GovernAtlasSubmit your product ↗
Discover platforms/Usercentrics

GOVERNATLAS / PRODUCT DOSSIER

Cookiebot CMP

Cookiebot presents a consent management product and website scanning workflow.

Explore the product ↗Add to comparison ↗

01 / CONTEXT & SCOPE

Understand the proposition.
Define the boundary.

The decision to make

Evaluate the difference between discovering website activity and controlling it. A scan report can identify a tracker, while your consent configuration and integrations determine what happens before and after a user's choice. Both need a controlled test on the website you actually operate.

What this record does not establish

A consent management product and scanning workflow do not establish complete tracker detection, legal compliance or correct behavior of scripts outside the tested implementation.

3 current sources · 4 published assertions
Source coverage is a research boundary, not a quality score.

02 / YOUR EVALUATION

Turn interest into a useful trial.

Open the evaluation playbook ↗
A

A test worth running

On an authorized staging site, run a clean-browser visit, reject optional categories, then accept and withdraw a test choice. Inspect network activity and scanner results at each stage. Add a new synthetic tracker and check whether the next scan leads to a reviewed configuration change.

GovernAtlas editorial proposal. We have not performed this test.

B

Evidence to bring back

  1. Record the website build, consent configuration and observed requests for each stage of the test.
  2. Assign an owner and retest procedure for new scripts, regions and changes to the site's tagging setup.

03 / DOCUMENTED EVIDENCE

Read the claim. Inspect the basis.

Each statement retains its classification and preserved source. A vendor assertion is not an independent test result.

01
vendor asserted

Cookiebot's homepage advertises ISO 27001 and ISO 27701 certifications in its security messaging. GovernAtlas has not inspected those certificates or established their issuing body, validity, legal entity and service boundary. This is not independent certification validation of the CMP.

Source, dates & preserved provenanceUsercentrics — Product capabilities and published scope ↗

Authority: vendor owned
Observed 2026-11-03 · Reviewed 2026-11-03 · current until 2026-12-03

Artifact SHA-256: 7b5159222ace882c9647e6c9fa833360d24e8adde36ac8ae28f62e166afa58e0

The hash identifies the preserved capture. The live source may have changed.

02
vendor asserted

Cookiebot's public DPA includes an annex listing subprocessors and their processing purposes. Buyers must reconcile that annex and the applicable agreement with their deployment; a listed supplier does not establish that customer-configured tags, trackers or destinations are covered.

Source, dates & preserved provenanceUsercentrics — Product capabilities and published scope ↗

Authority: vendor owned
Observed 2026-11-03 · Reviewed 2026-11-03 · current until 2026-12-03

Artifact SHA-256: fe22ca1bb16de6f32949446b2ff5debb1ba95fed451cb61dcb3d992a804f1ee1

The hash identifies the preserved capture. The live source may have changed.

03
vendor asserted

Cookiebot's posted DPA describes EU/EEA processing and conditional third-country transfers under its consent and transfer provisions. This is a contractual description, not proof that every data flow remains in the EU/EEA or that a customer's transfer assessment is complete.

Source, dates & preserved provenanceUsercentrics — Product capabilities and published scope ↗

Authority: vendor owned
Observed 2026-11-03 · Reviewed 2026-11-03 · current until 2026-12-03

Artifact SHA-256: fe22ca1bb16de6f32949446b2ff5debb1ba95fed451cb61dcb3d992a804f1ee1

The hash identifies the preserved capture. The live source may have changed.

04
vendor asserted

Cookiebot presents a consent management product and website scanning workflow. Scope: vendor documentation only; edition and availability boundaries require confirmation.

Source, dates & preserved provenanceCookiebot CMP — official product or documentation page ↗

Authority: vendor owned
Observed 2026-10-14 · Reviewed 2026-10-15 · current until 2026-11-13

Artifact SHA-256: eb6f02f20c57d3f3b04ce1b287f517cb1834852d3b153634e52316a9dd3d7ee4

The hash identifies the preserved capture. The live source may have changed.

Source register

Brand asset provenance

Organization identity asset from its official website; inclusion does not imply endorsement.

Official website ↗ · Original asset ↗

04 / BEFORE YOU COMMIT

Better questions.
A clearer decision.

Resolve these with the provider and your own evaluation team.

01

What is the scanner's coverage and how are unclassified technologies handled before consent?

02

What deployment, retention and access-control evidence supports the intended use?

03

What underlying assurance documents are available, and which claims remain unverified?

Regulatory applicability requires a separate, current determination. Inclusion is not certification.

COMPLIANCE / CLAIMS, SCOPE & GAPS

Start with the requirement.
Inspect the support.

Prepare your vendor review ↗

These labels describe this dossier’s current evidence coverage. A published mention may be a framework mapping, a qualified assertion or a limitation; it is not a compliance finding.

GDPR

Published mention available

EU personal data protection

Data-processing documentation

Read the current agreement, annexed subprocessors and third-country conditions against the selected CMP features and actual integrations.

Data-processing documentation

Trace consent records and add-ons separately from downstream advertising/analytics processing; retain the applicable subprocessor-list version.

Read the source-attributed statement

Cookiebot's public DPA includes an annex listing subprocessors and their processing purposes. Buyers must reconcile that annex and the applicable agreement with their deployment; a listed supplier does not establish that customer-configured tags, trackers or destinations are covered.

vendor asserted

Usercentrics — Product capabilities and published scope ↗
Read the source-attributed statement

Cookiebot's posted DPA describes EU/EEA processing and conditional third-country transfers under its consent and transfer provisions. This is a contractual description, not proof that every data flow remains in the EU/EEA or that a customer's transfer assessment is complete.

vendor asserted

Usercentrics — Product capabilities and published scope ↗

Explore GDPR evidence ↗

ISO 27001

Published mention available

Information security management standard

Vendor-reported assurance

Request the current certificate and scope, distinguishing Usercentrics organizational assurance from each purchased product and add-on.

Read the source-attributed statement

Cookiebot's homepage advertises ISO 27001 and ISO 27701 certifications in its security messaging. GovernAtlas has not inspected those certificates or established their issuing body, validity, legal entity and service boundary. This is not independent certification validation of the CMP.

vendor asserted

Usercentrics — Product capabilities and published scope ↗

Explore ISO 27001 evidence ↗

For HIPAA-regulated use, request service-specific BAA eligibility, processing scope and responsibility details. Missing evidence here does not establish noncompliance. Payment cannot alter these evidence labels.

KEEP THE RECORD USEFUL

A dossier should stand up to scrutiny.

Have a source that changes this picture? Submit it for editorial review.

Raise an evidence issue ↗