Cookiebot
Consent Management · Denmark
Cookie consent tool from Denmark. DPA published, database in Ireland, US CDN sub-processor. Free plan.
What is Cookiebot?
Cookie Consent From Copenhagen, With a US CDN in the Path
Cookiebot (by Usercentrics) scans a website for cookies and trackers, shows a consent banner and logs each visitor's consent. The contracting entity is Usercentrics A/S in Copenhagen, Denmark, and the Terms are governed by Danish law.
What It Covers
- Scan: an initial scan for cookies and trackers is part of the Free plan
- Frameworks: the pricing page lists compliance for GDPR and ePrivacy and for US state regulations, and Google Consent Mode; the Premium plans list GDPR, CCPA/CPRA, VCDPA, LGPD, POPIA and more
- Banner: custom banners, branding and multi-language support are Premium features
- Consent log: the Terms say consent logs are stored with the vendor's cloud provider, Microsoft Ireland Operations Ltd in Dublin, and deleted after 12 months
Pricing
Free covers one domain with up to 50 subpages and unlimited users. Premium starts at €7 a month, and the page lists a 14-day trial with no credit card. Prices are in euros and exclude VAT where applicable.
What the DPA Says
Cookiebot publishes a data processing agreement template with Usercentrics A/S as processor. It says the processing takes place within the EU / EEA, and Annex 2 lists the sub-processors: Microsoft Azure via Microsoft Ireland Operations (database in Ireland, fail-over to Amsterdam), Akamai Technologies, Inc. in the United States (CDN, geolocation to show the right banner and IP address stripping at the edge, with a database in the US), Bunny in Slovenia (an EU CDN option used by customers who choose it) and Visitor Analytics GmbH in Germany. The data the service processes includes the consent ID and state, the URL visited, the browser user agent, the IP address and a geolocation. Annex 2 names no transfer mechanism for Akamai, which is why this listing is rated Partial.
Where It Fits
For other consent tools, see the wider Consent Management category.
Key Features
Pricing
Free
- Up to 50 subpages
- Cookie scanning
- Consent banner
- Basic reporting
Premium
Popular- Unlimited pages
- Geo-targeting
- Custom branding
- Consent Mode v2
Enterprise
- Multi-domain
- IAB TCF 2.2
- Advanced analytics
- Dedicated support
Ready to try Cookiebot?
Free up to 50 subpages
Pros & Cons
Replaces
Company and data
Who you are buying from, and where your data goes.
- Company based in
- Denmark
- Ownership
- European-owned
- Data hosted
- In the EU
- Data processing agreement
- Published
Subject to the US CLOUD Act: a US provider in this tool's processing chain can be compelled to disclose data it holds, including data stored in the EU. The vendor itself is European-owned.
Full privacy and compliance record (show)
GDPR Compliance Data
Verified from vendor documentation| GDPR Status | Partially Compliant |
| HQ Country | Denmark |
| Ownership | European-owned |
| Foreign Disclosure Exposure | US CLOUD Act / FISA 702 |
| Data Hosting Location | European UnionDPA Annex 2: "Databases are hosted on servers within EU member states, specifically Ireland with a hot fail-over mechanism to Microsoft's datacenter in Amsterdam, the Netherlands" (Microsoft Ireland Operations Ltd). Terms: consent logs are stored "in a data center with Usercentrics's cloud vendor, Microsoft Ireland Operations Ltd in Dublin, Ireland" (cookiebot.com, read 2026-10-14). Vendor-stated. |
| EU Servers Available | |
| Data Processing Agreement | View DPA |
| Sub-processor List | View sub-processors |
| Schrems II Risk | Low Risk |
| SCCs in Place | |
| Last Verified | 20 October 2026 |
How we reached this
Read raw 2026-10-14 (DPA PDF text-extracted; privacy policy, terms and pricing rendered in headless Chrome). Replaces an earlier note ("Danish company, EU-hosted, IAB TCF certified"); the certification claim was not re-verified. Contracting entity: Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark (company registration DK34624607), named as controller in the Privacy Policy, as the party to the Terms (last update 25 June 2026, Danish law) and as processor in the DPA template. The documents say the data is shared among the Usercentrics entities (Usercentrics A/S, Usercentrics GmbH, Cybot A/S, Usercentrics Unipessoal and Usercentrics Inc.); they do not state who owns Usercentrics A/S, so ownership stays recorded as EU-owned without a stated parent. DPA: a template ("Without-signature") that says the processing is within the meaning of