Cookiebot CMP Review (2026): Pricing, Problems & Verdict

Cookiebot is a consent management platform (CMP) from Usercentrics that earns 7.0 out of 10 in Enzuzo's review, best suited for smaller sites whose page counts rarely change. Its cookie scanning and setup are strong features, and Google lists it in the Gold tier of its CMP Partner Program. It's free for one site under 50 pages.

Cookiebot's weak spots are opaque billing practices that climb with page and domain counts, email-only support on Premium plans, and mixed user feedback on public forums.

Cookiebot's advertised entry price is $8 (€7) a month, the rate for its smallest paid plan. Domains with 50 or more pages cost more. A single site with 200 pages, for example, pays $34 (€30) a month.

Each domain's price depends on how many pages Cookiebot's scanner finds in the intial run. Deleting URLs doesn't drop sites down to lower tiers since the first scanner run is treated as the default moving forward. This is a frequent source of ire in many of Cookiebot's reviews.

Who built Cookiebot?

The Danish company Cybot built Cookiebot in 2012, but merged with Usercentrics in September 2021.

Usercentrics, a German data privacy software company, continued to operate Cookiebot as a standalone product, although their public association has grown closer in recent times. Cookiebot's primary features include a consent banner, a cookie scanning tool, and audit logs. For more, read the company's history.

How Enzuzo evaluated Cookiebot

Enzuzo scored Cookiebot on the five scorecard criteria using Cookiebot's own documentation and pricing page, both checked on September 30, 2026. User ratings come from G2, Capterra, Trustpilot, and the platform app stores, checked on September 30 and October 1, 2026.

Independent research comes from published studies, each dated by the year its data was collected. Some evidence comes from proprietary first-party knowledge, including conversations with Enzuzo's customers that have experience building on Cookiebot.

Enzuzo sells a competing consent management platform, so we have access to benchmarking tools, industry best practices, and can evaluate Cookiebot better than outsiders can. However, this review could also come across as biased, so we try to do our best to maintain editorial neutrality by citing sources frequently. 

Cookiebot features

Cookiebot's Premium plans carry most of the weight, including automatic blocking, monthly scans, geotargeting, and IAB TCF, while the free plan covers a single-language banner with manual blocking.

Cookie scanning

Cookiebot's scanner sorts the cookies and trackers it recognizes into necessary, preferences, statistics, and marketing, lists any it doesn't recognize as unclassified, and publishes the result as a cookie declaration. Sites on the Premium tier can scan monthly, which we think is a gap.

Why?  A script added the day after a scan can run for weeks before Cookiebot lists it in the declaration. Daily scans cost an extra €99 a month, and the free plan gets only an initial scan and nothing more.

Cookie blocking

Cookiebot blocks non-essential scripts until a visitor consents, either automatically on Premium plans or through manual setup on the free plan, where the site owner tags each script by hand.

Consent banner and customization

Cookiebot's banner builder handles colors, fonts, layout, and button labels without code. Premium adds custom branding, banners built in HTML, CSS, and JavaScript, auto-translation into 47-plus languages, and geotargeting, which shows each region the banner the site owner has set for it.

Google Consent Mode v2 and other consent signals

Google Consent Mode v2 is on by default in Cookiebot, which holds the Gold tier in Google's CMP Partner Program. Both the free and Premium plans also pass consent to Microsoft UET and Amazon. Both honor Global Privacy Control, the browser signal that tells a site not to sell or share a visitor's data.

IAB TCF support

Cookiebot is a registered CMP under IAB Europe's Transparency and Consent Framework, and Google's certified CMP list shows it as CMP ID 134 for web. Publishers need TCF to pass consent to ad vendors, and Cookiebot includes it on Premium plans only.

Integrations

Cookiebot installs through a WordPress plugin, a Google Tag Manager template, and apps for Wix, HubSpot, and Shopify, or through a script tag on any site. The WordPress plugin has more than 100,000 active installs. The Shopify app is the newest: Usercentrics launched it in November 2025, and an existing Cookiebot subscription can cover the store.

