Cookiebot alternatives
For a site that runs Cookiebot and has outgrown its tier, or wants features its plan leaves out. Cookiebot and 6 platforms a Cookiebot site can move to, measured against what the GDPR, the ePrivacy Directive and the California rules ask of a banner, from each vendor’s own pages. read 2026-10-22
Best for a large site with modest traffic
Usercentrics
Same company, but billed on sessions with unlimited subpages; GPC and downloadable consent proof are on every plan.
Best for an agency running many WordPress sites
Complianz
Licensed per install with no page view or session limits, and the agency licence adds a multisite plugin.
Best for a one-site shop on the free plan
CookieHub
Blocking, proof of consent and GPC on every plan, where Cookiebot's free plan blocks only through manual markup.
The requirements, platform by platform
Each row is something the rules ask of a cookie banner, with the article or section it comes from. Cookiebot sits in the first column so you can see what a switch gains or loses on each row. “paid plan” means the feature is not on the free plan; the note under it names the plan where it starts, when the vendor says. The wider field, without Cookiebot as the starting point, is on our consent management platforms page.
| Requirement | Cookiebot | Usercentrics | OneTrust | iubenda | CookieYes | CookieHub | Complianz |
|---|---|---|---|---|---|---|---|
| Blocks non-essential cookies until consentePrivacy Art. 5(3); GDPR Art. 6(1)(a) | yesmanual on the free plan | paid planauto-blocking from Essential | yes | yes | yes | yes | yesknown services |
| Keeps a consent record you can exportGDPR Art. 7(1) | paid planCSV; records kept 12 months | yesdownloadable for 12 months | yesConsent Receipt, exportable logs | not statedrecords kept | yesCSV; 1 year on free | not statedproof of consent kept | paid planrecords; export not stated |
| Honors Global Privacy Control signalsCCPA regs § 7025(b) | yes | yes | yes | yes | paid plan | yes | paid plan |
| Shows a “Do Not Sell or Share” linkCal. Civ. Code § 1798.135(a)(1) | yesto visitors detected in California | not statedCCPA/CPRA framework listed | yesopt-out mechanisms | yes“Your Privacy Choices” link | yes | yes | yesopt-out page |
| Offers a data processing agreementGDPR Art. 28(3) | yes | yes | yeson its legal site | yes | yes | yes | not stateddata stays on your server |
| Serves a different banner by regionopt-in (ePrivacy Art. 5(3)) vs opt-out (§ 1798.135) | paid plan | paid planfrom Plus | yes | paid plan | paid plan | paid plan | paid plan |
| Supports the IAB Transparency and Consent FrameworkIAB Europe TCF (ad-funded sites) | paid plan | paid planfrom Pro | yesTCF v2.3 | paid plan | paid plan | paid plan | paid plan |
| Finds new scripts on a schedule (scanner)what ePrivacy Art. 5(3) covers on your site | paid planfree: one initial scan | paid planfree: once at setup | yes | partialauto-blocking labelled experimental | yes100 pages a scan on free | yes50 pages scanned on free | yesfull site scan premium |
| On Google’s certified CMP listGoogle ads in the EEA, UK and Switzerland | yes | yes | yes | yes | yes | yes | yes |
Source: vendor documentation, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | |||||||
How Cookiebot’s plans are tiered
Cookiebot does not meter traffic. Its pricing page says it “does not charge based on page views or usage”: the plan follows the number of subpages on each domain, and each domain is billed separately. A subpage is any unique URL. So a large site with little traffic pays a large-site tier, and a ten-page site with a million visits can stay on the free plan.
| Plan | Subpages per domain | Domain rule |
|---|---|---|
| Free | up to 50 | 1 domain only; no Premium features |
| Premium Lite | fewer than 50 | 1 domain only |
| Premium Small | 50 to 349 | accounts with four or more domains |
| Premium Medium | 350 to 3,499 | also any domain under 350 in a one-to-three-domain account |
| Premium Large | 3,500 to 6,999 | per domain |
| Premium Extra Large | 7,000 or more | per domain |
Source: cookiebot.com/en/pricing, plan cards and FAQ, read 2026-10-22. Prices are not shown on this site. | ||
Four rules that move a Cookiebot bill
- The highest count wins. The scanner crawls each domain every month, and the plan is set by “the highest page count recorded during the website scan history”. Pruning pages later does not undo a peak.
