# Borlabs Cookie — Data Protection

Borlabs Cookie by Borlabs GmbH holds a panel rating of 1/5 from 6 AI judges (category median 2.5/5), as of 2026-10-21. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: Borlabs GmbH (https://de.borlabs.io)
- Category: [Data Protection](https://whats-best.ai/software/data-protection.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/data-protection/borlabs-cookie
- Alternatives: https://whats-best.ai/software/data-protection/borlabs-cookie/alternatives ([markdown](https://whats-best.ai/software/data-protection/borlabs-cookie/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-21 · oldest source captured 2026-10-20

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Borlabs GmbH
- Headquarters: Not stated on the vendor’s pages as of 20 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 20 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 20 Oct 2026

## The panel's verdict

Borlabs Cookie is a WordPress consent plugin from Borlabs GmbH, scored strongest on integrations and automation, where the computed range runs 4 to 4 on a documented JavaScript API v3, PHP API and WP-CLI support, and on sovereignty, credited to a verifiable German entity — Amtsgericht Hamburg, HRB 171030 — development within the EU, and an architecture that keeps all visitor data on the customer's own server with none transmitted to the vendor. Weakest are privacy management, rights and incidents and audit readiness: the captured pages document consent banners, content blockers, a sample privacy-statement text and IAB TCF labeling ('Non-TCF Standard'), but we found no public information on processing registers, data subject request workflows, breach registers or revision-safe audit evidence. Framework coverage rests on that single consent regime. Despite score spreads on sovereignty and framework coverage, the flagged splits report none. Orders run through Paddle.com as merchant of record, whose jurisdiction the captured pages do not state; a starting price of 'Ab 49 Euro' is published, excluding VAT.

**Speaks for it:**
- Documented JavaScript API v3, PHP API and WP-CLI integration earn integrations and automation scores that run 4 to 4.
- Sovereignty scores of 4–6 credit Borlabs GmbH (Amtsgericht Hamburg, HRB 171030), development within the EU, and all visitor data kept on the customer's own server with none transmitted to the vendor.
- IAB TCF support is operationalized, with non-TCF service groups labeled 'Non-TCF Standard' once TCF is enabled.
- A starting price of 'Ab 49 Euro' is published, stated as excluding VAT, with anytime cancellation and a 30-day money-back guarantee.

**Held against it:**
- Privacy management scores of 0–2: we found no public information on processing registers, DPIA workflows, processor management or technical and organizational measures.
- Rights and incidents scores of 0–1: we found no public information on data subject request intake, statutory deadline tracking, a breach register or deletion execution.
- Audit readiness scores of 0–1: we found no public information on revision-safe change history or exportable evidence packs, with one judge finding no public information on proof-of-consent logging.
- Integrations reach only the WordPress perimeter — we found no public information on directory import, ticketing, single sign-on or a REST API for the wider estate.
- The subprocessor list is available only on request, and all orders run through Paddle.com as merchant of record, whose jurisdiction the captured pages do not state.

**Best for:**
- You run WordPress sites and want consent and content-blocking automation through documented JavaScript, PHP and WP-CLI interfaces.
- You require visitor data to stay on your own server, with none transmitted to the vendor, under a German entity that develops within the EU.
- You need IAB TCF consent handling with non-TCF service groups labeled in the same banner.

**Avoid if:**
- You need a register system — records of processing, DPIA workflows, processor management or technical and organizational measures — rather than a consent plugin.
- You must run data subject request workflows, statutory deadline tracking or a breach register as operations.
- You need auditor-ready evidence such as revision-safe change history or exportable evidence packs.
- You need connectors beyond WordPress — directory import, single sign-on, ticketing or a REST API other systems can call.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v2). "n/r" = not rated: the vendor publishes no price.

| Criterion | The External DPO | The In-House Counsel | The Drafted Generalist | The Lead Auditor | The IT Integrator | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Records & DPIA depth | 0/5 | 1/5 | 0/5 | 0.5/5 | 0.5/5 | 0/5 |
| Data subject rights & incidents | 0/5 | 0/5 | 0/5 | 0/5 | 0.5/5 | 0/5 |
| Privacy regime coverage | 0.5/5 | 1/5 | 0.5/5 | 1.5/5 | 1/5 | 1/5 |
| Audit readiness & evidence | 0/5 | 0/5 | 0/5 | 0.5/5 | 0.5/5 | 0/5 |
| Integrations & automation | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| European sovereignty | 2/5 | 3/5 | 3/5 | 3/5 | 2.5/5 | 2.5/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **0.5/5** | **1/5** | **0.5/5** | **1/5** | **1.5/5** | **1/5** |