Cookiebot pricing

Cookiebot charges per domain, per month, at a tier its scanner assigns based on the number of unique pages on each domain:

Three rules shape a Cookiebot bill. Yearly billing costs exactly 12 times the monthly price, with no annual discount. Every subdomain bills as its own domain. And billing follows the highest page count the scanner has ever recorded.

Ease of use

Cookiebot is easy to launch. Ease of setup is the most common praise on Cookiebot's Capterra listing, where reviewers rate its ease of use 4.5 out of 5. Cookiebot's own setup steps cover adding a domain, running the first scan, and configuring the banner.

Some teams find Cookiebot's admin dashboard dated. Four teams that spoke with Enzuzo while weighing a switch described the admin as dated or hard to use, and two of them were still on older Cookiebot plans or versions.

Support

Cookiebot's support is email-based. Premium plans get customer care and technical support by email, the free plan gets the help center, and Usercentrics Advanced adds priority support with video calls. Capterra reviewers rate Cookiebot's customer service 3.9 out of 5, below its overall 4.2.

Cookiebot's plan comparison lists no phone number or live chat for Cookiebot Core plans. Email suits routine questions. No Cookiebot plan below Usercentrics Advanced offers a live channel for urgent problems, such as a banner that misfires during a launch or a Google Consent Mode setup that stops passing signals.

Compliance coverage

Cookiebot covers the main privacy laws and consent signals that most websites need. Regional US state privacy law coverage requires a Premium plan, however.  

Cookiebot states it offers compliance frameworks for the GDPR, California's CCPA and CPRA, Virginia's VCDPA, Brazil's LGPD, and South Africa's POPIA. It also publishes regulation pages for Canada's PIPEDA, Quebec's Law 25, Switzerland's FADP, the EU's Digital Markets Act, and 11 U.S. state privacy laws, including those in Colorado, Connecticut, Texas, and Florida.

Enzuzo was not able to independently test or confirm Cookiebot's privacy law claims, so they are posted here without comment.

The free plan's limits matter most for compliance coverage. Without geotargeting, a free site shows one banner to every visitor, and consent lapses after a month. Cookiebot's lack of a DSAR tool also means teams that must answer access or deletion requests need a separate process (Enzuzo offers DSAR access on all paid plans).

What do users say about Cookiebot?

Users mostly like Cookiebot's setup and scanning and dislike its billing approach. Cookiebot's ratings run from 2.6 out of 5 on the HubSpot Marketplace to 4.6 on the Wix App Market:

Across the larger review sites, reviewers praise easy setup and accurate automatic scanning, and many like how simple the banner is to customize. Complaints center on price increases, charges that arrive without warning, and slow support. Trustpilot shows the split most clearly, with 86% of its ratings at either five stars or one.

Is Cookiebot free?

Cookiebot is free for one domain with fewer than 50 pages. The free plan limits the banner to one language and offers manual blocking only. It also runs an initial scan only, and a visitor's consent lasts at most one month. Every Premium plan starts with a 14-day trial that needs no credit card. Read more in the Cookiebot pricing overview.

Does Cookiebot delete cookies?

Cookiebot's documentation doesn't say that it deletes tracking cookies already stored in a visitor's browser when consent is withdrawn. The one removal it documents is for unclassified cookies, which its scan report guide says are removed at every page load. Its consent withdrawal guide notes that a visitor can also delete the site's cookies, or just its two consent cookies, to change or withdraw consent.

Many sites keep tracking cookies after a withdrawal, whichever CMP they run. A PoPETs 2025 study of the top 200 sites found advertising or analytics cookies still present after revocation on 69 of 120 sites (57.5%) in 2024. The study didn't report results by CMP.

What are the most common problems with Cookiebot?

Cookiebot's documented problems are concentrated in billing and support, with smaller, setup-specific problems in scanning and in consent shared across domains and regions. Enzuzo's sales-call evidence comes from 31 calls in which Cookiebot came up, most with teams weighing other tools, so it shows why some customers leave. Ten of those calls also included praise for Cookiebot, most often its price and simple setup.

Billing and support problems

Cookiebot's billing problems start with its page-count rule: a domain's price rises when a scan finds more pages, and it doesn't fall when pages are removed. The upside is that traffic doesn't change the price, which suits high-traffic sites with few pages.

