# Cookiebot — Consent Management (CMP) Cookiebot by Usercentrics A/S holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-10-30. Provenance: EU-Made; sovereignty: not determined. - Vendor: Usercentrics A/S (https://www.cookiebot.com/de/) - Category: [Consent Management (CMP)](https://whats-best.ai/software/consent-management.md) - Provenance (editorial classification): EU-Made - Canonical page: https://whats-best.ai/software/consent-management/cookiebot - Alternatives: https://whats-best.ai/software/consent-management/cookiebot/alternatives ([markdown](https://whats-best.ai/software/consent-management/cookiebot/alternatives.md)) - Data as of: 2026-11-04 · evaluated 2026-10-30 · oldest source captured 2026-10-29 **AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology ## At a glance - Vendor: Usercentrics A/S - Headquarters: Not stated on the vendor’s pages as of 29 Oct 2026 - Data hosting: Not stated on the vendor’s pages as of 29 Oct 2026 - Free plan: Yes, per the vendor’s own page [S4] ## The panel's verdict Cookiebot, a consent management platform from Usercentrics A/S of Denmark (reg. no. 34624607), scored highest on banner and choice at 7 to 8, with scanning and classification and standards and platforms each at 7, and lowest on sovereignty. Judges credit deep scanning of first- and third-party cookies, local storage, IndexedDB, pixel tags and dynamic cookies, monthly rescans with a daily option at +99 €/month, and signal coverage from Google Consent Mode v2 with Google-certified (Golden Badge) status to Microsoft UET, Clarity, Amazon signals and GPC. Sovereignty clustered at 4 despite a published data processing agreement and ISO 27001, ISO 27701 and SOC 2 Type 2 certifications: we found no public information on where the banner script is served or consent logs are stored, or on subprocessors, and the privacy policy names group companies including a US-incorporated Usercentrics Inc. The judges split by a point on prior blocking and pricing transparency (5 to 6 each), the lower scores citing undocumented embed and verification details for blocking and missing prices above Premium Lite (7 €/month). **Speaks for it:** - banner and choice scored 7 to 8, documenting accept, reject and customize options, per-category toggles on both layers, withdrawal at any time via the cookie declaration, WCAG 2.2 accessibility, and 47+ languages with browser-language detection - scanning and classification scored 7, with patented deep scanning of first- and third-party cookies, local storage, IndexedDB, pixel tags and dynamic cookies, and monthly rescans with a daily option at +99 €/month - standards and platforms scored 7, documenting Google Consent Mode v2 with Google-certified (Golden Badge) CMP status, Microsoft UET and Clarity consent modes, Amazon consent signals, GPC, and plugins or apps for WordPress, Wix and Shopify - consents are exportable as CSV including categories, retained up to 12 months, with a consent ID visitors can cite and cross-domain consent sharing - the free tier is fully specified at one domain and 50 subpages, Premium Lite is 7 €/month with no minimum term, and the 14-day trial requires no credit card **Held against it:** - sovereignty scored 4: we found no public information on where the banner script is served or consent logs are stored, or on subprocessors and their locations - the privacy policy names group companies, including US-incorporated Usercentrics Inc., among those data is shared with - we found no public prices for the tiers above Premium Lite (7 €/month), so the annual cost above the Lite band cannot be computed from the captured pages - prior blocking scored 5 to 6: we found no public information on placeholders for embedded videos or maps, server-side tagging, or a documented way to verify nothing loads before consent - the captured pages give different figures for the TCF version, naming both 2.3 and 2.4, and we found no public information on a registered IAB Europe CMP ID **Best for:** - You run a small site within one domain and 50 subpages and want automatic scanning and blocking on the free tier - Your ad measurement runs through Google and you need Consent Mode v2 from a Google-certified (Golden Badge) CMP - You serve visitors across regions and languages and need per-region opt-in and opt-out rules with 47+ languages and browser-language detection - You deploy through the WordPress plugin, the Wix or Shopify