# Cookiebot — Data Protection

Cookiebot by Cybot A/S holds a panel rating of 1.5/5 from 6 AI judges (category median 2.5/5), as of 2026-10-21. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: Cybot A/S (https://www.cookiebot.com)
- Category: [Data Protection](https://whats-best.ai/software/data-protection.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/data-protection/cookiebot
- Alternatives: https://whats-best.ai/software/data-protection/cookiebot/alternatives ([markdown](https://whats-best.ai/software/data-protection/cookiebot/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-21 · oldest source captured 2026-10-20

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Cybot A/S
- Headquarters: Not stated on the vendor’s pages as of 20 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 20 Oct 2026
- Free plan: Yes, per the vendor’s own page [S8]

## The panel's verdict

Cookiebot, a consent management platform from Cybot A/S, a trademark of Usercentrics A/S registered in Denmark, scored strongest on framework coverage at 5-7 and integrations and automation at 4-6. The pages show no-code apps for Wix, Shopify and WordPress, Google Tag Manager templates, live consent signals to Google, Microsoft and Amazon, monthly automated scanning with prior blocking, and coverage of GDPR, UK GDPR with PECR, CCPA, VCDPA, LGPD, TCF v2.4 and the Google and Microsoft consent modes from one implementation. It scored weakest on privacy management at 0-1 and rights and incidents at 2: the record-keeping evidenced is visitor consent choices, and the judges found no public information on records of processing, DPIA tooling, breach registers or request workflows with statutory clocks; the 45-day response language is the vendor's own policy, not a product module. The genuine split is integrations and automation, 4-6: judges weighing enterprise plumbing — a documented API, single sign-on, directory import — scored low because none is shown publicly, while judges weighing the website estate scored high. Audit readiness sits at 4; pricing transparency at 4-5.

**Speaks for it:**
- Native no-code apps for Wix, Shopify and WordPress, with Google Tag Manager templates and consent signals sent to Google, Microsoft and Amazon.
- Monthly automated scanning that identifies and classifies cookies and trackers, with non-essential cookies blocked prior to consent.
- Regimes named as covered — GDPR, UK GDPR with PECR, CCPA, VCDPA, LGPD, TCF v2.4, Google Consent Mode and Microsoft UET Consent Mode — from a single implementation.
- Consent logging of every decision including changes over time, positioned for GDPR accountability and CCPA recordkeeping, alongside scan reports and a public cookie declaration.
- Published monthly prices — Shopify Free at 0 USD, Shopify Essential at 6 USD, Shopify Pro at 30 USD, Wix Premium at 7 EUR, WordPress Premium from 7 EUR per domain — plus free tiers and a 14-day free trial.

**Held against it:**
- Privacy management scored 0-1, with no public information on records of processing, DPIA tooling, processor management or TOMs.
- Rights and incidents scored 2, with no public information on request workflows with statutory clocks, breach registers or authority notification output.
- No public information on a documented API, webhooks, single sign-on or directory import, leaving automation inside the website estate.
- No public prices for the Usercentrics Advanced tier or the add-ons, and WordPress pricing scales by page count from 7 EUR.
- No public information on hosting location or a subprocessor list, while the group entity list includes Usercentrics Inc.

**Best for:**
- You run your site on Wix, Shopify or WordPress and want a consent banner, monthly scanning and prior blocking set up without code.
- You need one implementation serving GDPR consent to EU visitors and a Do Not Sell or Share link with GPC handling for likely-California visitors.
- Your advertising runs on Google and Microsoft and you want automatic consent signals, including Google Consent Mode v2.
- You need per-visitor consent records with changes over time as evidence for the consent side of an audit.