Art. 4 No. 2 and Art. 28 GDPR. Clause 3.4 says the processing of controller data takes place within the EU / EEA and that any transfer outside it needs the controller's prior consent and the Art. 44 et seq. conditions. Annex 2 sub-processors: Microsoft Azure via Microsoft Ireland Operations Ltd (database hosted in Ireland, hot fail-over to Amsterdam), Akamai Technologies, Inc. (USA; "Database in the US"; CDN, geolocation to show the right cookie banner, IP address stripping at the edge), Bunny (BunnyWay d.o.o., Slovenia; CDN for customers who choose the EU CDN provider) and Visitor Analytics GmbH (Germany; analytics). Rated PARTIAL because clause 3.4 and the Akamai entry sit side by side without a named transfer mechanism for Akamai: extraterritorialExposure is US_CLOUD_ACT, narrowly (a US CDN handling end-user IP addresses for banner geolocation, a US-parented cloud host, and a US group entity named in the Privacy Policy); sccInPlace false because none is named for a listed transfer. Consent data is deleted from the log after 12 months (Terms). Pricing page: Free for up to 50 subpages and one domain, Premium from EUR 7 a month, 14-day trial. Open questions for the vendor: which transfer mechanism applies to Akamai and what data it receives; whether the EU CDN option removes Akamai from the path; who owns Usercentrics A/S.
Categories
Company Info
| Founded | 2012 |
| Team Size | 51-200 |
Alternatives to Cookiebot
Borlabs Cookie
German WordPress cookie consent plugin. GDPR-compliant consent management.
Usercentrics
German consent management platform. Cookie and app consent with full GDPR compliance.
etracker
German web analytics with consent-free, cookieless tracking and a built-in consent and tag manager. Operated from Berlin by JustRelate.
iubenda
Italian consent management and privacy/cookie policy generator from iubenda s.r.l. in Milan, part of the Belgian team.blue group since 2022, covering GDPR, ePrivacy and CCPA for 150,000+ businesses.
Questions about Cookiebot
Is Cookiebot GDPR compliant?
Partly. Cookiebot meets some of the requirements, with caveats worth reading before you commit. Cookiebot is a European company headquartered in Denmark, data is hosted within the European Union, and a Data Processing Agreement is published. Every claim on this page links to the vendor's own documentation.
Where does Cookiebot store data?
Cookiebot states: "DPA Annex 2: "Databases are hosted on servers within EU member states, specifically Ireland with a hot fail-over mechanism to Microsoft's datacenter in Amsterdam, the Netherlands" (Microsoft Ireland Operations Ltd). Terms: consent logs are stored "in a data center with Usercentrics's cloud vendor, Microsoft Ireland Operations Ltd in Dublin, Ireland" (cookiebot.com, read 2026-10-14). Vendor-stated.". Data is hosted within the European Union.
Does Cookiebot offer a Data Processing Agreement (DPA)?
Yes. Cookiebot publishes a DPA at https://www.cookiebot.com/en/wp-content/uploads/sites/7/2026/06/DPA_EN_Template_UC-A_S_Without-signature_19.06.26_PB.pdf. A DPA is required under Article 28 GDPR whenever a provider processes personal data on your behalf.
What a DPA has to cover →Is Cookiebot a European company?
Yes. Cookiebot is headquartered in Denmark and, as far as we can establish, European-owned.
Is Cookiebot subject to the US CLOUD Act?
Indirectly. Cookiebot itself is European-owned and headquartered in Denmark, so the company is not subject to US jurisdiction. The exposure runs through a US provider in its processing chain, a host, CDN or other sub-processor, which can be compelled to disclose data it holds even when that data sits on EU servers. That is a narrower exposure than a US-owned vendor, and the compliance notes above say which provider it is.
Schrems II compliance checklist →Who are Cookiebot's sub-processors?
Cookiebot publishes its sub-processor list at https://www.cookiebot.com/en/wp-content/uploads/sites/7/2026/06/DPA_EN_Template_UC-A_S_Without-signature_19.06.26_PB.pdf. Worth reading: a vendor hosting in the EU can still route data through non-EU sub-processors, which is where residency claims usually come apart.
Some links on this page are affiliate links. If you sign up through one we may earn a commission, at no extra cost to you. It never affects which tools we list, how we rank them, or what we report about their compliance, see our terms.
Spotted something wrong?
Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.
If you work at Cookiebot and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.