Lab test, State of Consent 2026
Cookiebot
[Never a commercial relationship] · free plan, dashboard snippet unchanged
No counted finding under stated conditions
No counted finding in the tested configuration. The one request observed before a choice came from our own hardcoded Meta Pixel test snippet and was withdrawn on 4 Oct 2026 (see the context note). After a verified "reject all", no listed tracker activity on page 2 met our counting rule (0 of 6 runs). See the note on automatic blocking below.
Observed under stated conditions: our own identical WordPress test site, free plan, dashboard snippet unchanged, our tags (GA4, Google Ads, Meta Pixel, YouTube) hardcoded in the theme header (insertion method A), automated Chromium with a fresh profile per run from a German (EU) IP. Lab days 25 and 26 Sep 2026 (Israel time). Findings human-reviewed on 28 Sep 2026. These are observations of browser behaviour, not a legal assessment of the product.
Lab findings (exact report wording)
- Cookiebot, config 1 (free plan, dashboard snippet unchanged; our tags hardcoded in the theme header): on first load, the listed tracker activity observed before any choice (requests to www.facebook.com, in 3 of 3 runs on 25 Sep and 3 of 3 runs on 26 Sep 2026) came from our own hardcoded test tags in a form the tested setup was not configured to block, and is withdrawn (see the context note). No other listed tracker request or tracking storage met the counting rule. After a verified "reject all", no listed tracker activity on page 2 met the counting rule (0 of 6 runs). On a return visit the stored consent still read as the refusal (6 of 6).
Context: Cookiebot was tested on its free plan with the embed snippet from the Cookiebot dashboard, used unchanged (it includes data-blockingmode="auto"). As of 28 September 2026, Cookiebot's pricing page and terms list automatic blocking for paid plans and manual blocking for the free plan, while its WordPress-plugin page describes automatic blocking on the free tier; we asked Cookiebot which applies; no answer was received before publication (see "Vendor response" below). The one request observed before a choice (www.facebook.com) came from our own Meta Pixel test snippet, hardcoded in the theme header and not marked up for Cookiebot's manual blocking. The Cookiebot configuration served to our page listed the two Google tag loaders, which it held back in every run, but no Meta Pixel entry; our test Pixel sets no cookie. In a diagnostic on our own lab site (3 runs, 4 Oct 2026), with only that snippet given Cookiebot's documented marketing markup, no request to www.facebook.com occurred. We therefore do not report it as a finding about Cookiebot (corrections log, section 8). We do not say that Cookiebot fails to block.
Cookiebot: what our lab test and our site sample showed before a consent choice
Observed under stated conditions: lab on our own identical WordPress test site, free plan, dashboard snippet unchanged, our tags hardcoded in the theme header (insertion method A), automated Chromium with a fresh profile per run from a German (EU) IP; wild figures are aggregates of sampled public homepages, never a named site. Not a legal assessment of the product.
- In our lab. On our own WordPress test site (free plan, dashboard snippet unchanged, lab days 25 and 26 Sep 2026), no listed tracker request or tracking storage met our counting rule before a choice. The Cookiebot configuration served to our page listed our two Google tag loaders, which it held back in every run.
- Correction. An earlier lab observation for Cookiebot was withdrawn after our audit of 4 Oct 2026, because it came from our own test tags; the report's corrections log (section 8) records it.
- Setup factors. What mattered in our test was how our tags reached the page. Our Meta Pixel was a hardcoded inline snippet without Cookiebot's manual markup; in a diagnostic with only that markup added, no request to www.facebook.com occurred (3 runs, 4 Oct 2026). Which blocking mode applies on the free plan is a question we have put to Cookiebot (see the context note above). We tested one insertion method only (our tags hardcoded in the theme header); tags added through Tag Manager or a plugin were not tested.
- On sampled homepages. On sampled public homepages detected as using Cookiebot, 276 of 377 (73%; Wilson 95% interval 69% to 77%) made a request matching our tracker lists before any choice, on both 24 and 25 Sep 2026. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.
- Cookiebot's reply. Published unedited in the "Vendor response" box below.
- Method. Our counting rules and limits: methodology.
Raw per-run counts
"Verified" means the automation worked; it is not a verdict on the product. Only the wording above is a finding. O1 = a listed third-party tracker request before a choice; O2 = listed tracking storage (cookie or localStorage name) before a choice; O3 = O1/O2 activity after a verified reject.