Two pricing changes in 2025 pushed some domains into higher tiers. A new XLarge tier arrived between early and late March 2025, which moved domains with 7,000 or more pages from the €50 Large rate to €90. In mid-July 2025, Premium Small began requiring four or more domains in the account.

The four-domain rule moved accounts with one to three domains of 50 to 349 pages from €15 to the €30 Medium rate. It also means two 200-page domains cost more than four: two bill at Medium for $68 a month, while four qualify for Small at $64.

Billing also dominates Cookiebot's negative reviews. Surprise charges are the most common complaint among recent one-star reviews on Trustpilot, and a Capterra reviewer reports charges after closing the account. Trustpilot also carries 155 one-star reviews, as of October 1, 2026.

Product and setup problems

Cookiebot's scanner can show up in a site's own analytics. Its scanner documentation lists 11 IP addresses and the user agent token Cookiebot/1.0 for filtering, but commenters there reported Google Analytics 4 spikes, around 2024, that IP filters didn't remove.

The scanner also misread the sites of two teams weighing a switch. A UK agency said EU-based scans threw false positives on a U.S. client's site, and another company said the scanner couldn't read its separate booking site. Automatic scanning is still among the features Capterra reviewers praise most, however.

Beyond the scanner, another setup problem teams report is consent across several domains and regions, which still requires manual work for some, even though Cookiebot lists cross-domain consent sharing and geotargeting as Premium features.

A consumer hardware brand evaluating Cookiebot called its cross-domain sharing "very flimsy." Several teams weighing a switch found region-specific rules hard to set up and buggy.

Single-site owners face smaller limits. On the free plan, a visitor's consent lasts one month at most, so returning visitors see the banner again; Premium lifts that limit from $8 a month.

Cookiebot CMP errors and problems

Independent crawls from 2021 and 2023 found that most sites running Cookiebot still set or loaded at least one tracking cookie before consent or after a rejection. Both studies found similar problems on sites using other CMPs. The studies don't isolate how much comes from Cookiebot itself versus each site's setup.

In a 2021 crawl run from Germany, Bollinger and colleagues found that on 66.4% of 9,446 Cookiebot sites, at least one cookie was still set for a purpose the visitor had rejected. Cookiebot was the only CMP where they could confirm a rejection had registered, so that figure can't be compared with other CMPs.

Across all 29,398 sites in the Bollinger study, which used five CMPs, 94.7% had at least one potential GDPR issue.

A December 2023 crawl of the top 1 million sites, published by Jha and colleagues, found that 75.85% of 12,415 Cookiebot sites loaded a listed tracker domain that set a persistent cookie before any banner click.

Among the eight CMPs in the study, that rate was the fourth highest: sites on Usercentrics' own CMP were lowest at 32.94%, OneTrust sites were at 61.33%, Didomi sites at 82.14%, and HubSpot sites were highest at 99.20%.

The 2023 crawl ran from U.S. data centers, and the authors note that sites might behave differently for U.S. visitors. Two of the study's authors were affiliated with illow, a rival CMP vendor, when it was published.

Cookiebot claims close compliance with the IAB framework relevant for ad vendors. In 233 crawls of Cookiebot sites published at WWW 2024, the string never recorded consent after a rejection. In 201 of those crawls, though, it still claimed legitimate interest, a legal basis that lets vendors process data without consent, which the framework allowed at the time.

A 2025 USENIX paper notes that Cookiebot lets developers change banner text "without guardrails." A button can read "Continue to Site" instead of "Accept All Cookies," which gives a false impression to users. 

Cookiebot's oldest independent results predate the Usercentrics merger. In a September 2019 crawl of top UK sites, published at CHI 2020, only two of 85 Cookiebot-powered sites (2.35%) met the study's minimal legal requirements, against 11.8% of all CMP sites.

Cookiebot pros and cons

Cookiebot's main strength is automatic scanning behind a Google-certified banner, and its main weakness is a bill that follows page and domain counts.

