHAs, or a documented way to test that nothing loads early — and 'automatic' stays a claim until those test steps are published. 2 10 11 5
Scanning & cookie classification
Show reasoningHide reasoning
How this is scored
How the product knows what the site sets: a scanner that crawls the site for cookies, local storage, pixels and third-party requests, scheduled rescans, a maintained database that classifies cookies and services by purpose, provider and lifetime, alerts on new or changed trackers, and a cookie declaration or policy section that updates itself from the scan.
0 — No scanning and no cookie list; every service is entered and described by the site owner from scratch.
3 — A one-off scan or a list of services the site owner fills in, with some predefined templates; scheduled scans, classification and the declaration are basic or not described.
5 — A scanner that finds cookies and third-party services on the site, regular rescans, automatic classification into categories from a vendor database, and a cookie declaration generated from the result and kept on the site.
8 — Scanning described in depth: scheduled scans with a stated depth or page count, scanning behind logins or in different regions, local storage and pixels as well as cookies, a large maintained database of services with purposes, providers and lifetimes, email alerts on new or changed trackers, and the declaration updated automatically in several languages.
10 — The cookie list stays true without manual work: continuous monitoring of the live site with a change history, unknown trackers flagged for review rather than silently classified, the classification sources and update process published, and scan reports exportable for an audit.
The Data Protection Officer
The scanner is documented in depth: patented deep scanning of first- and third-party cookies and third-party requests, coverage of HTML5 local storage, IndexedDB, pixel tags and ultrasound beacons, dynamic cookies set during interaction, monthly scans with a daily option, and a cookie declaration populated automatically in more than 47 languages. The declaration shown on the vendor's own site carries an unclassified section alongside the classified counts. We found no public information on scanning behind logins or per region, a stated scan depth, or email alerts when trackers change. 3 5 10 12 13
The Agency Developer
The scanner is documented broadly: patented deep scanning of first- and third-party cookies plus third-party requests, covering local storage, IndexedDB, pixel tags and even ultrasound beacons, monthly rescans with a daily option at +99 € /Mon., automatic categorisation into named categories, and a cookie declaration published on the site that even carries an Unclassified bucket rather than hiding unknowns. We found no public information on email alerts for new or changed trackers, a stated scan depth or page count, or scanning behind logins. A tracker a client added on Friday gets caught at the next monthly pass, or daily if they pay for the add-on. 12 3 5 13 10
The Publisher Marketing Lead
Scanning is described in real depth: patented deep scanning of first- and third-party cookies and third-party requests, local storage, IndexedDB, pixel tags and even dynamic cookies set during interaction, monthly rescans with a daily paid option, automatic categorisation, and a cookie declaration in 47-plus languages generated from the scan with per-cookie providers and lifetimes. We found no public information on email alerts when new or changed trackers appear, on scan depth or page counts, or on a change history of the live site. 3 4 10 12 13
The In-House Lawyer
A patented deep scanner detecting first- and third-party cookies, third-party requests, HTML5 local storage, IndexedDB, pixel tags and dynamic cookies, monthly automatic scans with a priced daily option, automatic classification into named purposes together with providers, and a cookie declaration generated from the scan and published on the site in over 47 languages. We found no public information on email alerts when trackers change, on a stated scan depth, or on scanning behind logins or from different regions. 3 5 10 12 13
The WordPress Webmaster
The scanner uses patented deep scanning to find first- and third-party cookies, local storage, pixel tags and even dynamic cookies set during interaction, classifies them automatically with providers and lifetimes shown in the declaration that lives on the site, and monthly rescans are standard with daily scans available. I found no public information on alerts when new or changed trackers appear, on scanning behind logins, or on a stated scan depth, so keeping the list true between scans is on me. 12 3 10 13 5
The Skeptic
The scanner is documented in real depth: deep scanning of first- and third-party cookies and third-party requests, local storage, IndexedDB, pixel tags and beacons, dynamic cookies set during interaction, monthly rescans with a daily option priced at +99 €/month, automatic categorisation, and a cookie declaration published on the site in 47+ languages — their own declaration even shows an 'Unclassified (13)' bucket instead of hiding unknowns. We found no public information on stated scan depth or page count, scanning behind logins, or email alerts on new or changed trackers. 12 13 3 10 5
Consent records & proof
Show reasoningHide reasoning
How this is scored
What the site owner can show afterwards: a record per consent with time, pseudonymous ID, the choices made and the banner version shown, how long records are kept and where, export of the consent log, re-consent when the services or texts change, consent expiry, records available to the visitor (a consent ID), and proof that withdrawal took effect.