**Avoid if:**
- You need a records-of-processing register, DPIA tooling or breach-register workflows — privacy management scored 0-1 and rights and incidents 2, and the record-keeping the pages evidence is visitor consent choices.
- You plan to integrate through a documented API or manage access with single sign-on — integrations and automation ranged 4 to 6, and the connectors shown stop at the website estate.
- You must budget an Advanced Business or Enterprise deployment in advance — pricing transparency ranged 4 to 5, with public numbers stopping at the app editions.
- Your procurement requires documented hosting locations and a subprocessor list — sovereignty ranged 3 to 4; the pages name EU standard contractual clauses as transfer safeguards but we found no public information on either.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v2). "n/r" = not rated: the vendor publishes no price.

| Criterion | The External DPO | The In-House Counsel | The Drafted Generalist | The Lead Auditor | The IT Integrator | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Records & DPIA depth | 0.5/5 | 0/5 | 0.5/5 | 0.5/5 | 0.5/5 | 0/5 |
| Data subject rights & incidents | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 |
| Privacy regime coverage | 3/5 | 3/5 | 3/5 | 3.5/5 | 3.5/5 | 2.5/5 |
| Audit readiness & evidence | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Integrations & automation | 2/5 | 3/5 | 3/5 | 2.5/5 | 2/5 | 3/5 |
| European sovereignty | 2/5 | 2/5 | 2/5 | 2/5 | 1.5/5 | 2/5 |
| Pricing transparency | 2.5/5 | 2/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2/5 |
| **Weighted verdict** | **1.5/5** | **1.5/5** | **1.5/5** | **2/5** | **1.5/5** | **1.5/5** |

### The judges

- **The External DPO** (v2.0): Carries thirty client mandates and bills by the hour they save. Optimizes for multi-client capability, reusable templates, a RoPA that drives the rest, and client-ready reports. Rejects single-tenant tools that treat the consultancy as thirty separate customers.
- **The In-House Counsel** (v2.0): Answers personally when the authority writes. Optimizes for defensibility: request clocks that never slip, a breach workflow that produces the Art. 33 notification, regime coverage that matches where the company actually operates. Rejects tools whose legal content nobody maintains.
- **The Drafted Generalist** (v2.1): Office manager at an 80-employee firm who got compliance added to her job title, not her calendar. Optimizes for guided workflows in plain language and software that knows the law so she does not have to. Rejects consultant-shaped platforms that assume a compliance department.
- **The Lead Auditor** (v2.0): Audits management systems for a living and has seen every folder of screenshots. Optimizes for revision-safe history, evidence packs on demand, and a defensible answer to "show me the state on date X". Rejects systems where the audit trail is assembled the week before the audit.
- **The IT Integrator** (v2.0): Has to feed the compliance platform from the estate that already exists: Entra ID, Jira, the CMDB. Optimizes for directory import, a real API, webhooks and SSO — compliance data that stays current because it syncs, not because someone retypes it. Rejects data islands with a CSV drawbridge.
- **The Skeptic** (v2.1): Hunts certification logos that link nowhere, "AI-powered" features with no substance behind them, consulting bundled as software, legal-update promises with no named lawyer, and customer counts that disagree between pages. Exists to keep the rest of the bench honest.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Appeal deadline: 45 [S3]
- California minors: yes [S3]
- Certifications: yes · yes · yes · yes [S1]
- Cookie declaration: https://www.cookiebot.com/de/cookie-declaration/ [S3]
- Data subject requests: yes [S4]
- DPA availability: yes [S5]
- DPA available: Data Processing Agreement · yes [S6]
- DPA available: yes [S7]
- DPA available: yes [S8]
- GDPR consent revocation: yes [S3]
- Government requests: yes [S3]
- Gpc support: yes [S3]
- Legal basis consent: Einwilligung (Art. 6 Abs. 1 lit. a DSGVO) · Vertragserfüllung (lit. b) · berechtigtes Interesse (lit. f) [S3]
- No pii sale: no [S3]
- Regulations page: DMA (EU) · GDPR (EU) · CCPA (California) · VCDPA (Virginia) · LGPD (Brazil) · TCF v2.4 (IAB) · Google Consent Mode (EU) · Microsoft UET Consent Mode [S8]
- Supported regulations: DMA (EU) · GDPR (EU) · CCPA (California) · VCDPA (Virginia) · LGPD (Brazil) · TCF v2.4 (IAB) · Google Consent Mode (EU) · Microsoft UET Consent Mode [S2]
- Third country transfers: EU-Standardvertragsklauseln · verbindliche interne Datenschutzvorschriften [S3]
- US fee policy: no [S3]
- US privacy rights: yes [S3]
- US response deadline: 45 · 90 [S3]

