Cookiebot Review 2026: Why Your Marketing Tracking Quietly Breaks Without Consent, and How to Fix It

In this blog post I'm going to walk you through Cookiebot, and why I think it's one of the smartest, most underrated tools in any marketer's stack.

Because here's something most marketers don't realise until it bites them. Your tracking can break without anything looking broken. Your dashboards still load. Your campaigns still run. The numbers still come in. They're just quietly wrong, and you're making decisions on them.

I've been in marketing since the dial-up days, and I've seen a lot of tracking come and go. What's changed in the last couple of years is that consent is now part of the plumbing. If it isn't set up correctly, your data leaks out of the bottom of the bucket. And depending on where your visitors are, it can also put your business at legal risk.

This Cookiebot review covers both sides of that story: the marketing performance side (attribution gaps, shrinking audiences and Smart Bidding learning from incomplete data), and the risk side, with Google Consent Mode v2 for EU and UK traffic and CIPA for US traffic. Then I'll show you exactly how Cookiebot deals with all of it, starting with a free scan of your own website.

Why I wanted to write this Cookiebot review

Cookie consent is a topic I've been writing about for a while now. I've covered whether Google Analytics requires cookie consent under GDPR, what Google Consent Mode v2 is and whether you need it and the best consent management platforms for small business. Cookiebot comes up again and again in that research, and for good reason.

What I love about Cookiebot is that it doesn't treat consent as a legal box to tick. It treats it as a marketing problem. Its own homepage puts it in five words: get compliant without data loss. That's exactly the right way to think about it, and it's the reason I was so excited to dig into it in depth for this review.

I spent hours going through every corner of Cookiebot, from its pricing and Google Consent Mode setup to its brand new CIPA template, its WordPress plugin and its add-ons. Here's what I found.

How marketing tracking quietly breaks when consent isn't set up correctly

Let's start with the bit that matters to every marketer, wherever you are in the world: performance.

Every tracking tool on your website, from Google Analytics and your Google Ads tag to the Meta Pixel and your HubSpot tracking code, depends on one thing. It has to be allowed to run. When consent isn't handled well, one of two things happens. Either those tools fire when they shouldn't (which is the legal risk we'll come to in a moment), or they don't send the right signals when they should, and your data starts to thin out.

Here's what that looks like in real life.

1. Attribution gaps

You can see the traffic, but not where it came from. Cookiebot points out that consent decline rates across the EU average 40 to 54%, which leaves a significant share of your traffic unattributed if your setup can't account for it. And that's before you add the visitors who found you through a podcast, a referral or a conversation, which no tracking pixel can see.

The result is that budgets get moved based on incomplete data. The channel that's working looks like it isn't, and the one that's coasting gets the credit.

2. Audiences that quietly shrink

Your remarketing lists rely on consented data. If your consent signals aren't reaching Google in the format it expects, those audiences stop filling up. Cookiebot explains that sites flagged in Google's consent audits lose access to ad personalisation, so remarketing audiences stop receiving ads. No error message. Just smaller audiences and weaker results.

3. Smart Bidding learning from incomplete data

This is the one that keeps me up at night on behalf of my clients. Google's automated bidding is only as clever as the conversion data you feed it. Cookiebot warns that without compliant consent signals, conversion measurement can be suspended, and your bidding algorithms lose the optimisation data they depend on. So the algorithm keeps spending your money, but it's learning from a partial picture.

The good news is that this is very fixable. When consent is collected correctly and signalled correctly, Google can use consented data in full and use modelling to fill in the gaps for visitors who decline. That's the whole point of Consent Mode, and it's where Cookiebot really shines.

Which brings us to the two risks, and they're different depending on where your visitors live.

Risk one: Google Consent Mode v2 for EU, EEA and UK traffic

If you advertise to, or measure, visitors in Europe or the UK, this part is for you.