Config 1: free plan, dashboard snippet unchanged
| State | Runs | O1 before a choice | O2 before a choice | O3 after a verified reject | Days |
|---|---|---|---|---|---|
| State 1: first load, no interaction | 6 (verified 6) | 0/6 (raw 6/6) ³ | 0/6 | n/a | 25 and 26 Sep 2026 |
| State 2: reject all, then page 2 | 6 (verified 6) | 0/6 (raw 6/6) before the click ¹ ³ | 0/6 before the click ¹ | 0/6 | 25 and 26 Sep 2026 |
| State 3: accept all, then page 2 | 6 (verified 6) | 0/6 (raw 6/6) before the click ¹ ³ | 0/6 before the click ¹ | n/a | 25 and 26 Sep 2026 |
| State 4: return visit after reject | 6 (verified 6) | n/a | n/a | n/a | 25 and 26 Sep 2026 |
| State 5: first load with GPC (synthetic diagnostic) | 6 (verified 6) | 0/6 (raw 6/6) ³ | 0/6 | n/a | 25 and 26 Sep 2026 |
¹ States 2 and 3 begin with the same first page load as State 1. Their O1/O2 counts come from that page load, before the reject or accept click: the same observation as State 1, not a separate result. Activity after a verified reject is O3.
³ Raw counts include requests or storage from our own hardcoded test tags that were withdrawn as findings on 4 Oct 2026 (see the finding text and context note below, and section 8). Where every counted item of that kind was withdrawn, the figure after withdrawal is shown first and the raw count in brackets.
Sampled public homepages (wild)
- State 1: first load, no interactionCookiebot: of 377 sampled homepages detected as using it and measured on both 24 and 25 Sep 2026, 276 (73%; Wilson 95% interval 69% to 77%) made a request matching our tracker lists before any choice, on both days, in an automated browser in Germany. Site configuration, other scripts on the page and detection errors can all contribute; this study cannot separate them from the product.
- State 2: reject all, then page 2Cookiebot: of the 225 sampled homepages where our automated reject click could be verified on both days, 58 (26%; interval 21% to 32%) showed listed tracker activity on the next page. Verified clicks depend on the banner's design, so these subsets differ in size and make-up between CMPs and should not be compared as a ranking.
Wild figures are aggregates of sampled public homepages, never a named site. The intervals cover sampling error only, not errors in CMP detection, list matching or click automation. Verified reject clicks depend on each banner's design, so the subsets differ in size and make-up between CMPs and should not be compared as a ranking.
Method and limits
- States: 1 first load; 2 reject all, then page 2; 3 accept all, then page 2; 4 return visit after reject; 5 first load with Global Privacy Control. States 2, 3 and 5 begin with the same first page load as State 1, so what is seen before their click is reported once, with State 1.
- A click state counts only if the banner closed and the CMP's own stored consent decoded to the expected choice.
- Counted finding: seen in at least 2 of 3 runs on at least 2 different days, with the network capture, a screenshot, the list versions and the SHA-256 of the CMP's loaded script stored on every supporting run, and one human review per item. Anything less is not a finding.
- Lists: EasyPrivacy plus a curated list of vendor-documented endpoints for the lab tag set, each pinned by version. The CMP's own consent logging is not counted.
- Tested as labelled above (free tiers, except the Real Cookie Banner Pro configuration with a free reviewer licence); one insertion method (tags hardcoded in the theme header). Tag Manager or plugin-inserted tags may behave differently. "None observed" is not proof of blocking, for any vendor or configuration: a lab result describes the runs we made under the stated conditions and does not show that a product always blocks.
- GPC is a browser signal; EU law does not require consent tools to act on it. State 5 is a diagnostic, not a compliance test.
- Lab run dates are lab days in Israel time (UTC+3); run timestamps are UTC.
Full method: methodology. Full results for all six tested CMPs, with our commercial interests stated before any result: State of Consent 2026 report.
Vendor response
Before publication, Cookiebot received the passages, table rows and labels that name it, with its evidence, and at least 10 business days to reply, to point out an error, or to supply a configuration for a re-run. A reply of up to 200 words is published here unedited (we omit only text that is against the law or concerns third parties, and tell the vendor first). No reply is not read as agreement.
Cookiebot received its results and evidence on 4 October 2026 and was invited to send a statement by 19 October 2026. No statement was received.
Commercial interests: CookieTelemetry gave notice to leave its affiliate programmes on 24 Sep 2026 ($0 earned) and sells a paid website monitoring service that checks for tracking before consent. Both are described at the top of the report. This page contains no affiliate link and no product offer.