- Plans move up on their own. If the scanner finds more subpages than the plan allows at the end of a billing cycle, the subscription upgrades to the next tier. You cannot pick a Premium tier by hand.
- Subdomains are separate domains. shop.example.com and example.com are two subscriptions; example.com/en and example.com/de are one. Adding both example.com and www.example.com bills both.
- Small domains cost more in small accounts. With one to three domains, a domain under 350 subpages falls under Premium Medium. The Small plan is offered only to accounts with four or more domains.
A new account runs every Premium feature free for 14 days. If you have not chosen a plan when it ends, the setup stays in your account but the banner is no longer displayed, so the site stops collecting consent. The free plan keeps one domain of up to 50 subpages, with manual blocking only, consent that expires after up to one month instead of twelve, and no CSV export of consents.
Find your tier before you compare
Enter each domain and subdomain with its page count to see where Cookiebot’s rules put it, beside the plan its sister product, Usercentrics, would meter on sessions instead. The gap between the two answers is the first thing a switch has to beat. To see how the rest of the field meters, read the next section; to judge the banner you run today, use the cookie banner checklist.
Pre-filled with a realistic example. Your numbers stay in this browser tab.
Cookiebot, billed per domain by subpages
Premium Medium × 2
- example-shop.com: Premium Medium
- blog.example-shop.com: Premium Medium
Usercentrics Web CMP, billed by sessions
Pro
9,000 sessions a month on 2 domains. Subpages do not count.
Tier names only, from each vendor’s pricing page read 2026-10-22. Both vendors move you up a tier automatically when you pass a limit; confirm the tier with the vendor before you buy.
What each alternative bills on
Plans are hard to compare across vendors because each one counts something different. Cookiebot counts pages. Most of the others count traffic, and one counts installs. Match the meter to the number your site has the most of: a large catalogue with modest traffic suits a traffic meter, and a small site with heavy traffic suits Cookiebot’s.
| Platform | Billed on | Free plan | What moves you up |
|---|---|---|---|
| Cookiebot | subpages per domain | 1 domain, up to 50 subpages | The scanner finds more subpages, or you add a domain |
| Usercentrics | sessions a month + domains | fewer than 1,000 sessions, 1 domain | Sessions pass the plan's limit; more than one domain needs Pro |
| OneTrust | average daily visitors | none listed | A quote, across all channels and properties |
| iubenda | pageviews a month, per site | yes; limits not on the plan page | Pageviews past the quota are charged as overage |
| CookieYes | pageviews a month, per domain | 5,000 pageviews a month | Paid plans charge per 1,000 extra pageviews |
| CookieHub | sessions a month | fewer than 1,000 sessions a month | A plan with more included sessions |
| Complianz | WordPress installations (licences) | the free plugin | More sites to license; no page view or session limits |
Source: each vendor’s own plan or pricing page, read 2026-10-22. No prices are shown on this site. | |||
Cookiebot and Usercentrics: one company, two products
Cookiebot is a Usercentrics product, and Cookiebot’s own pricing page sells both: “Cookiebot Core” on subpages and “Usercentrics Advanced” on sessions, for unlimited domains, through sales. Its FAQ says the two are “based on different technologies and functionalities”, so you cannot upgrade from one to the other inside the product. Moving from Cookiebot to Usercentrics is a new setup, like moving to any vendor in the table. Usercentrics’ own pricing page also sells self-serve Web CMP plans, metered on sessions and domains, which are the plans compared here.
A Usercentrics or CookieHub session is not quite an analytics session, and a pageview quota counts every reload. Take a month from your analytics, add a margin, and check how each vendor treats the overage: Cookiebot and Usercentrics both move you up a plan automatically. If the switch is about the banner rather than the bill, our CookieYes alternatives page compares the same rows for the other common free banner.