Google requires companies using its services in the EEA, the UK and Switzerland to use a certified consent management platform that integrates with the latest version of Consent Mode. Consent Mode v2 added two new signals, ad_user_data and ad_personalization, on top of the existing ones for analytics and advertising storage. Those signals tell Google exactly what each visitor has agreed to, so Google Ads and Google Analytics can behave accordingly.

If they're missing, or wrong, you pay for it in performance. Cookiebot spells out what happens if you fail Google's consent audit:

• Remarketing disabled. Google revokes access to ad personalisation, so your remarketing audiences stop receiving ads.
• Conversion tracking broken. Without compliant consent signals, conversion measurement is suspended and your bidding algorithms lose optimisation data.
• Revenue drops. For publishers, non-compliant ad requests default to limited ads or get dropped entirely.

I've written a full explainer on Google Consent Mode v2 and whether you need it if you want to go deeper. The short version is that if you have any European or UK traffic and you run Google Ads or GA4, you need a certified CMP. Cookiebot is one of the very best.

Risk two: CIPA for US traffic

Now for the one that a lot of US marketers haven't heard of yet, and really should have.

The California Invasion of Privacy Act (CIPA) is a 1967 California law that was written for phone taps and hidden recording devices. Nothing in it mentions websites. But since 2022, plaintiffs' law firms have used it to file thousands of lawsuits and demand letters against ordinary websites, arguing that everyday tools like analytics scripts, chat widgets, session replay software and marketing pixels such as the Meta Pixel amount to unlawful wiretapping.

Cookiebot's own guide to CIPA requirements is one of the clearest explainers I've read on it. Here are the facts that made me sit up:

• CIPA lets individuals sue directly, with statutory damages of up to $5,000 per violation, and each site visit can arguably count separately.
• According to Cookiebot, filings of this kind jumped from just over 200 in 2023 to nearly 4,000 the following year.
• It applies to any business with a website that California visitors can reach, regardless of where the business itself is based. Even a handful of California visitors is enough to make you a target.
• Smaller sites are, if anything, more exposed, because they typically don't have the legal budget to fight back. That's a large part of why so many of these claims get paid out rather than defended.

Why a standard US cookie banner doesn't cover CIPA

This is the part that catches people out. Most US state privacy laws, like the CCPA and CPRA, use an opt-out model. You can usually collect data first, as long as you tell people and let them opt out. So most US cookie banner setups don't ask for consent before tracking tools fire.

CIPA is different. It can require consent before collection starts at all. So a CCPA-style banner, on its own, doesn't close the gap that these demand letters are targeting.

Doesn't the new SB 690 law fix this?

Not yet, and not fully. California passed SB 690, which Governor Newsom signed on 30 September 2026. But as Cookiebot explains, it doesn't take effect until 1 January 2027, it only deals with one part of CIPA (the pen register theory in section 638.51), and it leaves the wiretapping and eavesdropping claims under sections 631 and 632 untouched. Plaintiffs are also pairing CIPA with federal laws like the VPPA, and similar state wiretap laws are being tested in Florida and Pennsylvania.

In other words, waiting for lawmakers to sort this out isn't a plan. Getting consent right on your website is.

(A quick but important note: I'm a marketer, not a lawyer, and neither this article nor any software is legal advice. If you've already received a demand letter, speak to a lawyer before you change anything or reply.)

What is Cookiebot?

Cookiebot is a consent management platform from Usercentrics, one of the biggest names in privacy technology. It automates cookie consent on your website so you can stay compliant with privacy laws around the world while keeping your marketing data flowing.

The numbers speak for themselves. According to Cookiebot, it's used on more than 2.4 million websites and apps, handles 8.8 billion user consents every month, supports 47+ languages and has more than 600,000 customers. It also holds ISO 27001 and ISO 27701 certifications, is HIPAA ready, and is a Google-certified CMP partner.

