Cookiebotis a consent management platform, not a network-layer auditor. Here’s what it does well, and what it structurally can’t see.
Cookiebot is a strong, accessible entry point for consent management, particularly known for its automated cookie scanning and categorization. It gives site owners a fast way to inventory scripts and stand up a compliant-looking banner without a lot of manual configuration. In our audit, Cookiebot's initial scan-and-categorize step consistently did what it was designed to do.
A CMP manages consent intent— the rules it’s configured with. It doesn’t verify what actually fires on the wire. These gaps aren’t unique to Cookiebot; they’re structural to client-side consent management as a category, based on our audit of 50 live sites.
Cookiebot's categorization is built from a scan at a point in time. Scripts that get added to the page later — including shadow pixels sharing data with new third-party networks — aren't automatically picked up until the next scan runs, leaving a window where new trackers fire uncategorized. Our audit found shadow-pixel behavior on 78% of sites reviewed across CMPs.
In our 50-site audit, 42% of sites had trackers firing before the user interacted with the consent banner at all — often because a script sits in the page's <head> ahead of the CMP, or a third-party widget loads synchronously on page load. A banner that appears correctly doesn't guarantee nothing fired before it appeared.
When an authorized script loads additional, unrelated third-party scripts on its own — a pattern we found on 65% of audited sites — those nested trackers were never registered with the CMP and so were never scanned or categorized in the first place.
Cookiebot can be configured to respect the Global Privacy Control signal, but confirming that every third-party tag actually stops sending data after that signal is received requires inspecting outbound network requests directly, which sits outside what a consent-scanning dashboard measures.
Cookiebot automates a lot of the consent-banner and cookie-categorization work CCPA/CPRA compliance requires, but it doesn't independently confirm that every tracker actually stops firing after a consumer opts out. That verification happens at the network layer, outside what a cookie-scanning tool measures.
Cookiebot runs scans on a schedule you configure, but between scans, newly added or newly "shadow" trackers loaded by an existing vendor script won't be categorized or blocked. Our audit found this gap — trackers added after initial setup — on the majority of sites reviewed, regardless of CMP.
Not always. If a script sits ahead of the CMP in the page's load order, or a third-party widget loads synchronously, it can fire before the banner renders or before the user makes a choice. Our audit found pre-consent firing on 42% of sites across CMPs.
No — they're complementary. Cookiebot manages the consent banner and cookie inventory. Privisy is an independent audit that verifies what's actually happening on the wire, including whether Cookiebot's own blocking configuration is holding up in practice. Most teams keep both in place.
Run a free, instant network-layer scan to see exactly what fires on your site, before or after consent.
Run a Free Scan