**Data**
- Log files retention: 7 [S3]
- Retention account: bis zu fünf volle Steuerjahre nach Kündigung [S3]
- Retention configuration: yes [S3]
- Retention enduser: 12 [S3]

**Hosting**
- Group entities: Usercentrics A/S · Usercentrics GmbH · Cybot A/S (inkl. Prag Büro) · Usercentrics Unipessoal · Usercentrics Inc [S3]

**Integrations**
- Cms plugins: WordPress · Wix · Shopify [S1]
- Cookie checker: Cookie checker (cookie scanning tool) · yes [S6]
- Google tag setup: yes [S1]
- Shopify: yes [S5]
- Shopify: Shopify · yes [S7]
- Shopify app: Cookiebot CMP for Shopify · Shopify · yes [S6]
- Wix app: yes [S5]
- Wix app: Usercentrics for Wix · Wix App Market · yes [S6]
- Wix app: Wix · yes [S7]
- Wordpress plugin: yes [S1]
- Wordpress plugin: yes [S5]
- Wordpress plugin: Usercentrics Cookiebot plugin for WordPress · WordPress · yes [S6]
- Wordpress plugin: WordPress · yes [S7]

**Legal**
- Address: 1058 · Copenhagen · Havnegade 39 · Denmark [S2]
- Company registration: Usercentrics A/S · Denmark · 34624607 [S5]
- Controller: Usercentrics A/S · Havnegade 39, 1058 Kopenhagen, Dänemark [S3]
- DPA: yes [S1]
- DPA available: yes [S2]
- Entity: Usercentrics A/S · Denmark · 34624607 [S1]
- Entity: Denmark · Usercentrics A/S · 34624607 [S4]
- Entity: Usercentrics A/S · Denmark · Denmark · 34624607 [S6]
- Entity: Denmark · Usercentrics A/S · 34624607 [S7]
- Entity: Usercentrics A/S · Denmark · 34624607 [S9]
- Entity name: Usercentrics A/S [S2]
- Jurisdiction: Denmark [S2]
- Legal entity: Usercentrics A/S · Denmark · 34624607 [S8]
- Management: Ea Luise Andersen · Daniel Johannsen [S2]
- Privacy contact: privacy@cookiebot.com [S3]
- Privacy policy update: 2026-09-29 [S3]
- Registration number: DK34624607 [S2]
- Registration number: DK34624607 [S3]

**Pricing**
- Currency: EUR [S2]
- Free trial: yes · 14 [S6]
- Free trial: 14 · yes [S7]
- Shopify essential: Shopify Essential · USD · customizable banner · up to 2 languages · 14-day free trial · 6 [S8]
- Shopify free features: Shopify Free · USD · block tracking until consent · initial compliance scan · unlimited manual scans · Google Consent Mode v2 · 1 default language (any) · privacy trigger on chosen pages · 0 [S8]
- Shopify pro: Shopify Pro · USD · up to 60 languages · 14-day free trial · 30 [S8]
- Trial: yes · 14 [S1]
- Wix addons note: Add-ons extend Cookiebot CMP without extra code or subscription [S8]
- Wix free features: Wix Free · EUR · GDPR · Google Consent Mode v2 · one default language · light and dark themes · 0 [S8]
- Wix premium: Wix Premium · EUR · CCPA coverage · 60+ languages · customizable banner · advanced display controls · 7 [S8]
- Wordpress free features: WordPress Free · EUR · up to 50 subpages · one consent banner · basic consent management · 0 [S8]
- Wordpress premium: WordPress Premium · per domain · EUR · pricing by page count · 14-day free trial · 7 [S8]