Cookiebot comes in two flavours. Cookiebot Core is built for solopreneurs and growing businesses, and it's what most of my readers will want. Usercentrics Advanced is for businesses managing multiple brands, platforms or regions at scale. For the rest of this review, I'm focusing on Cookiebot Core.

How does Cookiebot work?

Cookiebot does three jobs, and it does them automatically: it scans, it blocks and it signals.

1. It scans your website for every cookie and tracker

Cookiebot uses patented scanning technology to crawl your website and find every cookie and tracker in use, including the ones added by third-party scripts that you may not even know are there. It then categorises them automatically (necessary, preferences, statistics and marketing), using its continuously updated global library of known cookies and trackers.

And it doesn't stop after day one. On paid plans, Cookiebot rescans your website every month. This is a much bigger deal than it sounds. Every time you add a new plugin, a chat widget, a video embed or a new marketing tool, you can introduce new trackers without realising it. Cookiebot catches them for you. On the free plan, Cookiebot runs your first scan automatically when you add your domain, and after that you can run a new scan yourself from inside your account whenever you need to.

2. It blocks trackers until visitors consent

This is called prior consent, and it's exactly what GDPR requires and what CIPA claims are built around. Cookiebot's automatic blocking mode holds back non-essential cookies and trackers until a visitor has made a choice, so nothing fires before it should. If you want more control, a manual mode lets you decide exactly how each script behaves.

3. It signals consent to your ad platforms

Once a visitor makes a choice, Cookiebot passes that choice on to the platforms that need it. It supports Google Consent Mode, Microsoft UET Consent Mode and Amazon Consent Signal, so your Google Ads, Microsoft Advertising and Amazon Ads campaigns all get clean, accurate consent signals automatically.

Behind all of that, Cookiebot keeps a record of every consent, which you can export as a CSV, and automatically generates a cookie declaration for your website that stays up to date with every scan.

Cookiebot and Google Consent Mode v2

For marketers running Google Ads and GA4, this is the heart of it.

Cookiebot was among the first consent management platforms certified by Google when it launched its CMP Partner Program in May 2023. It has since earned, and kept, Gold Tier status in that programme, which is the highest level. To keep it, Cookiebot has had to meet new requirements, including integrating its WordPress plugin with the WP Consent API and providing a diagnostic tool for checking your Consent Mode implementation.

Even better, Cookiebot and Usercentrics are among a small number of CMPs with direct integrations inside Google Ads, Google Analytics and Google Tag Manager themselves. So you can set things up from inside the Google tools you already use.

Here's what Cookiebot does with Google Consent Mode v2:

• Automatically signals valid user consent to Google Ads, GA4, gtag and Google Tag Manager
• Updates your Google tags with each visitor's consent choice the moment they make it
• Supports Advanced Consent Mode, so Google can use conversion modelling to fill gaps for visitors who decline, while respecting their choice
• Has Google Consent Mode switched on by default in the WordPress plugin

Setting it up is a three-step process. You scan your website and customise your banner. You add the Cookiebot script through Google Tag Manager or the WordPress plugin, and Consent Mode v2 activates automatically. Then Cookiebot keeps your Google tags updated with consent signals from that point on. Cookiebot's documentation is clear that you should make sure a default consent state is set, and it walks you through how.

If you want to learn more, Cookiebot even runs a free Google Consent Mode v2 course that breaks it all down into bite-sized lessons. I love that. It's a company that wants its customers to understand what they're doing, not just install a script.

Cookiebot and CIPA: the new CIPA/VPPA template

For US marketers, this is where Cookiebot really impressed me.

Cookiebot has launched a dedicated CIPA consent template built for exactly the problem I described above. It lets you show a California-specific, opt-in banner that blocks high-risk categories such as session replay, chat widgets and ad pixels until a visitor actively consents. It also covers the VPPA, which adds overlapping risk for any site with embedded video.