0 — No record of consent is kept anywhere; the choice lives only in the visitor's browser.
3 — Consent stored in a cookie with a simple log or counter; per-visitor records, retention, export and banner versions are basic or not described.
5 — A consent log with a record per consent (time, pseudonymous ID, choices), a retention period stated, export of the log as a file, and the banner asking again when the configuration changes.
8 — Proof described in depth: each record tied to the banner version and texts shown, a consent ID the visitor can look up, retention and storage location stated, consent expiry configurable, withdrawal recorded as its own event, cross-domain or cross-device consent recorded consistently, and the log searchable and exportable through an API.
10 — Records built for a dispute: a tamper-evident or audit-proof log, every record reproducible with the exact banner and texts the visitor saw, documentation on how to answer a supervisory authority's request, and the full log exportable in an open format when the customer leaves.
The Data Protection Officer
Consent choices are recorded and securely stored for future visits and in the event of an audit by data protection authorities, documentation of consents runs up to 12 months with end-user data deleted after 12 months, all consents export as CSV including categories, visitors receive a consent ID and date to cite, consent expiry is configurable, and cross-domain consent sharing is documented. For answering a supervisory authority the gaps matter: we found no public information tying each record to the banner version and texts the visitor actually saw, no withdrawal recorded as its own event, and no export through an API. 5 7 8 9 13
The Agency Developer
Consent documentation runs with a stated retention of up to 12 months, CSV export of all consents including categories, configurable expiry (up to 1 month free, up to 12 months premium), a consent ID visitors are asked to cite, cross-domain consent sharing, and a data copy available before cancellation. We found no public information on records tied to the exact banner version and texts shown, withdrawal logged as its own event, or searching the log through an API. Good enough for client audits, not dispute-grade. 5 13 8 7
The Publisher Marketing Lead
Consent logs with retention up to 12 months, CSV export including categories, a consent ID the visitor can quote when complaining, configurable consent expiry up to 12 months and cross-domain consent sharing are all documented — enough for the basic proof an auditor asks of my shop. We found no public information on each record being tied to the banner version and texts shown, on withdrawal recorded as its own event, on re-consent when the configuration changes, or on API access to the log. 5 7 8 9 13
The In-House Lawyer
Consent documentation is kept up to twelve months, exportable as a CSV including the categories chosen, with a consent ID the visitor can cite when making contact, configurable expiry from one to twelve months, cross-domain consent sharing, and storage described as being available for an audit by data protection authorities. For a dispute I would still want more: we found no public information on each record being tied to the exact banner version and texts shown, on withdrawal being recorded as its own event, or on tamper-evidence of the log, though a data copy can be requested before cancellation. 5 7 8 9 13
The WordPress Webmaster
Consent logs with a consent ID and date, retention up to 12 months, configurable consent expiry (one month free, up to twelve paid), CSV export of all consents including categories, and cross-domain consent sharing are all documented, and the consent is stored for audits by data protection authorities. I found no public information on records tied to the banner version and texts shown, withdrawal recorded as its own event, or searching the log through an API. 5 13 8 9
The Skeptic
Consents are recorded and stored with an audit purpose stated, retention documented (up to 12 months), CSV export of all consents including categories, configurable consent expiry, a consent ID that visitors are asked to cite, and cross-domain consent sharing. We found no public information on records carrying the banner version and texts shown, withdrawal logged as its own event, or API access to search the log — exactly the things I would want in hand the day a supervisory authority writes. 8 5 13 7
Frameworks, signals & platforms
Show reasoningHide reasoning
How this is scored
Where the consent goes and where the product runs: the IAB Transparency and Consent Framework (TCF, current version) with a registered CMP ID, Google Consent Mode v2 and Google's CMP certification, Microsoft UET consent mode and other ad-platform signals, the Global Privacy Platform and Global Privacy Control for US laws, plugins and apps for WordPress, Shopify, TYPO3 and other systems, iOS and Android SDKs, connected TV, multi-domain and agency accounts, and an API.
0 — No consent signal is passed on; other tools cannot read the visitor's choice.
3 — Consent readable through a cookie or a JavaScript variable, perhaps one CMS plugin; TCF, Consent Mode, app SDKs and multi-site management are basic or not described.
5 — Google Consent Mode v2 supported with the vendor named as a Google-certified CMP, IAB TCF supported, plugins or integrations for several named CMS and shop systems, a JavaScript API, and several domains manageable from one account.
8 — Signals and platforms described in depth: a registered IAB Europe CMP ID and the current TCF version, Google Consent Mode v2 in basic and advanced mode, Microsoft UET consent mode and other named ad signals, GPP and GPC for US states, iOS and Android SDKs documented, agency or partner accounts managing many client sites, and a REST API for configuration.