**Product**
- Account data categories: Konto-Daten: Kontaktdaten, Firmenname, Adresse, Telefonnummer, USt-ID, Sprache, Währung, Bestellnummer, Rechnungsempfänger-E-Mails, maskierte Zahlungsdaten [S3]
- Account deletion: yes [S3]
- Addons: yes [S1]
- Advanced solution: Usercentrics Advanced · Advanced Business · Enterprise [S1]
- Aggared statistics: Aggregierte Statistiken über Endnutzer-Einwilligungen mit grafischer Darstellung im Service Manager [S3]
- Audience survey: Audience Survey · yes [S2]
- Audience survey: Audience Survey · capture first-party attribution [S1]
- Audience survey: Audience Survey · yes [S6]
- Banner choices: Deny · Customize · Allow all [S7]
- California visitor detection: Cookiebot CMP · Detects visitors likely located in California and presents required 'Do Not Sell or Share My Personal Information' link automatically; runs GDPR consent flow for EU visitors [S6]
- Choice records: Cookiebot CMP · Keeps a record of each visitor's consent choices over time (audit logs) [S6]
- Cmp capabilities: automatic cookie scan and categorization, customizable consent banner, prior blocking of non-essential cookies, consent records [S5]
- Cmp description: plug-and-play consent management platform that deep-scans website to detect and control all cookies and third-party trackers [S7]
- Cms downloads: yes [S9]
- Compliance scope: yes · yes [S7]
- Config data: Konfigurationsdaten: Domain-Namen sowie Konfiguration von Inhalt, Aussehen und Verhalten gegenüber Endnutzern [S3]
- Consent automation: Cookiebot CMP automates GDPR-compliant consent collection, logging, and documentation [S4]
- Consent categories: Consent · Details · About [S7]
- Consent gated tools: yes [S8]
- Consent logging: consent logging of every decision including changes over time [S4]
- Consent mode v2 support: yes [S9]
- Consent signal platforms: Google · Microsoft · Amazon [S1]
- Consent transfer: Einwilligung des Endnutzers wird automatisch auf andere Webseiten des Kunden übertragen [S3]
- Consent withdrawal: consent withdrawal and granular consent change supported as best practice [S4]
- Cookie checker: Cookie checker · yes [S2]
- Cookie checker: yes [S4]
- Cookie scanning: Cookiebot CMP · Site scanning to identify cookies and trackers [S6]
- Course: 0 · yes [S9]
- Customizable design: yes [S8]
- Data categories: Konto-Daten · Konfigurationsdaten · Systemgenerierte Daten [S3]
- Fine risk statement: EUR 20M or 4% of annual global turnover [S8]
- Free scan: free website scan with customized report and privacy compliance risk level [S4]
- Free scan: yes [S5]
- Free test: DSGVO- und ePrivacy-Konformität des Online-Trackings · yes [S3]
- Free trial days: yes · 14 [S4]
- Google certified: yes [S8]
- Google consent mode course: free · Google Consent Mode V2 · yes [S1]
- Google gold tier: Gold Tier [S1]
- Google login: yes [S3]
- Gpc support: Cookiebot CMP · Supports Global Privacy Control (GPC) signal handling and audit logs [S6]
- Granular consent: yes [S1]
- Gtm integration: yes · yes [S9]
- Implementation methods: Google Tag Manager template · directly into website code · yes [S9]
- Minors: 13 [S3]
- New signals: ad_user_data · ad_personalization [S9]
- Newsletter: yes [S3]
- Newsletter personalization: yes [S3]
- No code cms apps: no-code consent management app, set up in minutes [S8]
- No coding required: yes [S8]
- No third party sharing contacts: nur zur Abwicklung der Abfrage (z.B. Demo-Buchungstool) [S3]
- Opt out records retention note: Keep records of consumer requests and responses for at least 24 months [S6]
- Regulations covered: DMA (EU) · GDPR (EU) · CCPA (California) · VCDPA (Virginia) · LGPD (Brazil) · TCF v2.4 (IAB) · Google Consent Mode (EU) · Microsoft UET Consent Mode [S4]
- Regulations covered: DMA (EU) · GDPR (EU) · CCPA (California) · VCDPA (Virginia) · LGPD (Brazil) · TCF v2.4 (IAB) · Google Consent Mode (EU) · Microsoft UET Consent Mode [S6]
- Research activities: E-Mail-Einladungen zu Umfragen, Nutzerinterviews und Produktforschung [S3]
- Scale stats: 600000 · 47+ · 2.4M · 8.8B [S1]
- Scan data: E-Mail-Adresse · Definitionen der erkannten Cookies · Scan-Berichte [S3]
- Scan feature: Webseite nach Tracking-Technologien scannen [S3]
- Scan free test: yes [S7]
- Scanner: automated scanner detects and categorizes cookies and trackers across domain including third-party [S5]
- Scanning: identify and classify cookies and trackers · monthly [S1]
- Setup steps: Sign up for free account · Choose banner and copy code · Paste code into site header [S1]
- Shopify app: yes [S4]
- Shopify block until consent: yes [S8]
- Shopify cmp: Cookiebot CMP for Shopify · yes [S2]
- Shopify features: automated cookie and tracker scanning · consent management for analytics and ads · Google Consent Mode v2 · e-commerce optimized [S8]
- Site scan: CMP scans site for every cookie and tracker, handles consent collection, logging, documentation [S4]
- Social chat retention: 14 [S3]
- Social presences: Facebook · Instagram · Google/YouTube · Twitter · LinkedIn · Google My Business [S3]
- Solution tiers: Solopreneur · Emerging Business [S1]
- Stats: 600000+ · 47+ · 2.4M · 8.8B [S9]
- System generated data: Systemgenerierte Daten: Abonnementdaten, Rechnungsdaten, USt-ID-Prüfung; Rechnungen im Service Manager abrufbar [S3]
- Theme compatibility: yes [S8]
- Trademark owner: Usercentrics A/S [S2]
- Trial available: 14 [S8]
- Trusted websites: 2.4M+ [S8]
- UK GDPR support: yes · yes · yes · yes · yes [S5]
- US optout link: yes [S3]