Where Cookiebot does well:

• Automatic scanning and categorization that save manual tracker work
• Google Consent Mode v2 on by default, with Gold-tier Google CMP partner status
• A registered IAB TCF CMP that recorded no false consent in a 2023 independent study
• Fast setup through WordPress, Google Tag Manager, and Wix
• Pricing that ignores traffic, which suits high-traffic sites with few pages

Where Cookiebot falls short:

• Billing tied to the highest page count ever scanned, with every subdomain billed separately
• A four-domain minimum on its cheapest multi-domain tier
• Email-only support on Premium plans, rated 3.9 out of 5 on Capterra
• Monthly scans by default, with daily scans at €99 a month extra
• A dashboard some teams find dated
• Cross-domain consent and regional rules that some teams find hard to set up

One team weighing a switch put its reason plainly to Enzuzo: "It's pure pricing. Cookiebot works fine. But they charge based on subdomains."

Is Cookiebot safe for a business to use?

Cookiebot is generally safe for businesses; it's a Google-certified CMP partner, it's registered with IAB Europe, and it holds ISO 27001 and 27701 certifications. 

Some events are worth analyzing further, though.

In December 2021, the Wiesbaden Administrative Court issued an interim injunction in case 6 L 738/21.WI. It barred a German university from embedding Cookiebot in a way that sent the complainant's full IP address to servers of Akamai, a U.S.-headquartered content delivery network.

On January 17, 2022, the Hessian Higher Administrative Court (case 10 B 2486/21) set aside that injunction on procedural grounds, because the complainant hadn't shown the urgency needed for interim relief. The appeal court made no ruling on GDPR compliance and left the main case to the lower court.

The Wiesbaden case still matters for EU buyers because it investigated where Cookiebot's scripts were served from. A business that must keep personal data inside the EU should keep this as a key consideration.

What are consentcdn.cookiebot.com and cookiebot.eu?

Consentcdn.cookiebot.com and consent.cookiebot.com are Cookiebot's default domains. They serve its banner and consent service through Akamai's network. Cookiebot's European CDN guide says Akamai logs visitors' IP addresses, the issue in the Wiesbaden case. Cookiebot therefore offers an EU-only version on cookiebot.eu domains.

Site owners switch by changing .com to .eu in the Cookiebot script tag or choosing .eu in the Google Tag Manager template. The guide was last updated about two years ago, and it lists trade-offs. The WordPress plugin didn't support the EU version yet, and cross-domain consent sharing didn't carry over. U.S. visitors were all treated as Californian, so state-level geotargeting didn't work.

Cookiebot vs Usercentrics: which is better?

Cookiebot is the better fit for small and mid-sized sites, and Usercentrics Advanced is the better fit for multi-brand or multi-region businesses that want guided onboarding. When the two companies merged, their 2021 announcement set that split: Cookiebot for plug-and-play compliance, mainly for small and mid-sized businesses, and Usercentrics for enterprise.

Cookiebot and Usercentrics Advanced differ most in how they're priced. Cookiebot Core charges per domain by page count and publishes its prices. Usercentrics Advanced charges by visitor sessions, covers unlimited domains, and has no public price; it's sold through Usercentrics' sales team and reselling partners.

Advanced also adds features Cookiebot Core lacks: A/B testing, single sign-on, cross-device consent sharing, support for 60 or more languages instead of 47, a customer success manager, and priority support. On Google's certified CMP list, Cookiebot appears as a web CMP (ID 134), while Usercentrics' own CMP (ID 5) covers web, apps, and connected TV.

Verdict: who should use Cookiebot?

Cookiebot is a solid choice when the job is a Google-certified banner with Consent Mode v2 and an up-to-date cookie declaration, on one domain or a few where pages are added slowly. It's a weaker choice once a business runs several mid-sized domains, adds pages quickly, or wants privacy requests handled in the same tool.

If you're comparing your options, speak with a consent management specialist to learn how Enzuzo can power your stack. 

Cookiebot's 14-day trial is the fastest way to price a specific site: the trial scan assigns the site's tier, so it shows the real Cookiebot price before any comparison.

Cookiebot alternatives worth considering

The top Cookiebot alternative depends on specific use cases and factors for switching away, such as billing concerns, feature disparity, or wider governance requirements. 

Enzuzo's consent management platform suits teams that want consent banners and DSAR workflows on one plan, with chat support starting on its free plan. Enzuzo holds the same Gold tier in Google's CMP Partner Program as Cookiebot. Enzuzo's Pro plan includes 30,000 monthly visitors, so high-traffic sites should compare both pricing models.

