Setting up Cookiebot in a GDPR-compliant way

Cookiebot CMP (cookiebot.com, part of Usercentrics) combines a monthly cookie scan, a consent banner and automatic script blocking. Its effectiveness stands or falls with a correct integration in “auto-blocking” mode.

Cookiebot works in two modes. In automatic mode (auto-blocking) the script tries to prevent all known trackers before consent by intercepting their execution. This only works if the Cookiebot script really is the first in the head — any script before it escapes its control. In manual mode Cookiebot blocks nothing itself; instead all tags have to be marked with type="text/plain" and a data-cookieconsent attribute, or wired up through the consent API.

The monthly cookie scan is Cookiebot's core function, but it has the usual limits of automatic scanners: it crawls a limited number of subpages, only detects what loads at the time of the scan, and classifies cookies using a database that does not know every niche service. Unknown cookies end up as “unclassified” and have to be categorised manually.

Cookiebot has belonged to Usercentrics since 2021. The free plan (one domain, up to 50 subpages) is considerably more limited than the paid ones: according to comparison sites (as of 2026) it offers only manual blocking instead of auto-blocking, one banner language, hardly any design options and a short validity for stored consent. Anyone on the free plan therefore has to mark up every tag themselves with data-cookieconsent. Paid plans are billed by number of subpages. Check current plan details on cookiebot.com before deciding.

Manual markup looks like this: <script src="…"> becomes <script type="text/plain" data-cookieconsent="statistics" src="…"> — the browser treats the script as text until Cookiebot activates it after the matching consent. Valid values are preferences, statistics and marketing (also combined, e.g. "statistics, marketing"). data-cookieconsent="ignore" deliberately excludes a script from auto-blocking — this should only apply to scripts that are genuinely necessary. Your own code can read the status via window.CookieConsent.consent.statistics or .marketing; server-side it is stored in the "CookieConsent" cookie.

The Cookiebot scan and a consent check like consentglass answer different questions. The Cookiebot scan inventories which cookies and services appear on the subpages and fills the cookie declaration with them. It does not check whether the banner actually blocks in live operation: for that you have to look from the outside at which requests and cookies occur on the first visit before any consent. That is exactly where the typical integration mistakes show up — a script before the Cookiebot tag, a forgotten data-cookieconsent, a tag manager container that fires independently of the banner.

Is this a risk?

In manual mode Cookiebot blocks nothing by itself — every tag then has to be wired up via the data-cookieconsent attribute or through Google Consent Mode. If this is forgotten, the tracker loads despite a rejection and the legal basis under Section 25(1) TDDDG is missing. Even auto-blocking mode does not reliably catch server-side tags or scripts loaded only after interaction.

What you can do

• Enable auto-blocking and load the Cookiebot script as the very first element in the <head>, before all other scripts.
• After the monthly scan, assign the detected cookies to categories manually and research unclear entries yourself.
• Enable Google Consent Mode v2 in the Cookiebot settings if Google services are in use.
• In a private window, after clicking “Reject”, check whether requests to tracking hosts still appear in the network tab.

Häufige Fragen

Is Cookiebot's auto-blocking mode enough?

For many standard trackers yes, but only if the Cookiebot script really loads first in the head. It does not reliably catch server-side tags and scripts loaded only after a click — those have to be wired up manually.

Is the free Cookiebot plan enough?

For small sites it can be, if you know the limits: according to current plan comparisons the free plan has no auto-blocking, so every tag must be marked up manually with type="text/plain" and data-cookieconsent. Whether the result holds up depends on that integration, not on the plan.

What does data-cookieconsent mean?

The attribute assigns a script to a consent category (preferences, statistics, marketing). Together with type="text/plain" the script only loads once that category has been allowed. data-cookieconsent="ignore" excludes a script from auto-blocking.

Do I have to check the cookie scan report?

Yes. Unclassified cookies have to be assigned to a category manually, otherwise Cookiebot treats them as “not necessary” in case of doubt and blocks them or displays them incorrectly.

Does Cookiebot work with Google Consent Mode v2?

Yes, the integration can be enabled in the settings. But it does not replace script blocking — it adds the transmission of signals to Google.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.