**Support**
- Developer docs: yes [S7]
- Docs: yes · yes [S9]
- Docs available: Developer documentation · Support [S6]
- Documentation: Developer documentation · yes [S2]
- SLA: yes [S1]

13 more facts on the canonical page: https://whats-best.ai/software/data-protection/cookiebot

## Questions

### Is Cookiebot European?

Not determined: the vendor’s pages as captured do not say where Cookiebot is based.

### Where does Cookiebot store data?

Not stated on the vendor’s pages as of 20 Oct 2026.

### Does Cookiebot have a free plan?

Yes. Cookiebot has a free plan, per [the vendor’s page captured 20 Oct 2026](https://whats-best.ai/evidence/9323).

### What are the best alternatives to Cookiebot?

As of 21 Oct 2026, the panel rates [preeco | datenschutz (4/5)](https://whats-best.ai/software/data-protection/preeco), [Dastra (3/5)](https://whats-best.ai/software/data-protection/dastra) and [caralegal (3/5)](https://whats-best.ai/software/data-protection/caralegal) highest among the other 41 Data Protection products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [preeco | datenschutz](https://whats-best.ai/software/data-protection/preeco) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Cookiebot alternatives](https://whats-best.ai/software/data-protection/cookiebot/alternatives).

## What this page leaves out

- 9 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.

## Sources

- [S1] Vendor page: https://www.cookiebot.com (checked 2026-10-20)
- [S2] Legal notice — found from the homepage: https://www.cookiebot.com/en/legal-notice/ (checked 2026-10-20)
- [S3] Privacy policy — found from the homepage: https://www.cookiebot.com/de/privacy-policy/ (checked 2026-10-20)
- [S4] Security / trust page — found from the homepage: https://www.cookiebot.com/en/gdpr/ (checked 2026-10-20)
- [S5] Privacy regime coverage — found from sitemap: https://www.cookiebot.com/en/uk-gdpr/ (checked 2026-10-20)
- [S6] Privacy regime coverage — found from sitemap: https://www.cookiebot.com/en/ccpa-compliance/ (checked 2026-10-20)
- [S7] Audit readiness & evidence — found from sitemap: https://www.cookiebot.com/en/cookiebot-report/ (checked 2026-10-20)
- [S8] Integrations & automation — found from sitemap: https://www.cookiebot.com/en/integrations/ (checked 2026-10-20)
- [S9] Integrations & automation — found from sitemap: https://www.cookiebot.com/en/google-consent-mode-v2-integration/ (checked 2026-10-20)

---

Cite as: whats-best.ai, "Cookiebot — Data Protection", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/data-protection/cookiebot

Corrections: https://whats-best.ai/correct/883?target=page