Leaving Cookiebot without a gap in consent
A switch fails in two places: the record of past consents gets left behind, and scripts end up either blocked for good or running before anyone has agreed. Work through it in this order.
“Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.”
- Take the consent log out first. On a Premium plan, export the CSV of all consents while the account is live; Cookiebot keeps consent records for up to 12 months. The free plan has no CSV export. Either way, Cookiebot’s data processing agreement (section 11.1) says that when the agreement ends it will, at your option and request, hand over the data files from the work “without undue delay, at the latest within 30 days”, or destroy them. Ask in writing, and keep the reply with the export.
- Find Cookiebot’s markup before you remove its script. With manual blocking, Cookiebot asks you to change each tracking script to
type="text/plain"and tag it withdata-cookieconsent. A browser never runs atext/plainscript on its own, so with Cookiebot gone those tags stay silent. Search your templates and tag manager fordata-cookieconsentand redo each one in the new platform’s own way. Never just switch them back to JavaScript: they would run before consent. - Put the new banner live before the old one stops. When a Cookiebot trial ends without a plan, the banner is no longer displayed. Swap the scripts in one release so the site never runs with no banner, or with two.
- Expect to ask every visitor again. The new platform keeps its own record from its own banner. Unless the vendor says in writing that it can read the choices Cookiebot stored, plan for returning visitors to see the new banner once.
- Sign the new processor’s terms and test. The new vendor processes visitor data for you, so it needs a processing agreement under Art. 28(3). Check the vendor’s terms against our data processing agreement template. Then open the site with Global Privacy Control switched on and check the result with the GPC checker.
“… at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing …”
The export is your proof for the consents collected under Cookiebot. File it with the date you switched, so a question about a visitor from before that date can still be answered.
Each platform in short
What each one is, who it fits, how it meets the rows, and what to confirm with the vendor. Cookiebot comes first, as the plan you are measuring the others against.
Cookiebot
What it is
The consent platform you are leaving, or deciding to keep. A Usercentrics product, billed per domain on subpage count.
Who it fits
A site with few pages and heavy traffic: the free plan has no traffic limit, and Premium tiers do not charge on page views.
What the rule requires and whether it meets it
GPC on every plan, and a “Do Not Sell Or Share” link shown to visitors it detects as Californian. Automatic blocking, scheduled scans, geotargeting, the IAB framework and CSV export of consents are Premium.
Check with the vendor
Which tier the scanner will put each of your domains in, subdomains included. The tier follows the highest page count ever recorded.
Usercentrics
What it is
Cookiebot’s sister product from the same company, sold as self-serve Web CMP plans metered on sessions and domains.
Who it fits
A large site with modest traffic, where a session meter beats a page meter. Subpages are unlimited on every plan.
What the rule requires and whether it meets it
GPC and downloadable proof of consent (12 months) are on every plan. Auto-blocking starts at Essential, geolocation rules at Plus, the IAB framework at Pro. Its processing agreement is linked from the pricing page.
Check with the vendor
Cookiebot’s own FAQ says the products run on different technology, so this is a new setup, not an upgrade. Its pages we read do not describe a “Do Not Sell or Share” link.
OneTrust
What it is
An enterprise privacy suite whose consent packages (CMP Base and CMP Suite) are priced on average daily visitors, by quote.
Who it fits
A firm that wants consent, privacy notices and request handling in one contract, and expects a sales process.
What the rule requires and whether it meets it
Its pages describe blocking until consent, geolocation rules by region, country or state, scheduled scans and a consent transaction database, plus GPC support and opt-out mechanisms for sale or sharing.
Check with the vendor
Its pages name the IAB framework, exportable consent logs and a data processing addendum, but every package is a quote, so ask which package carries each. Smaller-firm options are on our OneTrust alternatives page.
iubenda
What it is
A cookie banner sold with privacy and cookie policy generators, priced per site on monthly pageviews.
