Cookiebot CMP in 2026: a complete review of pricing, features, and service limitations

Cookiebot CMP is a consent management platform that scans a website, controls trackers, and stores a visitor's choice. It is used for cookie banners, Google Consent Mode v2, and managing non-essential tags. In a real project, the main risks are tied to the number of URLs, script loading order, and the loss of some analytics signals after users decline consent. This becomes especially noticeable when Google Ads automation depends on stable conversion data.

Short verdict: Cookiebot is a good fit for websites that need automated scanning, IAB TCF, and a mature Google integration. As of September 2026, paid plans on Cookiebot's official pricing page start at $8 per month, but the actual tier depends on the number of URLs found by the scanner. For agencies, this mechanism is multiplied by the number of client domains, so local SEO across multiple projects or a large catalog should be evaluated by total cost of ownership, not only the entry-plan price.

What is Cookiebot CMP and why does a website need it

Cookiebot CMP centralizes the collection, storage, and transmission of a user's decision about cookies and trackers. A CMP does not replace a legal audit, but it turns privacy requirements into technical logic: it shows the required banner, blocks specified categories before consent, and records the consent state.

Under GDPR, non-essential trackers generally should not run before valid consent is obtained. In CCPA/CPRA modes, the emphasis shifts toward notice and the ability to opt out of the sale or sharing of data. Geotargeting allows different banner models to be shown depending on the region. For an e-commerce team managing multiple sites, this is more convenient than maintaining separate custom logic in every template.

Technically, a CMP operates between the page and browser tracking systems. It categorizes cookies, manages permissions, and passes the consent signal into the advertising stack. In practice, the CMP must correctly preserve the user's choice while they move between pages and pass it to analytics and advertising systems without restarting non-essential trackers.

How much does Cookiebot CMP cost in 2026

Cookiebot calculates pricing by domain and the number of unique URLs, not by pageviews. As of September 2026, the official Cookiebot pricing page offers USD tiers ranging from Free to Premium XLarge. The platform determines the Premium tier by the number of subpages, meaning unique URLs found by the scanner. Taxes and billing periods can change the final amount. Current thresholds and prices should be checked directly on Cookiebot's official pricing page before purchase.

The practical risk appears near plan thresholds. Under Cookiebot's rules, Premium Small at $16 per month per domain applies to accounts with four or more domains; with fewer domains, a site with 50–349 subpages may be billed as Medium. For an agency managing multiple domains, one site moving from 349 to 350+ subpages means moving from Small at $16 to Medium at $34. Traffic does not necessarily need to change for this to happen.

For agencies, the math is more noticeable. Five client domains on Small cost from $80 per month. If two of them move to Medium, the total rises to $116. Also account separately for subdomains, staging, VAT, and specialist time spent reviewing the URL list.

Before setup, it is worth checking the site's structure. This reduces the risk of moving to a more expensive tier because of technical URLs.

1. export canonical HTML URLs from the sitemap and CMS
2. remove internal links to test and error pages
3. handle parameter-based duplicates with correct routing rules
4. request a preliminary estimate of the subpage count
5. set a budget threshold and review the URL list after every scan

What technical capabilities does Cookiebot provide

Cookiebot covers four core tasks: finding trackers, controlling when they run, adapting the banner to the brand, and applying the required configuration by geography. The scanner saves the most manual work, but its results still need to be reviewed after significant changes to tags or site templates.

How automatic cookie scanning works

The scanner crawls accessible HTML content, follows internal links, and interacts with page elements. It can discover dynamic URLs, old test pages, and 404 addresses if the site still links to them. Detected cookies and trackers are assigned to categories, while unknown entries require manual review.

How autoblocking stops scripts before consent

In autoblocking mode, Cookiebot loads synchronously and checks other scripts before they execute. This provides broad coverage, but adds work to the critical rendering path. Manual blocking through GTM gives more control over loading order, but the team becomes responsible for the consent requirements of each tag.

Can the Cookiebot banner be customized for region and brand

Paid plans allow you to change the layout, colors, text, logo, and CSS, and to distribute banners by country. Cookiebot states that it supports more than 47 languages for the consent banner and cookie declaration. The translation should still be reviewed by a local editor or lawyer, because a correct interface does not prove that the legal basis is correct.

Run visual checks on a mobile screen, with enlarged text, and with marketing cookies disabled. The banner should not cover the close button, break keyboard focus, or push the user toward one choice through dark patterns.

After publishing, test the banner in a clean browser profile. Go through a first visit, full rejection, partial consent, reopening the settings, and expiry of the consent cookie.

How Cookiebot works with Google Consent Mode v2 and IAB TCF

Cookiebot passes the visitor's decision to Google tags and ad-tech vendors in a standardized form. Consent Mode v2 manages the ad_storage, analytics_storage, ad_user_data, and ad_personalization states; Cookiebot states that Consent Mode v2 is enabled by default in its Google integration. IAB TCF passes a standardized TC string through the advertising chain.

In early September 2026, Cookiebot still documents support for TCF 2.3 in its product materials, while IAB has already published TCF 2.4; for web environments, the migration deadline to 2.4 is October 23, 2026. Before launching a publisher advertising stack, check the current version in Cookiebot's documentation for TCF and the Google Consent Mode integration.

In basic mode, tags that require consent do not run until permission is granted. In advanced mode, Google tags can send cookieless pings with denied states, which are used for modeling. This does not restore individual user data and does not override the requirements of a specific jurisdiction.

The Google Tag Manager setup is better treated as a separate process rather than a single code insertion.

