Is Cookiebot's auto-blocking mode enough?

For many standard trackers yes, but only if the Cookiebot script really loads first in the head. It does not reliably catch server-side tags and scripts loaded only after a click — those have to be wired up manually.

Is the free Cookiebot tier GDPR-compliant?

Yes, functionally identical in terms of blocking. The difference is only the branding (Cookiebot logo in the banner) and the limit of 50 subpages.

Do I have to check the cookie scan report?

Yes. Unclassified cookies have to be assigned to a category manually, otherwise Cookiebot treats them as “not necessary” in case of doubt and blocks them or displays them incorrectly.

Does Cookiebot work with Google Consent Mode v2?

Yes, the integration can be enabled in the settings. But it does not replace script blocking — it adds the transmission of signals to Google.

Setting up Cookiebot in a GDPR-compliant way

Cookiebot CMP (cookiebot.com, part of Usercentrics) combines a monthly cookie scan, a consent banner and automatic script blocking. Its effectiveness stands or falls with a correct integration in “auto-blocking” mode.

Cookiebot works in two modes. In automatic mode (auto-blocking) the script tries to prevent all known trackers before consent by intercepting their execution. This only works if the Cookiebot script really is the first in the head — any script before it escapes its control. In manual mode Cookiebot blocks nothing itself; instead all tags have to be marked with type="text/plain" and a data-cookieconsent attribute, or wired up through the consent API.

The monthly cookie scan is Cookiebot's core function, but it has the usual limits of automatic scanners: it crawls a limited number of subpages, only detects what loads at the time of the scan, and classifies cookies using a database that does not know every niche service. Unknown cookies end up as “unclassified” and have to be categorised manually.

Cookiebot has been part of Usercentrics since 2021. For small websites there is a free tier (up to 50 subpages) that shows the Cookiebot brand in the banner. The paid tiers allow white-labelling and more subpages. Functionally the tiers do not differ in blocking — the decisive factor remains the correct technical integration.

Is this a risk?

In manual mode Cookiebot blocks nothing by itself — every tag then has to be wired up via the data-cookieconsent attribute or through Google Consent Mode. If this is forgotten, the tracker loads despite a rejection and the legal basis under Section 25(1) TDDDG is missing. Even auto-blocking mode does not reliably catch server-side tags or scripts loaded only after interaction.

What you can do

Enable auto-blocking and load the Cookiebot script as the very first element in the <head>, before all other scripts.
After the monthly scan, assign the detected cookies to categories manually and research unclear entries yourself.
Enable Google Consent Mode v2 in the Cookiebot settings if Google services are in use.
In a private window, after clicking “Reject”, check whether requests to tracking hosts still appear in the network tab.

Häufige Fragen

Is Cookiebot's auto-blocking mode enough?: For many standard trackers yes, but only if the Cookiebot script really loads first in the head. It does not reliably catch server-side tags and scripts loaded only after a click — those have to be wired up manually.
Is the free Cookiebot tier GDPR-compliant?: Yes, functionally identical in terms of blocking. The difference is only the branding (Cookiebot logo in the banner) and the limit of 50 subpages.
Do I have to check the cookie scan report?: Yes. Unclassified cookies have to be assigned to a category manually, otherwise Cookiebot treats them as “not necessary” in case of doubt and blocks them or displays them incorrectly.
Does Cookiebot work with Google Consent Mode v2?: Yes, the integration can be enabled in the settings. But it does not replace script blocking — it adds the transmission of signals to Google.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.

This text is general information to the best of our knowledge, not legal advice. For an individual case, consult a law firm specialising in IT law.

Setting up Cookiebot in a GDPR-compliant way

Is this a risk?

What you can do

Häufige Fragen

How consentglass helps

Read on