And the best part for smaller businesses? It doesn't mean switching to a new platform. It's a configuration change inside the Cookiebot dashboard you're already using. According to Cookiebot's step-by-step support guide, it goes like this:

1. Log in to Cookiebot Admin and open your domain group.
2. Go to the Configuration screen.
3. Under Legislation Preset, select CIPA/VPPA and click Apply Preset. Cookiebot then sets your banner to require active consent before any tracking starts.
4. Under Design, then Compliance, add your Do Not Sell or Share link, either to your own data request form or to a link that reopens the banner.
5. Review your banner wording on the Content tab, and you're done.

Cookiebot is refreshingly honest about this too. It describes the template as a configuration change, not a compliance guarantee, and recommends speaking to a lawyer if you've already received a demand letter. That kind of straight talking is exactly why I trust it.

Cookiebot also supports the Global Privacy Control (GPC) signal, so if a visitor's browser tells your website they don't want their data sold or shared, Cookiebot respects it.

How easy is Cookiebot to set up?

Very. And I say that as someone who has wrestled with more tracking scripts than I care to remember.

When you sign up, you add your website and Cookiebot scans it. You choose a legislation preset (for example GDPR for Europe, or CCPA, CPA or the CIPA/VPPA template for the US), and Cookiebot configures the right consent model for you. Then you pick how to add it to your website:

• WordPress plugin. The free Cookiebot plugin for WordPress sets up in under five minutes. Install and activate the plugin, connect your free Cookiebot account, paste in your Domain Group ID, and your banner is live.
• Google Tag Manager. Add Cookiebot through GTM, which is what most marketers running Google Ads will want.
• Manual script. Copy one line of code into the head of your website. That's it.
• Shopify and Wix. There are dedicated integrations for both, plus HubSpot, Umbraco and other major CMS platforms.

Here's a detail I absolutely loved, as someone who spends most of my working day with AI. The Cookiebot WordPress plugin ships with an AGENTS.md and a CLAUDE.md file, written so that AI coding assistants like Claude, ChatGPT, Cursor and GitHub Copilot can read the setup steps and verification checklist and help you install it correctly. That's a company thinking about how people work in 2026, and I don't see many others doing it.

If you're comparing options for your WordPress site, my guide to which cookie consent WordPress plugin to use is a good companion to this review.

Customising your Cookiebot banner

A cookie banner is often the very first thing a visitor sees on your website, so it has to look like it belongs to you. Cookiebot makes that easy.

You can start with a pre-built template (a banner, a pop-up dialog or an inline widget), then add your logo and change the colours, fonts, wording and button styles to match your brand, with a live preview on desktop and mobile as you go. If you want full control, you can build a completely custom banner with HTML, CSS and JavaScript.

Then there's the clever stuff:

• Geotargeting. Show the right banner to the right visitor depending on where they are, so European visitors get an opt-in banner and US visitors get the setup that fits US law.
• 47+ languages with auto-translation. Your banner speaks your visitor's language automatically.
• Cross-domain consent sharing. Visitors only have to make their choice once across your related websites.
• Privacy trigger. A little icon that lets visitors change or withdraw consent at any time, from any page.

I also love that the Cookiebot banner gives Deny, Customize and Allow all equal weight. That's not just good manners. It's what privacy laws increasingly expect, and it builds trust with your visitors.

Cookiebot analytics and add-ons

This is where Cookiebot goes beyond what I expect from a consent tool.

Every Premium plan includes an analytics dashboard with opt-in and opt-out statistics, so you can see how visitors respond to your banner over time, and a CSV export of every consent, including categories. That's your consent record if you ever need it.

Then there are the new Cookiebot add-ons. They run on the Cookiebot script you've already installed, so there's no new code and no developer needed, and you manage them from the same dashboard. Cookiebot says add-ons are included in your subscription during the launch period.