Who it fits
A site that wants its banner and its policies from one vendor.
What the rule requires and whether it meets it
It blocks before consent, detects GPC automatically and offers a “Your Privacy Choices” link for the US laws. Its data processing agreement is part of its terms. Geo-targeting sits on the higher plans.
Check with the vendor
Its own help article calls auto-blocking experimental. Its consent log is on every plan, the free one included, but the pages we read do not describe exporting it.
CookieYes
What it is
A hosted cookie banner with auto-blocking, a scanner and a consent log, priced per domain on monthly pageviews.
Who it fits
A small site that wants automatic blocking and an exportable log on the free plan, which Cookiebot’s free plan lacks.
What the rule requires and whether it meets it
Auto-blocking and the consent log are on every plan; the log exports as CSV, one year back on the free plan. GPC, geo-targeting and the IAB framework start at Pro.
Check with the vendor
The free plan is capped at 5,000 pageviews a month. Check your traffic against it before you move.
CookieHub
What it is
A hosted consent platform with a free tier and plans metered on monthly sessions.
Who it fits
A one-site shop on Cookiebot’s free plan that needs automatic blocking and GPC without paying.
What the rule requires and whether it meets it
Blocking, proof of consent and GPC are on every plan, and its data processing agreement is made under GDPR Art. 28. Location-based banners start at Basic; the IAB framework at Business.
Check with the vendor
The free tier is for fewer than 1,000 sessions a month, and the pricing page does not describe exporting consent records.
Complianz
What it is
A WordPress plugin licensed per installation. Its site says the plugin and its stored data stay on your own server.
Who it fits
WordPress sites and agencies: no page view or session limits on any plan, and the agency licence bundles a multisite plugin.
What the rule requires and whether it meets it
The free plugin blocks known third-party services and adds an opt-out page for California. GPC, geo-targeting, the IAB framework and records of consent are premium.
Check with the vendor
Exporting consent records is not described. Its plugin page says the plugin itself needs no processing agreement because visitor data stays on your server; ask about any Complianz service that handles visitor data off it.
How we compared them
We started from the platforms a Cookiebot site is most often weighed against: its sister product Usercentrics, the enterprise suite OneTrust, and four hosted or WordPress banners with a free or entry plan. Usercentrics is compared on its self-serve Web CMP plans. All seven are on Google’s certified CMP list. Plan facts are names and limits only: we publish no prices.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-22; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
How is Cookiebot priced?
Per domain, by the number of subpages its scanner finds: Free and Premium Lite under 50 subpages on one domain, then Small, Medium, Large and Extra Large as the count grows. It does not charge on traffic. Its prices are on its own pricing page; we publish none.
Is Cookiebot free?
For one domain of up to 50 subpages that uses no Premium features. The free plan blocks scripts only through manual markup, keeps a visitor’s consent for up to one month and has no CSV export of consents. A new account starts as a 14-day trial of every Premium feature.
What is the difference between Cookiebot and Usercentrics?
Both belong to Usercentrics. Cookiebot is billed on subpages per domain; Usercentrics’ Web CMP is billed on monthly sessions and number of domains, with unlimited subpages. Cookiebot’s FAQ says you cannot upgrade from one product to the other inside the product, so moving between them is a new setup.
Do I have to ask visitors for consent again after switching?
Usually, yes. Under GDPR Art. 7(1) you must be able to show that each visitor consented, and the new platform can only show what its own banner collected. Keep the Cookiebot export as proof for the earlier consents, and expect returning visitors to see the new banner once.
Does the free plan of an alternative honor Global Privacy Control?
Cookiebot, Usercentrics and CookieHub list GPC on their free plans; CookieYes and Complianz put it on paid plans. If you sell or share personal information, § 7025 of the CCPA regulations requires you to treat the signal as an opt-out. Our guide to the “Do Not Sell or Share” link covers the other half of the opt-out.
Which of these work for Google ads in Europe?
All seven platforms here are on Google’s list of certified CMPs, read on the date above. Our copy of the certified list explains what the listing does and does not prove.