### The judges

- **The External DPO** (v2.0): Carries thirty client mandates and bills by the hour they save. Optimizes for multi-client capability, reusable templates, a RoPA that drives the rest, and client-ready reports. Rejects single-tenant tools that treat the consultancy as thirty separate customers.
- **The In-House Counsel** (v2.0): Answers personally when the authority writes. Optimizes for defensibility: request clocks that never slip, a breach workflow that produces the Art. 33 notification, regime coverage that matches where the company actually operates. Rejects tools whose legal content nobody maintains.
- **The Drafted Generalist** (v2.1): Office manager at an 80-employee firm who got compliance added to her job title, not her calendar. Optimizes for guided workflows in plain language and software that knows the law so she does not have to. Rejects consultant-shaped platforms that assume a compliance department.
- **The Lead Auditor** (v2.0): Audits management systems for a living and has seen every folder of screenshots. Optimizes for revision-safe history, evidence packs on demand, and a defensible answer to "show me the state on date X". Rejects systems where the audit trail is assembled the week before the audit.
- **The IT Integrator** (v2.0): Has to feed the compliance platform from the estate that already exists: Entra ID, Jira, the CMDB. Optimizes for directory import, a real API, webhooks and SSO — compliance data that stays current because it syncs, not because someone retypes it. Rejects data islands with a CSV drawbridge.
- **The Skeptic** (v2.1): Hunts certification logos that link nowhere, "AI-powered" features with no substance behind them, consulting bundled as software, legal-update promises with no named lawyer, and customer counts that disagree between pages. Exists to keep the rest of the bench honest.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- AVV access URL: https://service.borlabs.io/data-processing-addendum [S4]
- AVV not required: Alle Daten liegen auf dem Server des Kunden, keine Besucherdaten werden an Borlabs übermittelt · no [S4]
- AVV support access: AVV angeboten, wenn Borlabs im Support auf WordPress/Server zugreift · yes [S4]

**Data**
- Processing location: at vendor's office and locations of involved parties [S3]
- Retention policy: contract data retained until full performance; otherwise as long as purpose requires or legal obligation/cconsent allows [S3]
- Subprocessor list on request: yes [S3]

**Hosting**
- Company location: Deutschland · yes [S4]
- EU development: Team within EU, company seat in Germany [S2]
- EU development: Germany · yes [S8]
- Headquarters: Headquartered in Germany [S5]
- Merchant of record: Paddle.com · yes [S2]
- Merchant of record paddle: Paddle.com [S7]
- Merchant of record paddle: Paddle.com [S8]
- Reseller: Paddle.com [S5]
- Reseller of record: Paddle.com · yes [S6]

**Integrations**
- API compatibility guarantee: yes [S7]
- API consent functions: Consents.addConsent · Consents.hasConsent · Consents.hasConsentForServiceGroup [S8]
- API content blocker lookup: ContentBlocker.findByContentBlockerId [S8]
- API provider lookups: findByContentBlockerId · findByIabVendorId · findByProviderId · findByServiceId [S8]
- API service group lookup: ServiceGroups.findByServiceGroupId [S8]
- API tools: cloneObject · inArray · onExist [S8]
- API unblock functions: Unblock.unblockScriptBlockerId · Unblock.unblockStyleBlockerId [S8]
- Content blocker API block content: yes [S7]
- Content blocker API detect iframes: yes [S7]
- General config API: GeneralConfigPhpApi · yes [S7]
- Js API exists: 3 · yes [S8]
- Language API: LanguagePhpApi · yes [S7]
- Language API get current code: yes [S7]
- Php API entry: borlabsCookieApi() [S7]
- Plugin config API: PluginConfigPhpApi · yes [S7]
- Wp cli: WP-CLI-Integration vorhanden [S7]

**Legal**
- Entity: Borlabs GmbH [S4]
- Entity: Borlabs GmbH · Hamburger Str. 11, 22083 Hamburg, Germany [S3]
- Entity: Borlabs GmbH [S5]
- Entity: Borlabs GmbH [S7]
- Entity: Borlabs GmbH [S8]
- Entity germany: Borlabs GmbH · yes · Germany [S6]
- Hq germany: Deutschland [S7]
- Last updated: 25. September 2026 [S3]
- Legal entity: Borlabs GmbH · Hamburger Str. 11, 22083 Hamburg, Germany [S2]
- Merchant of record: Bestellprozess · Kundendienstanfragen · Rücksendungen · Paddle.com [S4]
- No legal advice: no [S4]
- No legal advice: no [S6]
- Register: 171030 · Amtsgericht Hamburg [S3]
- Register court: HRB 171030 · Amtsgericht Hamburg [S2]
- Seat: Hamburg [S2]
- Seat: Hamburg [S3]
- Trademarks: Borlabs · Borlabs Cookie [S3]
- VAT id: DE 347062761 [S2]
- VAT id: DE 347062761 [S3]

