Cookiebot fix guide
Cookiebot and Global Privacy Control: why trackers fire after the signal
Cookiebot's own documentation says GPC only changes consent on a few banner setups. On every other setup, the signal has no effect on Cookiebot's consent at all. Even when it does apply, tags Cookiebot doesn't block keep firing.
Free. No account. Results in about a minute.
What Cookiebot says it does
- Decline Only banners: implied consent from scrolling or clicking becomes an opt-out instead of an opt-in.
- Do Not Sell banners with no banner shown: the signal triggers a full opt-out.
- Do Not Sell banners with the banner shown: the Do not sell checkbox comes pre-checked.
- Multilevel and Inline Multilevel banners: options that were pre-checked are unchecked.
- Every other banner setup: Cookiebot says the GPC signal has no impact on consent or the banner.
- Cookiebot honors GPC only, not Do Not Track.
From Cookiebot's own documentation, linked below.
How to set it up
- Check which banner type your Cookiebot domain group uses for US visitors.
- If it isn't one of the types above, GPC isn't changing anything. Switch US visitors to a type that responds to the signal.
- Make sure every advertising tag is blocked by Cookiebot, through automatic blocking or its manual markup, and categorized as marketing.
- Test with a browser that sends GPC and confirm marketing tags don't load.
Why tags still fire with Cookiebot
- A banner type that ignores GPC. This is the big one. A standard opt-in banner shown to US visitors doesn't change consent when the signal arrives, so whatever your US default is stays in place.
- Tags outside automatic blocking. Cookiebot can only hold back scripts it recognizes or that you've marked up for it. Pixels injected by apps or loaded late can slip past.
Gaps on every consent platform
- Pixels hardcoded outside the consent platform. A Meta or TikTok pixel pasted into the theme, or injected by a store app, never asks the consent platform for permission. It fires no matter what the banner says.
- Tag manager tags with no consent condition. Google Consent Mode only governs Google's own tags. Meta, TikTok, Pinterest and other tags in Google Tag Manager need their own triggers or consent checks, or they run for everyone.
- Ad tags filed under the wrong category. The opt-out only blocks the categories it's applied to. An advertising pixel sitting in a functional or performance category keeps running after the signal.
- Tags loading other tags. One ad script can pull in several more. The consent platform may gate the first one and never see the rest.
- Server-side forwarding. Conversion APIs and server containers send data from your server, not the browser, so the browser's opt-out never reaches them unless you pass it along.
Which tags do this most? See pixels that ignore opt-outs.
Questions
Does Cookiebot support Global Privacy Control?
Cookiebot's own documentation says GPC only changes consent on a few banner setups. On every other setup, the signal has no effect on Cookiebot's consent at all. Even when it does apply, tags Cookiebot doesn't block keep firing.
Why do trackers still fire after GPC with Cookiebot?
Usually because the tag isn't under Cookiebot's control: it's hardcoded in the page, loaded by an app or another tag, or sits in a category the signal doesn't reach.
How do I test whether Cookiebot honors GPC on my site?
Load the page with Global Privacy Control on, without touching the banner, and record every request. Consentinel's free scan does exactly this and names every ad vendor that ran, with the request as proof.
Sources: Cookiebot: Cookiebot and the GPC signal
Other platforms: OneTrust · Osano · Didomi · TrustArc
This is a technical guide, not legal advice. Cookiebot is a trademark of its owner; Consentinel isn't affiliated with it.
See what Cookiebot is missing on your site.
Free, about a minute. We test reject, accept and Global Privacy Control, and name every tag that ran when it shouldn't have.
Free. No account. Results in about a minute.