Cookiebot alternative: a free consent banner inside your tag manager

Cookiebot, from Usercentrics, is a consent platform that scans your site for cookies, blocks them until visitors agree and keeps consent records: free for one domain up to 50 subpages, then €7 to €90 a month per domain (as of 7 November 2026). AgentFirstStack Tags has a free consent banner built into its tag manager, which an AI agent turns on with one config change: it holds the container's tags until each visitor chooses, drives Google Consent Mode v2 and keeps 12 months of consent records. It doesn't scan for cookies, block scripts outside the container or support IAB TCF, so keep Cookiebot if you show Google ads as a publisher, need TCF, or have trackers you can't move into a tag manager.

Updated 7 November 2026

Set it up with one prompt

Paste this into your coding agent. It finds out how Cookiebot is used first, and stops if the site is one that should keep it.

What Cookiebot is

Cookiebot is a consent management platform: "Cookiebot is a trademark of Usercentrics A/S", a Danish company (cookiebot.com, as of 7 Nov 2026). Its scanner finds the cookies and trackers on your pages and categorizes them; the pricing page says "Every month our scanner crawls your website to identify new cookies and trackers". The banner holds trackers back until the visitor agrees (by manual markup on Free, and automatically too on Premium), keeps a record of each choice, and shows a cookie declaration. Setup is an account, a banner, and "Paste the code into your site header".

Cookiebot Core is priced per domain by the number of subpages, and "Plans automatically upgrade depending on your website's number of subpages". Subdomains are billed as separate domains. Prices in euros, excluding VAT (cookiebot.com/en/pricing, as of 7 Nov 2026):

The same page shows US dollar prices of $10, $20, $43, $70 and $120, a 14-day trial of Premium, and Usercentrics Advanced for multi-brand and enterprise setups, priced on request. What the two Core tiers include, from its comparison table:

Cookiebot CMP is on Google's list of certified CMPs with TCF CMP ID 134 (web), and "cookiebotusercentrics" is a Gold partner in Google's CMP Partner Program. Usercentrics also sells app and CTV consent platforms.

How AgentFirstStack does it

The banner is part of AgentFirstStack Tags. Instead of finding cookies and blocking them, it starts from the other end: the trackers run as tags in one container, and each tag waits for its consent type. Your agent turns it on in the container's draft, previews it, and publishes:

T=https://tags.agentfirststack.com
curl -s -X PATCH $T/v1/containers/$C/draft -H "$H" -H 'content-type: application/json' \
  -d '{"consent_banner":{"enabled":true,"privacy_url":"https://example.com/privacy","languages":{"de":{"accept":"Alle akzeptieren","reject":"Alle ablehnen"}}}}'
curl -s -X POST $T/v1/containers/$C/preview -H "$H"     # open preview_url with &afst_consent=open
curl -s -X POST $T/v1/containers/$C/publish -H "$H"
curl -sI "$T/c/$C.js" | grep -i x-afs-consent-banner     # "ask" for a visitor who must choose
curl -s "$T/v1/containers/$C/consent?since=30d" -H "$H"  # accept, reject and custom rates

• Who is asked: visitors from the EU, Iceland, Liechtenstein, Norway, the UK and Switzerland, and visitors whose country is unknown, start with every category denied until they choose. Everyone else starts with the container's defaults and can still open the banner. regions: "all" asks everyone.
• The banner: "Reject all" styled exactly like "Accept all" on the first layer, "Customize" for one unticked box per category (analytics, advertising, personalization), and "Necessary" always on. These defaults can't be turned off. Closing it without a choice changes nothing.
• What follows the choice: the container's tags (ad pixels wait for ad_storage, GA4 for analytics_storage), Google Consent Mode v2 default and updates (also seen by a GTM container loaded after the snippet), AgentFirstStack session replay, and the analytics tracker when it keeps a visitor id. An afst_consent dataLayer event lets the site's own code react.
• Withdrawal: a "Cookie settings" link or an optional floating button reopens the settings; turning a category off stops its tags, updates Consent Mode, and deletes the container's own identity and click-id cookies.
• Records: one per choice, kept 12 months, with an anonymous consent id, time, banner version, choice per category, country, language and the container version that held the text. No IP address, user agent or visitor id.
• The choice cookie: _afst_cc, kept 180 days by default and up to 395. Raising the banner's version asks again.

The cookie consent banner guide has the rules a banner is measured against, with the sources, and how this one maps to each.

What it doesn't do that Cookiebot does

• Cookie scanning and a cookie declaration. Nothing crawls the site for cookies or keeps a cookie list current. The tags scan reads up to 6 pages' HTML for tags, tools and consent platforms; your privacy policy has to list the cookies and third parties.
• Automatic blocking. Scripts outside the container (hard-coded pixels, plugins, chat widgets, video embeds) keep running until they're moved into the container or gated by your own code.
• IAB TCF and Google certification. It doesn't create a TCF consent string, and it isn't a Google-certified CMP or CMP partner.
• Vendor-level choices. Visitors choose by category, not by vendor.
• Translations. Only English is built in; your agent writes the other languages, up to 30, and nothing is translated automatically.
• Other vendors' cookies on withdrawal. Only the container's own cookies are removed.
• Apps and opt-out templates. Websites only, and no US-state opt-out templates. Browsers that send Global Privacy Control or Do Not Track get no tags at all by default.