apps, or the Google Tag Manager template **Avoid if:** - You must keep consent documentation beyond 12 months — documentation of consents runs up to 12 months - You need IAB TCF at no extra cost — it is an optional integration, paid from the entry paid tier - You must document hosting locations and subprocessors before signing — we found no public information on either, and the privacy policy names a US-incorporated group company among those data is shared with - You need to compute the full annual cost for a site above 50 subpages before committing — only Premium Lite's price (7 €/month) is public and the subscription upgrades automatically when the scan finds more subpages ## Scores by judge and criterion Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion. | Criterion | The Data Protection Officer | The Agency Developer | The Publisher Marketing Lead | The In-House Lawyer | The WordPress Webmaster | The Skeptic | | --- | --- | --- | --- | --- | --- | --- | | Banner & choice architecture | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 | | Prior blocking & script control | 3/5 | 2.5/5 | 2.5/5 | 3/5 | 3/5 | 2.5/5 | | Scanning & cookie classification | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | | Consent records & proof | 3/5 | 3.5/5 | 3/5 | 3/5 | 3/5 | 3/5 | | Frameworks, signals & platforms | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | | European sovereignty | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | | Pricing transparency | 3/5 | 3/5 | 3/5 | 2.5/5 | 2.5/5 | 3/5 | | **Weighted verdict** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** | ### The judges - **The Data Protection Officer** (v1.0): External DPO for a dozen mid-sized companies, two of which received a letter from a state supervisory authority about their cookie banner last year. Wants reject on the first layer, nothing loaded before the click, a consent log that shows which banner version each visitor saw, a cookie list that matches the site, and a DPA and subprocessor list that keep visitor data in the EU. - **The Agency Developer** (v1.0): Lead developer at a web agency that maintains forty client sites on WordPress, TYPO3 and Shopify. Wants one account for every client, blocking that works without rewriting each theme, content blockers for YouTube and Maps, a Tag Manager template, a scanner that flags the tracker a client added on Friday, and a JavaScript API documented well enough that forms and plugins can ask for consent. - **The Publisher Marketing Lead** (v1.0): Runs marketing for an ad-funded news site and an online shop in the same group, where every point of consent rate shows up in ad revenue and in Google Ads conversions. Wants a registered IAB TCF CMP, Google Consent Mode v2 in advanced mode, banner tests within what the law allows, consent shared between the site and the app, and a dashboard that shows where visitors drop off. - **The In-House Lawyer** (v1.0): In-house counsel at a retailer with shops in Germany, France and Austria, who has read the court decisions on missing reject buttons and the regulators' banner guidance. Wants § 25 TDDDG and the GDPR mapped to concrete settings, equal-weight choices as the default, consent that can be withdrawn as easily as it was given, and records that would hold up if a competitor or a consumer group sued. - **The WordPress Webmaster** (v1.0): Looks after the WordPress site of a mid-sized engineering company on top of the actual job, with Google Analytics, a YouTube channel, a Maps embed and a contact form with reCAPTCHA. Wants a plugin that finds these by itself, blocks them until the visitor agrees, survives the next plugin update and caching, and costs a known amount per site per year without a call to sales. - **The Skeptic** (v1.0): Has opened the browser's network tab on sites with a "certified" banner and watched the ad pixels fire before anything was clicked. Reads "consent rate optimisation" as a hint that reject will be grey and small, "auto-blocking" as a claim until the test steps are published, and "EU hosting" next to a US script CDN — and asks what leaving would cost: the consent logs, and every visitor asked again. ## European sovereignty — proven facts Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined. | Dimension | Finding | Points | Source | |---|---|---|---| | Legal entity | Not determined | — | — | | Hosting location | Not determined | — | — | | Hosting