Audience Survey

This one made me smile, because it solves the attribution problem I talked about at the start. Audience Survey asks your visitors one simple question (how did you hear about us?) and shows you which channels are driving your traffic, in a live dashboard inside Cookiebot.

The clever part is that it works regardless of consent status. It appears after a visitor has interacted with your cookie banner, whether they opted in or out. So you get first-party attribution data from podcasts, referrals, events and word of mouth, the channels no tracking pixel will ever see. For marketers deciding where to spend their budget, that's gold.

Consent Rate Benchmark

Consent Rate Benchmark, which Cookiebot is rolling out now, shows your opt-in rate next to your industry average and the top performers, with tips on how to improve your banner. Every extra visitor who opts in is more data for your analytics and your ad campaigns, so this is a very practical way to win some of that lost data back.

Beyond Google: Microsoft and Amazon consent

If you advertise on more than one platform, Cookiebot has you covered there too.

It supports Microsoft UET Consent Mode, so your Microsoft Advertising conversion tracking keeps working for European audiences, and Amazon Consent Signal, so consent is shared automatically with Amazon Ads. It's also certified under the IAB Transparency and Consent Framework, which matters if you run programmatic advertising or monetise your site with ads.

How much does Cookiebot cost?

Cookiebot is very affordable, and you can start for free. Its pricing page sums it up nicely: cheaper than a GDPR fine.

Here's how the Cookiebot Core pricing works:

• Free plan. One domain, up to 50 subpages and unlimited users, with compliance for GDPR, ePrivacy and US state laws, plus Google Consent Mode. Manual blocking only, as automatic blocking needs a paid plan. No credit card needed.
• Premium plans from $8 a month (or €7 in Europe). Premium comes in Lite, Small, Medium, Large and Extra Large tiers, based on how many subpages your website has. You get everything in the free plan, plus your own branded banner design, multiple domains, advanced automated reporting, 47+ languages, banner distribution by region and country, and no traffic limitations.
• Usercentrics Advanced for multi-brand and enterprise businesses, priced on request.

Every Premium plan starts with a 14-day free trial with all premium features unlocked, and no credit card required. When you sign up, Cookiebot scans your website and recommends the right tier for its size. You can upgrade or cancel at any time.

If you'd like the full breakdown, I've written a dedicated guide to how much Cookiebot costs.

Start with a free Cookiebot scan

If you only do one thing after reading this review, make it this.

Cookiebot's free cookie scanner tells you exactly which cookies and trackers your website is using, in about two minutes. You just enter your website address. It detects first-party and third-party cookies and tracking requests, categorises them by purpose and provider, and checks them against major US, EU and global privacy laws like GDPR and CCPA to flag where you might be at risk. Then it emails you a detailed report you can share with your developer or legal team.

It's free forever, there's nothing to install, and I'd bet good money that most website owners who run it will find at least one tracker they didn't know was there. That's not a scare tactic. It's just how websites work once you've added a few plugins and marketing tools over the years.

Who is Cookiebot best for?

Based on everything I've looked at for this Cookiebot review, it's a brilliant fit for:

• Marketers running Google Ads, GA4, Meta or Microsoft Ads who want clean consent signals, full remarketing audiences and reliable conversion data
• Businesses with European or UK visitors who need a Google-certified CMP for Consent Mode v2
• US businesses with California visitors who want to close the CIPA gap with the CIPA/VPPA template
• Founders and entrepreneurs on WordPress who look after their own website and want a banner live in minutes
• Agencies managing lots of client websites, who need multiple domains, automated monthly scans and a dashboard that keeps every site in check. Usercentrics also runs a partner network of more than 5,400 partners.
• Anyone who has added plugins, embeds and marketing tools over the years and isn't 100% sure what their website is tracking any more

My Cookiebot review verdict

Most consent tools sell you a cookie banner. Cookiebot sells you working marketing data.