10 — One consent across every channel: web, apps and connected TV under one configuration, consent shared across domains and logged-in devices, every signal (TCF, Consent Mode, GPP, ad platforms) documented with its mapping to the banner choices, and configuration exportable or managed as code.
The Data Protection Officer
Signal coverage is broad: Google Consent Mode v2 including advanced mode with the Google Gold Tier certification, Microsoft UET and Clarity consent modes, Amazon consent signals, Global Privacy Control, and IAB TCF with the captured pages giving different figures, 2.3 and 2.4. Plugins or guides cover a dozen CMS and shop systems including WordPress, Wix and Shopify, alongside a Google Tag Manager template, multi-domain configuration and a partner programme. We found no public information on a registered IAB Europe CMP ID, the Global Privacy Platform, platform-specific iOS or Android SDKs beyond a generic API-and-SDK mention, or a REST API for configuration. 2 3 4 5 11 14
The Agency Developer
Google certification (Gold Tier, Golden Badge) with Consent Mode v2 in basic and advanced mode, Microsoft UET and Clarity consent modes, Amazon consent signals and GPC are all documented, alongside TCF support — the captured pages give different figures for the TCF version, 2.3 on the features page and 2.4 on the IAB and pricing pages — a WordPress plugin, Wix and Shopify apps, guides for TYPO3 and nine other systems, multi-domain management and a partner/reseller programme. We found no public information on a registered IAB CMP ID, GPP, dedicated iOS or Android SDKs, or a REST API for configuration. It covers the three systems I run; the app and API side stays vague. 2 3 5 14 11 4 13
The Publisher Marketing Lead
Google lists it as a certified CMP with the Golden Badge, Consent Mode v2 activates automatically with advanced mode, conversion modeling and the new ad user data and ad personalization signals — the part that protects my Google Ads conversions — alongside Microsoft UET, Microsoft Clarity and Amazon consent signals and Global Privacy Control. The captured pages give different figures for the TCF version, citing both 2.3 and 2.4; we found no public information on a registered IAB CMP ID number, iOS or Android SDKs, GPP, or a documented REST API. 2 3 4 5 8 11 14
The In-House Lawyer
Google Consent Mode v2 with Google-certified CMP status and automatic activation, an optional IAB TCF integration (the captured pages give different figures for the version, naming 2.3 and 2.4), Microsoft UET and Clarity consent modes, Amazon consent signals, Global Privacy Control, plugins for WordPress, Wix and Shopify plus CMS guides for twelve further systems, multi-domain and cross-device consent, and a reseller programme are all documented. We found no public information on a registered IAB Europe CMP ID, on the Global Privacy Platform, or on named iOS and Android SDKs. 2 3 4 11 14
The WordPress Webmaster
Google Consent Mode v2 with Gold Tier certification, IAB TCF 2.4 as an optional add-on, Microsoft UET and Clarity consent modes, Amazon consent signals and GPC are all documented, alongside a WordPress plugin, Wix and Shopify apps, an Umbraco app, guides for a dozen CMSs, multi-domain configuration and a partner/reseller programme. I found no public information on a registered IAB CMP ID number, GPP, documented iOS and Android SDKs, or a REST API, so app and connected-TV coverage stays open. 2 3 11 14 4
The Skeptic
Signals are strong: Google Consent Mode v2 in basic and advanced mode with Google-certified (Golden Badge) CMP status, Microsoft UET and Clarity consent modes, Amazon consent signals, GPC, IAB TCF, and guides for a dozen named CMS systems plus WordPress, Wix, Shopify and Umbraco apps. But no registered IAB Europe CMP ID appears on any captured page, the captured pages give different figures for the TCF version (2.3 and 2.4), TCF is an optional integration paid from the entry paid tier, and we found no public information on documented iOS or Android SDKs or a REST configuration API. 2 3 14 11 5 15
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the banner script is served from, where consent logs and scan results are stored, and who the subprocessors are (hosting, CDN, geolocation, scanner infrastructure, app SDK telemetry, email and support). Independently sourced by the sovereignty pipeline; a CMP runs on every page of the customer's site and sees every visitor, so the whole chain counts, not only the database. For a plugin that runs on the customer's own server, the vendor's licence, update and scanner services are the chain.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN for the banner script, geolocation, scanner, analytics, support) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, banner script and consent logs served and stored in the EU, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, CDN and every subprocessor, or a self-hosted option that keeps the banner and the logs on the customer's own server; data export and deletion documented, and certifications published with their scope rather than implied.