1. add the Cookiebot CMP template to the GTM container
2. define the initial consent state before Google tags run
3. assign consent requirements to third-party tags
4. replace the regular page-load trigger with a consent-update event where needed
5. verify the states in Tag Assistant for accept, reject, and granular consent settings
6. publish the container after testing in a separate environment

IAB TCF is mainly needed by publishers and sites with programmatic advertising. IAB TCF creates a TC string that encodes processing purposes, vendors, and legal bases. For a corporate website without programmatic advertising, this level of complexity is often unnecessary.

The most useful test starts after clicking Reject. If GA4 or an advertising pixel continues writing cookies, the banner serves a visual purpose but does not provide the expected technical behavior.

How Cookiebot affects website speed and analytics accuracy

The impact depends on the blocking mode and banner implementation. Synchronous autoblocking sits on the critical path and can add delay, so the actual impact is better measured on the specific site rather than estimated using a universal number. Measure LCP, INP, and CLS on real mobile devices before and after integration.

CLS often appears when a video, map, or other embed is inserted after consent without reserved space. A practical solution is to give the container fixed dimensions and show a neutral placeholder. If LCP gets worse, check manual blocking, the order of third-party tags in GTM, and deferred loading of heavy widgets.

An analytics gap appears when some users decline analytics_storage. GA4 can no longer observe the full event sequence in the same way as before the CMP, while cohort analysis and attribution receive less observable data. Advanced Consent Mode adds modeling, but the model is not a raw event log.

For control, split the metrics into two sets. The technical set includes consent rate, the share of unknown cookies, tag errors, and Core Web Vitals. The business set compares backend orders with analytics conversions, ROAS, and the share of modeled data.

How to install Cookiebot on WordPress, Shopify, or a custom site

Installation comes down to loading the CMP early, blocking non-essential tags, and checking every consent state. The difference between platforms is who controls the ``, native scripts, and the loading order of third-party code.

How to install Cookiebot on WordPress

For WordPress, the official plugin is convenient. After installation, check not only the homepage but also forms, videos, WooCommerce, and cached pages.

1. install the Cookiebot CMP plugin from the WordPress dashboard
2. paste the Domain Group ID from the Cookiebot account
3. choose automatic or manual blocking based on the plugin stack
4. clear the page cache and CDN
5. test key pages in a private window

How to install Cookiebot on Shopify

For Shopify, the official app through App Embed is more practical. Native Shopify scripts may load before third-party code, and the Customer Privacy API passes the consent state but does not itself block cookies before consent.

1. install the Cookiebot CMP app from the Shopify App Store
2. enable App Embed in the theme settings
3. verify regions in Customer Privacy settings
4. test the storefront in preview and production
5. test Shopify Analytics and advertising pixels after Reject

How to add Cookiebot to a custom site

On a custom site, the CMP script must appear before the tags it controls. The main risk here is not inserting the script itself, but getting the order of the default consent state and third-party tags wrong.

1. create a domain group and configure the banner template
2. insert the CMP script as high as possible in ``
3. assign categories to third-party scripts or move them into GTM
4. set the default consent state before the Google tag
5. check Network, Application Cookies, and dataLayer for each choice
6. document the retesting procedure after releases

What Cookiebot pros and cons should be considered before paying

Cookiebot's strength is its mature integration set and scanning automation. Its weak point for large sites and agencies is cost predictability, because the plan depends on the number of URLs rather than actual traffic.

If the site is small and stable in terms of page count, the pricing model is fairly easy to understand. If the CMS generates filters, language duplicates, staging URLs, or a large catalog, it is better to audit the URL list separately before paying.

Is Cookiebot worth using in 2026

Cookiebot is worth considering if a site needs automated scanning, a mature Google Consent Mode v2 integration, geotargeting, and IAB TCF support. It is best suited to international projects, publishers with programmatic advertising, and teams that want to centralize consent management without building their own CMP logic.

Yes — for an international website in the Google ecosystem. Cookiebot combines Consent Mode v2, GTM, automated scanning, and 47+ languages in one product.

Yes, but calculate the full cost — for an agency or multiple domains. Each domain is priced separately, and crossing a subpage threshold can automatically increase the plan cost.

Not always — for a small WordPress site. If there is no complex advertising stack, a solution with an annual WordPress license may be cheaper and easier to administer.

Compare alternatives — if predictable budgeting is the main criterion. Cookiebot pricing depends on site structure, so catalogs, language versions, and technical URLs can affect the plan even without traffic growth.

Cookiebot or an alternative CMP: what should you choose for your project

Cookiebot should be chosen based on technical fit, not brand familiarity. For a publisher with programmatic advertising, IAB TCF and the vendor list matter. For a small WordPress site, an annual license may be a stronger criterion, while for an agency the priorities may be centralized management of multiple sites and a predictable budget.

The table shows trade-offs, not a universal winner. Pricing models and key feature data should be checked against the official Cookiebot, CookieYes, and Complianz pages immediately before migration; alternative providers can change their terms. For Termly and consentmanager, use the official Termly pricing page and the consentmanager feature and pricing table respectively. Run the same test scenario for each option: scan representative pages, Reject all categories, check GTM, measure Web Vitals, and export the consent log. Comparing plan price alone is not enough.

One more question matters for the team: how quickly will it notice that a new tag bypassed the rules or changed behavior after a release? That is why a technical test after every tag change is more important than a one-time banner setup.

How an agency can separate CMP and client work sessions

A CMP handles a visitor's consent on a specific website, but it does not solve the agency's operational problem of opening WordPress, GTM, and advertising accounts for multiple clients in the same browser. In that scenario, cookies, local storage, and active logins from different projects can become mixed.

For this workflow, Afina provides a separate isolated browser profile for each client: its own cookies, storage, history, and fingerprint. Profiles can be organized into project groups and the team can be given access to the required set through collaboration tools. This is not a replacement for a CMP. Cookiebot controls consent on the website, while profile isolation reduces operational confusion between client environments.

Download