options | Not determined | — | — | | Open source | Not determined | — | — | | Data processing agreement | Not determined | — | — | | Transfer impact assessment | Not determined | — | — | ## Key facts Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources). **Compliance** - Accessibility: 2.2 · yes [S2] - Article disclaimer: no [S15] - Certifications: ISO 27001 · ISO 27701 · SOC 2 Type 2 · HIPAA · yes [S2] - Children under 13: 13 [S7] - Compliance test: yes [S3] - Consent legal basis: Art. 6 (1) (f) · Art. 6 (1) (a) [S13] - DPA: yes [S5] - DPA: DPA available in footer [S10] - DPA available: yes [S4] - DPA available: yes [S11] - Gpc: yes [S7] - No personal data sale third parties: no [S7] - Regulations: yes · yes · yes [S4] - Ut no sale: no [S7] **Data** - Account deletion selfservice: yes [S7] - Account retention: bis zu fünf volle Steuerjahre nach Kündigung [S7] - Chat deletion: 14 [S7] - Config deletion: yes [S7] - Customer data categories: Konto-Daten · Konfigurationsdaten · Systemgenerierte Daten · E-Mail, Name, Firma, Adresse, Telefon, USt-ID, Sprache, Währung, Bestellnummer, maskierte Zahlungsdaten [S7] - Enduser retention: 12 [S7] - Government requests: yes [S7] - Logfile retention: 7 [S7] - Real cookie banner storage: yes [S15] - Return on termination: yes [S7] - Scan processing: E-Mail-Adresse · Definitionen der erkannten Cookies · Scan-Berichte [S7] - Third country transfers: EU-Standardvertragsklauseln · verbindliche interne Datenschutzvorschriften [S7] - Wplp storage: yes [S15] **Hosting** - Group entities: Usercentrics A/S · Usercentrics GmbH · Cybot A/S · Usercentrics Unipessoal · Usercentrics Inc. [S7] - Legal entity: Usercentrics A/S · Denmark · 34624607 [S14] **Integrations** - Analytics and cms: GA4 · Shopify · WordPress [S11] - Cms: Wix · WordPress · Shopify · 30+ [S2] - Cms: WordPress · Wix · Shopify [S12] - Cms guides: Adobe Experience Manager · BigCommerce · Drupal · Hubspot · Magento · Prestashop · Shopify · Squarespace · Typo3 · WIX · Webflow · WordPress [S4] - Cms plugins: WordPress · Wix [S9] - Consent modes: yes · yes · yes · yes · yes [S2] - Google tag manager: yes [S5] - Gtm: yes [S2] - Iab tcf: 2.4 · yes [S4] - Iab tcf: yes [S5] - Implementation methods: yes [S4] - Shopify: yes [S8] - Shopify: Shopify · yes [S10] - Wix app: yes [S8] - Wix app: yes [S5] - Wix app: Wix · yes [S10] - Wix app: Usercentrics for Wix app · yes [S13] - Wordpress plugin: yes [S8] - Wordpress plugin: yes [S5] - Wordpress plugin: WordPress · yes [S10] - Wordpress plugin: Usercentrics Cookiebot plugin for WordPress · yes [S13] **Legal** - Company: Usercentrics A/S · Denmark · 34624607 [S8] - Company: Usercentrics A/S · Denmark · 34624607 [S5] - Company registration: Usercentrics A/S · 34624607 · Denmark [S10] - Company registration: Usercentrics A/S · Denmark · 34624607 [S13] - Controller: Havnegade 39, 1058 Kopenhagen, Dänemark · Usercentrics A/S [S7] - DPA available: yes [S14] - DPA available: Data Processing Agreement linked in footer [S13] - DPA link: yes [S8] - Entity: Denmark · Usercentrics A/S · 34624607 [S3] - Entity: Usercentrics A/S · Denmark · 34624607 [S4] - Entity: Usercentrics A/S · Denmark · 34624607 [S9] - Entity: Usercentrics A/S · Denmark · 34624607 [S12] - Entity name: Usercentrics A/S · Havnegade 39, 1058 Kopenhagen, Dänemark [S6] - Imprint scope: Impressum gilt für alle Cookiebot-Webseiten und Social-Media-Accounts [S6] - Jurisdiction: Dänemark · 34624607 [S6] - Legal entity: Usercentrics A/S · Denmark · 34624607 [S11] - Registration number: DK34624607 [S6] - Registration number: DK34624607 [S7] **Pricing** - Auto upgrade: yes [S5] - Billing model: number of domains · number of subpages [S5] - Complianz free: yes [S15] - Cookieyes free: 1 · 5000 [S15] - Daily scan addon price: monthly · 99 [S5] - Free plan: Free · 1 · 50 · yes · yes · 0 [S4] - Free tier: yes [S3] - Free tier: Free · unlimited · 1 · 50 [S5] - Free trial: 14 [S3] - Free trial: yes [S11] - Iubenda free: no · 1000 [S15] - Moove premium: 72 [S15] - No contracts: no · no · yes [S5] - Payment methods: PayPal · Visa · Mastercard · Maestro · JCB · Discover · American Express · Dankort [S5] - Premium lite: Premium Lite · EUR · 7 [S4] - Premium lite features: banner_design · branding_logo · multi_domain_management · advanced_reports · 47_plus_languages · regional_banner_delivery [S4] - Premium tiers: Lite · 50 · Small · 350 · Medium · 3500 · Large · 7000 · Extra Large [S5] - Real cookie banner pro: 1 · 67 [S15] - Small tier domains: Small · 50-349 · 4 [S5] - Termly free: 1 · 10000 [S15] - Trial: 14 · yes · yes [S4] - Trial: yes · 14 [S2] - Trial: 14 · no [S5] - Trial no credit card: no [S4] - Trial tier recommendation: subpages · yes [S4] - VAT treatment: local VAT · no VAT · reverse charge (not Denmark) [S5] - Wplp free: unlimited [S15] **Product** - Ad settings panel: Ad Settings [S3] - Addon benchmark: Consent Rate Benchmark · industry consent rate comparison [S5] - Addons: Add-ons based on same Consent data and script; current add-on is Audience Survey [S2] - Addons: Audience Survey · visitor source survey [S5] - Admin interface languages: English · French · German · Spanish · Italian [S9] - Admin language change: Account Settings · under a minute [S9] - Admin localization scope: menus · configuration labels · tooltips · system messages · reports · no [S9] - Advanced features: Advanced tier: advanced consent personalization, role management, enterprise support, analytics/reporting, API & SDK integrations, custom compliance configuration [S2] - Advanced languages: 60+ · yes · yes · yes [S2] - Aggregated statistics: aggregierte Einwilligungsstatistiken mit grafischer Darstellung im Service Manager [S7] - Article topic: Ranked comparison of ten WordPress cookie consent plugins for 2026 [S15] - Audience segments: self-employed/small businesses · marketing & growth teams · agencies & web professionals [S2] - Auto blocking: blocks non-necessary cookies until consent, then activates only consented categories [S2] - Automatic categorization: necessary · functional · analytics · performance · advertising [S12] - Automatic scan categorization: yes [S4] - Automatic scanner: automated scan of cookies and trackers, populates banner and declaration [S10] - Automatic scans: yes [S11] - Banner button options: Accept · Reject · Customize [S8] - Banner button versions: three-button · two-button · one-button [S8] - Banner consent choices: Deny · Customize · Allow all [S13] - Banner customization: CSS · HTML · JavaScript [S4] - Banner customization: customizable content, elements, colors, branding [S2] - Banner customization: HTML · CSS · JavaScript [S5] - Banner language autodetect: yes · yes [S9] - Banner language config: yes · yes · yes [S9] - Banner languages: 47 [S9] - Banner layouts: Dialog · Leiste · Kompakt [S5] - Banner logo customization: yes · yes [S8] - Banner mobile optimized: yes [S8] - Banner toggles: first · second [S8] - Blocking by group: scripts block cookies into functional groups [S10] - Capabilities: yes · yes · yes · yes [S9] - CCPA framework support: yes [S3] - Cms plugins: yes · yes [S3] - Competitor comparison: yes [S9] - Complianz consent mode: paid · paid [S15] - Consent decline stat: EU consent rate declines 40-54% when visitors reject cookies · 40 · 54 [S2] - Consent dialog script: consent dialog script manages the prior consent banner required by GDPR [S10] - Consent documentation retention: up to 12 months [S5] - Consent expiry free: 1 month · 12 months [S5] - Consent id tracking: Consent ID and date recorded for consent contacts [S13] - Consent mode auto activation: yes [S4] - Consent mode modeling: yes · yes [S8] - Consent mode signals: ad_user_data · ad_personalization · yes [S14] - Consent mode v2 default: yes [S11] - Consent mode v2 support: V2 · yes [S4] - Consent mode v2 support: yes [S14] - Consent renewal recommendation: 12 · 6 [S3] - Consent scope domains: www.cookiebot.com · admin.cookiebot.com · manage.cookiebot.com · support.cookiebot.com · www.cybot.com · admin.usercentrics.eu · account.usercentrics.eu [S13] - Consent state cookie duration: HTTP Cookie · 1 year [S13] - Consent storage: future visits · audit · yes [S8] - Consent sync: automatische Übertragung der Endnutzer-Einwilligung auf andere Webseiten des Kunden [S7] - Consent withdrawal: Users can at any time change or withdraw consent via the Cookie Declaration [S13] - Conversion modeling: yes · yes [S4] - Cookie categorization: yes · necessary · preferences · statistics · marketing [S2] - Cookie checker: Cookie checker · yes [S13] - Cookie compliance tcf: no [S15] - Cookie declaration: auto-generates and integrates cookie declaration; cookie policy too [S2] - Cookie declaration: standard · customizable [S5] - Cookie declaration counts: 51 [S13] - Cookie reports: Cookie-Erklärungen und Scan-Berichte [S7] - Cookie scanning: yes · yes · yes [S5] - Cookiebot consent mode: yes [S15] - Cookiebot free plan: 1 · 50 · yes [S15] - Cookiebot history: 2012 · Cybot · 2021 [S15] - Cookiebot regulations: yes · yes · paid_from_entry_tier [S15] - Cookiebot wordpress plugin available: yes [S15] - Cookieyes installs: 1000000 [S15] - Cookieyes tcf: paid [S15] **Support** - Channels: email support@cookiebot.com · support ticket [S4] - Channels: yes · email · email [S5] - Developer documentation: yes [S9] - Free SLA: free · trial · 4 business days (32 business hours) [S4] - Google escalation: forward consent mode support requests to Google CMP Support · yes [S4] - Help center and tickets: Help Center · technical support ticket · customer care service [S11] - Newsletter double optin: yes [S7] - Premium SLA: L · Lite · M · S · 1 business day (8 business hours) [S4] - Support center: yes [S14] - Training course: Google Consent Mode V2 · yes [S14] - Youtube guide: yes [S11] 98 more facts on the canonical page: https://whats-best.ai/software/consent-management/cookiebot ## Questions ### Is Cookiebot European? Yes. whats-best.ai classifies Cookiebot as EU-Made. ### Where does Cookiebot store data? Not stated on the vendor’s pages as of 29 Oct 2026. ### Does Cookiebot have a free plan? Yes. Cookiebot has a free plan, per [the vendor’s page captured 29 Oct 2026](https://whats-best.ai/evidence/12405). ### What are the best alternatives to Cookiebot? As of 3 Nov 2026, the panel rates [Usercentrics CMP (3.5/5)](https://whats-best.ai/software/consent-management/usercentrics), [Didomi (3.5/5)](https://whats-best.ai/software/consent-management/didomi) and [CCM19 (3.5/5)](https://whats-best.ai/software/consent-management/ccm19) highest among the other 19 Consent Management (CMP) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Usercentrics CMP](https://whats-best.ai/software/consent-management/usercentrics) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Cookiebot alternatives](https://whats-best.ai/software/consent-management/cookiebot/alternatives). ## Head-to-head - [Cookiebot vs CookieYes](https://whats-best.ai/compare/cookiebot-vs-cookieyes.md) ## What this page leaves out - 25 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 8 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 6 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 6 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. - 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. ## Sources - [S1] Vendor homepage: https://www.cookiebot.com/de/ (checked 2026-10-29) - [S2] Features page (cookie consent): https://www.cookiebot.com/de/cookie-consent-loesung/ (checked 2026-10-29) - [S3] Features page (IAB TCF): https://www.cookiebot.com/de/iab-framework/ (checked 2026-10-29) - [S4] Features page (Google Consent Mode): https://www.cookiebot.com/de/cookiebot-cmp-google-consent-mode/ (checked 2026-10-29) - [S5] Pricing page: https://www.cookiebot.com/de/pricing/ (checked 2026-10-29) - [S6] Legal notice: https://www.cookiebot.com/de/legal-notice/ (checked 2026-10-29) - [S7] Privacy policy: https://www.cookiebot.com/de/privacy-policy/ (checked 2026-10-29) - [S8] Banner & choice architecture — found from sitemap: https://www.cookiebot.com/en/cookie-banner/ (checked 2026-10-29) - [S9] Banner & choice architecture — found from sitemap: https://www.cookiebot.com/en/cookiebot-admin-interface-localized-languages/ (checked 2026-10-29) - [S10] Prior blocking & script control — found from sitemap: https://www.cookiebot.com/en/cookie-scripts/ (checked 2026-10-29) - [S11] Prior blocking & script control — found from sitemap: https://www.cookiebot.com/en/google-tag-manager-cookie-consent/ (checked 2026-10-29) - [S12] Scanning & cookie classification — found from sitemap: https://www.cookiebot.com/en/cookie-checker/ (checked 2026-10-29) - [S13] Scanning & cookie classification — found from sitemap: https://www.cookiebot.com/en/cookie-declaration/ (checked 2026-10-29) - [S14] Frameworks, signals & platforms — found from sitemap: https://www.cookiebot.com/en/google-consent-mode-v2-integration/ (checked 2026-10-29) - [S15] Frameworks, signals & platforms — found from sitemap: https://www.cookiebot.com/en/wordpress-cookie-plugin/ (checked 2026-10-29) --- Cite as: whats-best.ai, "Cookiebot — Consent Management (CMP)", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/consent-management/cookiebot Corrections: https://whats-best.ai/correct/1151?target=page