The Data Protection Officer
The contracting entity is proven European: Usercentrics A/S, registered in Denmark with a Copenhagen address, and a data processing agreement is published alongside ISO 27001, ISO 27701 and SOC 2 Type 2, with EU standard contractual clauses or binding internal rules stated for transfers and a data copy available before termination. The chain beyond the entity is undocumented: the captured pages state no hosting location for the banner script and consent logs, name no subprocessors with locations, and list group companies including a US-incorporated Usercentrics Inc. among those data is shared with. 2 6 7 10
The Agency Developer
The contracting entity is clearly European — Usercentrics A/S, Havnegade 39, Copenhagen, with the company registration number stated — and a data processing agreement plus ISO 27001, ISO 27701 and SOC 2 Type 2 certifications are published, with EU standard contractual clauses named as the safeguard for transfers inside a group that includes Usercentrics Inc. We found no public information on where the banner script is served from, where consent logs and scan results are stored, or any named subprocessors such as CDN, geolocation or scanner infrastructure. Entity and safeguards are proven; the rest of the chain is not, which matters when the script sits on every page of every client site. 6 7 2 10
The Publisher Marketing Lead
The contracting entity is Usercentrics A/S in Copenhagen with a published registration number, a data processing agreement, ISO 27001, ISO 27701 and SOC 2 Type 2 stated, EU standard contractual clauses for third-country transfers, and a data copy available before cancellation — a good start on the chain. We found no public information on where the banner script, consent logs and scan results are hosted or on the subprocessors involved; the privacy policy names group companies, including a US-incorporated one, that data is shared with. 2 6 7 14
The In-House Lawyer
The legal notice and privacy policy name Usercentrics A/S, registered in Denmark with a company registration number and a Copenhagen address, publish a data processing agreement in the footer, and state EU standard contractual clauses plus binding internal rules for transfers to third countries, alongside ISO 27001, ISO 27701 and SOC 2 Type 2 certifications. The load-bearing links of the chain are unproven for a tool that sees every visitor: we found no public information on where the banner script and the consent logs are hosted, or on the subprocessors and their locations. 2 6 7 8
The WordPress Webmaster
The contracting entity is Usercentrics A/S, registered in Denmark with a Copenhagen address, a data processing agreement is published, and ISO 27001, ISO 27701 and SOC 2 Type 2 are stated, with EU standard contractual clauses covering data shared with group companies including a US entity. We found no public information on where the banner script is served from, where consent logs and scan results are stored, or which subprocessors sit behind hosting, CDN, geolocation and support, so most of the chain a CMP sees on every pageview remains unverified. 6 7 10 2
The Skeptic
The contracting entity is documented and European (Usercentrics A/S, Denmark, reg. no. 34624607), a data processing agreement is published, ISO 27001, ISO 27701 and SOC 2 Type 2 are stated, and EU standard contractual clauses are named as safeguards — while data is shared within a group that includes a US entity, Usercentrics Inc. We found no public information on where the banner script is served from or consent logs are stored, and no subprocessor list with locations; for a script running on every page of the customer's site, that is the part I want named before signing. 7 6 2 10
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per domain or site licence, the page-view, session or consent limits of each tier and what happens above them, the free tier's limits, which features (TCF, app SDKs, A/B testing, multi-domain, white label) cost extra, agency or reseller terms, minimum term, and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with domains, traffic or features is unclear.
5 — Tiers are public with their price per domain or licence and their main inclusions, but at least one commonly needed piece (traffic overage, extra domains, TCF, app SDKs, agency use) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (per domain, per page view or session band, per site licence), overage and extra domains priced, add-ons listed with prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of domains, traffic and apps, with every add-on, setup, support, overage and agency fee and the cancellation and data-return terms published.