On paid plans, it scans your website every month for every cookie and tracker. It blocks them until your visitors say yes. It sends clean consent signals to Google, Microsoft and Amazon so your remarketing, conversion tracking and Smart Bidding keep working. It gives US businesses a ready-made CIPA template and European advertisers a Gold Tier, Google-certified Consent Mode v2 setup. And with add-ons like Audience Survey, it even helps you see the traffic that tracking can't.

All for a free plan, or from $8 a month. That's less than most of us spend on a single software subscription we've forgotten we have.

If you're a marketer, your data is only as good as the consent behind it. Cookiebot helps keep your data both compliant and complete, and it does it without you needing a developer or a lawyer on speed dial.

So here's my advice. Run a free Cookiebot scan of your website today, see what it finds, then start your 14-day free trial and get it fixed. Your future self, and your Google Ads account, will thank you.

Cookiebot review FAQs

Is Cookiebot worth it?

For most businesses, yes. Cookiebot automates cookie scanning, prior consent blocking and consent signalling to Google, Microsoft and Amazon, which protects both your marketing data and your compliance. There's a free plan for small websites, Premium starts from $8 a month, and you can try every premium feature free for 14 days.

Is Cookiebot free?

Yes, Cookiebot has a free plan for one domain with up to 50 subpages, including compliance for GDPR, ePrivacy and US state laws, plus Google Consent Mode. The free plan uses manual blocking, and after your first automatic scan you run new scans yourself. Automatic blocking, monthly rescans, larger websites and premium features like custom branding and multiple domains need a Premium plan.

How much does Cookiebot cost?

Cookiebot Premium plans start from $8 a month (€7 in Europe), and the price depends on how many subpages your website has. Every plan starts with a 14-day free trial, no credit card required. See my full guide to Cookiebot pricing.

Is Cookiebot Google certified?

Yes. Cookiebot is a Gold Tier partner in Google's CMP Partner Program, the highest level, and was among the first CMPs certified when the programme launched in May 2023. It's also one of a small number of CMPs with direct integrations inside Google Ads, Google Analytics and Google Tag Manager.

Does Cookiebot work with Google Analytics 4 and Google Ads?

Yes. Cookiebot supports Google Consent Mode v2 and automatically signals each visitor's consent to GA4, Google Ads, gtag and Google Tag Manager. It also supports Advanced Consent Mode, so Google can use conversion modelling for visitors who decline.

Does Cookiebot help with CIPA?

Cookiebot offers a CIPA/VPPA template that shows an opt-in banner and blocks high-risk tools like session replay, chat widgets and ad pixels until a visitor actively consents, which is the gap CIPA demand letters target. Cookiebot is clear that this is a configuration change rather than a compliance guarantee, so speak to a lawyer if you've received a demand letter.

Does a CCPA cookie banner protect me from CIPA claims?

Generally, no. The CCPA uses an opt-out model, so most CCPA banners let tracking tools run before a visitor makes a choice. CIPA claims argue that consent is needed before collection starts, which is why an opt-in setup like Cookiebot's CIPA/VPPA template matters.

Does Cookiebot work with WordPress?

Yes. The free Cookiebot by Usercentrics plugin for WordPress sets up in under five minutes, scans and blocks cookies automatically, and has Google Consent Mode enabled by default. It even includes AGENTS.md and CLAUDE.md files so AI coding assistants can help you set it up.

What is Google Consent Mode v2?

Google Consent Mode v2 is the way your website tells Google what each visitor has consented to, including the newer ad_user_data and ad_personalization signals. Google requires businesses using its services in the EEA, UK and Switzerland to use it through a certified CMP. Read my full explainer on Google Consent Mode v2.

How do I check what cookies my website uses?

Use Cookiebot's free cookie scanner. Enter your website address and it detects your cookies and trackers, categorises them and emails you a compliance report in about two minutes.

Every Sunday I send a newsletter to marketers, entrepreneurs, founders and agencies about AI, marketing and running a business. You can sign up here.