Side by side

When to choose which

Use Cookiebot if

• You show Google ads through AdSense, Ad Manager or AdMob to visitors in the EEA, the UK or Switzerland and want personalized ads: Google requires a certified CMP integrated with the TCF.
• Your ad partners need an IAB TCF consent string.
• Many trackers load outside any tag manager (CMS plugins, embeds, widgets) and you want them found by a scan and blocked automatically.
• You want a cookie declaration kept current by monthly scans, consent exports for a legal team, 47+ translated languages, or consent in apps and on CTV.

Use the AgentFirstStack banner if

• Your trackers run, or can run, as tags in one container, and you want the banner, the tags and Consent Mode v2 in one place for free.
• You'd rather not pay by subpage count or per subdomain.
• An agent should set it up, check it in a preview, and read accept and reject rates and consent records over an API.
• You want consent records without IP addresses, and open source you can read or self-host.

Moving from Cookiebot

There's no Cookiebot import. What the tools do:

1. Find it. The tags scan (POST /v1/containers/:id/scan) reports Cookiebot under the consent platforms it detects, along with the tags and pixels on the pages.
2. Or keep it. If Cookiebot has to stay, the container follows its Google Consent Mode updates (any platform that calls gtag('consent', 'update', ...)), or its TCF signals with consent.tcf: true. Leave the AgentFirstStack banner off.
3. Move the trackers. Every script Cookiebot holds back becomes a tag in the container with a consent type: ad_storage for ad pixels, analytics_storage for analytics, and so on. A GTM container can come over with draft/import.
4. Switch in one change. Preview the banner, then publish and remove Cookiebot's script in the same deploy, so visitors never see two banners.
5. Expect one more question. The new banner doesn't read Cookiebot's stored choice, so visitors who already chose are asked again. Export Cookiebot's consent records (CSV export is on Premium) before you cancel, because they can't be imported.

FAQ

Is there a free alternative to Cookiebot?

Cookiebot itself is free for one domain up to 50 subpages, with an initial scan, manual blocking, one language and consent that expires after up to a month. AgentFirstStack's consent banner is free at any size within the hosted service's fair-use limits and open source, but it's part of a tag manager: it controls the tags in that container, not every script on the site.

Does AgentFirstStack scan for cookies like Cookiebot?

No. Cookiebot's scanner crawls the site for cookies and trackers and categorizes them. AgentFirstStack's tags scan reads up to 6 pages' HTML and reports the tags, tools and consent platforms on them, but doesn't list cookies or generate a cookie declaration, and its banner doesn't block scripts loaded outside its container.

Can I keep Cookiebot and still use AgentFirstStack Tags?

Yes. Cookiebot has Google Consent Mode v2 on by default, and the AgentFirstStack container follows any consent platform that calls gtag('consent', 'update', ...), so its tags wait for the choice made in Cookiebot's banner. With consent.tcf it follows an IAB TCF v2 platform instead. Leave the AgentFirstStack banner off, so visitors see one banner.

Is the AgentFirstStack banner Google-certified or IAB TCF registered?

No to both. Cookiebot is on Google's list of certified CMPs (TCF CMP ID 134) and is a Gold partner in Google's CMP Partner Program. Publishers serving personalized Google ads in the EEA, the UK or Switzerland need a certified CMP, so they should keep Cookiebot or another certified platform.

What does Cookiebot cost?

As of 7 November 2026, Cookiebot Core is free for one domain up to 50 subpages. Premium is €7 a month for one domain under 50 subpages, then €15, €30, €50 or €90 a month per domain by the number of subpages, excluding VAT, and daily scans cost €99 a month more. Subdomains count as separate domains (pricing).

Will visitors have to choose again if I switch?

Yes. The AgentFirstStack banner keeps its own choice cookie and doesn't read Cookiebot's, so visitors who already chose are asked once more. Cookiebot's consent records can't be imported either: export them before you cancel.

This page compares products; it isn't legal advice. Product names belong to their owners. AgentFirstStack isn't affiliated with Cookiebot or Usercentrics.

Related

• TagsCookie consent bannerWhat a banner has to do, and how CookieYes, Cookiebot and ours compare.
• TagsTag managerThe container the banner is part of.
• TagsConversion trackingConversions that respect each visitor's choice.
• TagsGoogle Tag Manager MCP comparedEdit GTM, or let the agent run the tag manager.
• ReplaySession replayRecorded only after consent where the law asks.
• All servicesOne MCP server for every serviceAnalytics, tags, mail and replay tools on one key.