The Data Protection Officer
The billing model is public: prices based on the number of domains and subpages, a free plan limited to one domain and 50 subpages, Premium Lite at 7€ /Monat with its features named, tier boundaries from 50 up to more than 7,000 subpages, automatic upgrades when the scanner finds more subpages, subdomains billed separately, a daily-scan add-on at +99 € /Mon., VAT treatment by customer location, and no minimum term. A buyer still cannot compute the real annual cost from the captured pages: the prices of the tiers above Lite and the per-domain cost are not shown, and agency or reseller terms are not priced. 4 5
The Agency Developer
The scaling basis is public — price per domain plus subpages, tier bands at under 50, 350, 3,500 and 7,000 subpages, automatic upgrade when the monthly scan finds more pages — with Premium Lite at 7€ /Monat, a daily-scan add-on at +99 € /Mon., VAT treatment, no minimum term, and a free tier limited to one domain and 50 subpages. We found no public prices for the Small through Extra-Large bands, extra domains, TCF licensing beyond "paid from the entry paid tier", or agency and reseller terms. I can price a single small site; I cannot compute the annual cost for a forty-domain portfolio from these pages alone. 5 4 15
The Publisher Marketing Lead
The free tier's limits are public — one domain, 50 subpages, with scanning and blocking included — Premium Lite is 7 €/Monat, scaling runs on domains and subpages with automatic upgrades when the scanner finds more pages, the daily-scan add-on is +99 €/Mon., and VAT treatment, the no-contract terms and the 14-day trial without credit card are all stated. We found no public information on the prices of the tiers above Lite or on the cost of additional domains beyond the package minimum, so I cannot compute a full annual cost for my two properties from these pages. 4 5 15
The In-House Lawyer
The free plan's limits are public — one domain, up to fifty subpages — Premium Lite is priced at 7 € per month, the billing basis in domains and subpages with automatic upgrade when the scanner finds more subpages is explained, VAT treatment and the no-contract, anytime-cancellation terms are stated, and the daily scan add-on costs +99 € per month. We found no public information on the prices of the Small, Medium, Large and Extra Large tiers, on per-domain pricing, or on the optional TCF integration, so the real annual cost above Lite cannot be computed. 3 4 5
The WordPress Webmaster
The free tier is fully specified (one domain, 50 subpages, with automatic scanning and blocking), the entry price is Premium Lite at 7€ /Monat, and the scaling by domains and subpages, automatic upgrade when the scanner finds more pages, separate subdomain billing, no-contract cancellation, VAT treatment and the daily-scan add-on at +99 € /Mon. are all public. But only the Lite price is published — the Small to Extra Large tiers show subpage limits without prices — and agency programme terms and the survey and benchmark add-ons carry no public figures, so I cannot compute the annual cost for a site of several hundred pages without asking. 5 4 15
The Skeptic
The free tier's limits are public (one domain, 50 subpages, one language), Premium Lite is 7 €/month, the scaling basis is explained (domains plus subpages, tiers by subpage count, automatic upgrade when the scan finds more subpages, subdomains billed separately), VAT treatment is stated, there is no minimum term, and the daily-scan add-on is priced at +99 €/month. But we found no public prices for the tiers above Lite, none for the Audience Survey or consent-rate benchmark add-ons or the enterprise tier, and no agency or reseller terms — so a buyer above 50 subpages cannot compute their annual cost from these pages alone. 4 5 15
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Cookiebot
Is Cookiebot European?
Yes. whats-best.ai classifies Cookiebot as EU-Made.
Where does Cookiebot store data?
Not stated on the vendor’s pages as of 29 Oct 2026.
Does Cookiebot have a free plan?
Yes. Cookiebot has a free plan, per the vendor’s page captured 29 Oct 2026.
What are the best alternatives to Cookiebot?
As of 3 Nov 2026, the panel rates Usercentrics CMP (3.5/5), Didomi (3.5/5) and CCM19 (3.5/5) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Usercentrics CMP (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Cookiebot alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 25 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (15)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.cookiebot.com Checked 29 Oct 2026 Details →
- 2 Features page (cookie consent) www.cookiebot.com Checked 29 Oct 2026 Details →
- 3 Features page (IAB TCF) www.cookiebot.com Checked 29 Oct 2026 Details →
- 4 Features page (Google Consent Mode) www.cookiebot.com Checked 29 Oct 2026 Details →
- 5 Pricing page www.cookiebot.com Checked 29 Oct 2026 Details →
- 6 Legal notice www.cookiebot.com Checked 29 Oct 2026 Details →
- 7 Privacy policy www.cookiebot.com Checked 29 Oct 2026 Details →
- 8 Banner & choice architecture — found from sitemap www.cookiebot.com Checked 29 Oct 2026 Details →
- 9 Banner & choice architecture — found from sitemap www.cookiebot.com Checked 29 Oct 2026 Details →
- 10 Prior blocking & script control — found from sitemap www.cookiebot.com Checked 29 Oct 2026 Details →
- 11 Prior blocking & script control — found from sitemap www.cookiebot.com Checked 29 Oct 2026 Details →
- 12 Scanning & cookie classification — found from sitemap www.cookiebot.com Checked 29 Oct 2026 Details →
- 13 Scanning & cookie classification — found from sitemap www.cookiebot.com Checked 29 Oct 2026 Details →
- 14 Frameworks, signals & platforms — found from sitemap www.cookiebot.com Checked 29 Oct 2026 Details →
- 15 Frameworks, signals & platforms — found from sitemap www.cookiebot.com Checked 29 Oct 2026 Details →