Enzuzo's roundup of Cookiebot alternatives adds setup notes for each tool. Head-to-head pages compare Cookiebot vs CookieYes, Cookiebot vs Complianz, OneTrust vs Cookiebot, and Osano vs Cookiebot.

How does a site switch away from Cookiebot?

Cookiebot's banner disappears as soon as the subscription ends, so a clean switch exports consent records and runs the new banner before the account is cancelled. A complete switch covers these steps:

• Export consent records as CSV (a Premium feature) and decide how long to keep them; Cookiebot retains records for up to 12 months.
• List every domain in the account, including www and regional subdomains.
• Capture the banner's text, categories, languages, styling, and geotargeting rules.
• Note the Google Consent Mode v2 default consent states and the Google Tag Manager template settings.
• Confirm the new CMP's IAB TCF ID and vendor list with ad partners.
• Remove the WordPress plugin, Shopify app, Wix app, or HubSpot app, and plan a replacement for HubSpot's own banner, which the HubSpot app switches off.
• Remove Cookiebot's script tags from site templates, along with any hard-coded renew or withdraw links.
• Cancel in the Cookiebot account after the new CMP goes live, and keep the cancellation confirmation.
  
  

Frequently asked questions

Is Cookiebot worth it in 2026?

Cookiebot is worth it for a single site under 50 pages, which pays $0 to $8 a month, and for high-traffic sites with few pages, because traffic doesn't change its price. It's less worth it for businesses with several mid-sized domains or fast-growing page counts, because billing follows the highest page count ever scanned. Its 14-day trial shows a site's real tier before any commitment.

Is Cookiebot safe?

Cookiebot is safe by the measures a business buyer can verify, including Google's Gold CMP tier and an IAB Europe registration. A German court's 2021 order against one university's Cookiebot setup was set aside in January 2022, with no ruling on GDPR compliance. Businesses that must keep personal data in the EU should still ask where Cookiebot serves its scripts from.

Does Cookiebot block cookies before consent?

Cookiebot can block non-essential cookies before consent, automatically on Premium plans or with manual blocking on the free plan. Independent crawls in 2021 and 2023 still found that most sites running Cookiebot set or loaded at least one tracker early or after a rejection, as did sites on other CMPs. Rejecting everything in a private window and watching network requests is the quickest way to test a site.

Which is better, Cookiebot or Usercentrics?

Cookiebot is the better pick for a site owner who wants to sign up online at a published per-domain price. Usercentrics Advanced is the better pick for a business with many brands or regions that can buy through a sales team. Both come from Usercentrics. Advanced adds unlimited domains, single sign-on, A/B testing, and a customer success manager, priced by visitor sessions.

Does Cookiebot work across multiple domains?

Cookiebot supports multiple domains, and Premium plans include cross-domain consent sharing. Each domain and subdomain bills separately, though, and accounts need four or more domains to reach the cheaper Small tier. Enzuzo offers a valuable multi-domain consent product, which teams prefer over Cookiebot.

How does Cookiebot handle U.S. state privacy laws?

Cookiebot lists support for U.S. state laws such as California's CCPA and CPRA, through geotargeted banners on Premium plans. Teams that spoke with Enzuzo while weighing a switch found region-specific rules hard to set up, and one ran its U.S. visitors on its UK configuration. Enzuzo's guide to U.S. privacy laws lists what each state requires.

Why did my Cookiebot bill go up?

A Cookiebot bill usually goes up because a scan found more pages and moved a domain to a higher tier, and billing then uses the highest page count ever recorded. Two 2025 changes also raised some bills: a new €90 XLarge tier for domains with 7,000 or more pages, and a rule that sends accounts with one to three mid-sized domains to the €30 Medium rate.

Does Cookiebot work with Shopify?

Cookiebot works with Shopify through an app Usercentrics launched in November 2025. The app has a free plan and paid plans up to $30 a month. An existing Cookiebot subscription can cover the store instead. One UK agency that spoke with Enzuzo while weighing a switch said the Shopify integration "wasn't smooth," so stores should test the banner before launch.