Cookiebot

Cookiebot’s pitch is automation: a monthly crawler inventories the cookies and trackers on your site, classifies them, and keeps a public cookie declaration up to date, while its auto-blocking mode holds scripts and iframes until the visitor consents to the matching category. It is a Google-certified CMP supporting IAB TCF v2.3, Google Consent Mode (including v2 defaults and signal-sending on consent submission) and Microsoft UET Consent Mode, with an official tag template in the GTM gallery — which makes it a common default for sites that need certified consent signals for Google’s ad products with minimal setup.

How blocking actually works. The auto-blocker compares elements about to be injected into the DOM against a checklist of resources that require consent, and modifies matching elements so they cannot load until the visitor’s consent state allows it. Manual markup does the same thing explicitly: you set a script’s type to text/plain and add a data-cookieconsent attribute naming the category (preferences, statistics, or marketing); Cookiebot re-enables the script when that category is granted. The auto-blocker respects manual markup — anything carrying data-cookieconsent is left alone — so you can mix the two modes on one site.

Real gotchas, from Cookiebot’s own docs. Anything that loads before the Cookiebot script can set cookies before anything exists to stop it, so the CMP tag must be first in the head. document.write injections are handled but may render at the bottom of the page instead of their intended position. Cookiebot advises against relying on auto-blocking when most of your JavaScript ships in a single bundle, and sites that inject scripts dynamically (typical of single-page apps) are expected to gate loading through the Cookiebot API rather than trust the auto-blocker. Classification is only as good as the crawl: gated or login-only flows need cookies added manually in the admin.

Deployment and verification. Direct script install or via the GTM template (configured with your Domain Group ID); when deploying through GTM you enable Consent Mode in the tag and set the default granted/denied states yourself. The admin includes a Google Consent Mode Checker to verify the signals end-to-end. Native integrations exist for WordPress, Webflow, and Wix, and banners ship with 47+ languages and regional targeting on paid tiers.

Positioning and pricing. Since the 2021 merger with Usercentrics, Cookiebot is the automated, self-serve product in that portfolio; enterprise and configuration-heavy cases are steered to the session-priced Usercentrics Advanced plan. Cookiebot’s own tiers are published and priced per domain by subpage count — free for one domain up to 50 subpages, €7–€90/month per domain beyond that — so costs are predictable but climb with large multi-domain estates.

Use it when you want a published-price CMP that discovers and blocks trackers largely on its own, especially on server-rendered content sites. Look past it when you run a heavily bundled SPA (you will be hand-wiring the consent API anyway), need mobile-app or CTV consent, preference management beyond cookies, or fine-grained enterprise governance.