**Pricing**
- Cancellation: yes [S1]
- Money back guarantee: 30 [S1]
- Paddle merchant of record: Paddle.com · yes [S3]
- Starting price: 49 · EUR [S1]
- VAT excluded: EUR · yes [S5]
- VAT excluded: EUR · no [S7]
- VAT exclusive: EUR · no [S3]
- VAT exclusive: EUR · no [S6]
- VAT exclusive: EUR · yes [S8]
- VAT note: EUR · yes [S4]
- VAT treatment: All prices in EUR excl. VAT [S2]

**Product**
- Brand registration: Borlabs and Borlabs Cookie are registered trademarks of Borlabs GmbH [S2]
- Documentation mustertext: Mustertext Datenschutzerklärung · yes [S4]
- Legal advice disclaimer: Borlabs GmbH is not a law firm and does not provide legal advice or legal representation. [S5]
- No legal advice: no [S3]
- No legal advice: no [S7]
- No visitor data transmitted: lokal auf Kundenserver · no [S4]
- Non tcf labeling: When TCF is enabled, all Service Groups are marked with an icon and the label 'Non-TCF Standard' [S5]
- Plugin auto update modes: auto-update-all · auto-update-minor · auto-update-none · auto-update-patch [S7]
- Tcf non standard labeling: When TCF is activated in Borlabs Cookie, all service groups are marked with a symbol and the label 'Nicht-TCF-Standard' to meet TCF requirements [S6]
- Team location: yes · yes [S3]
- Wordpress only: WordPress [S1]

**Support**
- Response time: yes · 30 [S3]
- Status page: Status page and Support listed under Resources [S5]
- Ticket system: support ticket system · no [S3]

## Questions

### Is Borlabs Cookie European?

Not determined: the vendor’s pages as captured do not say where Borlabs Cookie is based.

### Where does Borlabs Cookie store data?

Not stated on the vendor’s pages as of 20 Oct 2026.

### Does Borlabs Cookie have a free plan?

Not stated on the vendor’s pages as of 20 Oct 2026.

### What are the best alternatives to Borlabs Cookie?

As of 21 Oct 2026, the panel rates [preeco | datenschutz (4/5)](https://whats-best.ai/software/data-protection/preeco), [Dastra (3/5)](https://whats-best.ai/software/data-protection/dastra) and [caralegal (3/5)](https://whats-best.ai/software/data-protection/caralegal) highest among the other 41 Data Protection products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [preeco | datenschutz](https://whats-best.ai/software/data-protection/preeco) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Borlabs Cookie alternatives](https://whats-best.ai/software/data-protection/borlabs-cookie/alternatives).

## What this page leaves out

- 26 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 13 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor page: https://de.borlabs.io (checked 2026-10-20)
- [S2] Imprint — found from the homepage: https://de.borlabs.io/impressum/ (checked 2026-10-20)
- [S3] Privacy policy — found from the homepage: https://de.borlabs.io/datenschutzerklaerung/ (checked 2026-10-20)
- [S4] Records & DPIA depth — found from sitemap: https://de.borlabs.io/docs/auftragsverarbeitungsvertrag-avv-adv/ (checked 2026-10-20)
- [S5] Privacy regime coverage — found from sitemap: https://borlabs.io/docs/non-tcf-standard/ (checked 2026-10-20)
- [S6] Privacy regime coverage — found from sitemap: https://de.borlabs.io/docs/nicht-tcf-standard/ (checked 2026-10-20)
- [S7] Integrations & automation — found from sitemap: https://de.borlabs.io/docs/php-api-v3/ (checked 2026-10-20)
- [S8] Integrations & automation — found from sitemap: https://de.borlabs.io/docs/javascript-api-v3/ (checked 2026-10-20)

---

Cite as: whats-best.ai, "Borlabs Cookie — Data Protection", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/data-protection/borlabs-cookie

Corrections: https://whats-best.ai/correct/886?target=page