Two Solid CMPs, Two Very Different Pricing Models
Cookiebot (now part of Usercentrics) is one of the most recognised names in cookie consent. It's been around for years, it's an IAB-certified CMP, it scans in dozens of languages, and it powers consent banners on a large share of European websites. Comparing it to CookieBeam isn't a serious-tool-versus-toy matchup: both scan your site, block scripts until consent, and speak Google Consent Mode v2.
The real differences show up in how each one prices, how deep the blocking goes (scripts only vs. scripts plus network connections), what happens between scans, and how much control you get over regional behaviour and privacy signals. This guide walks through each honestly, including where Cookiebot is the better pick. Want the wider market view first? Our honest comparison of cookie consent tools covers the whole field.
How Cookiebot Prices: Per Domain, by Subpage Count
This is the single most important thing to understand before choosing Cookiebot. As of mid-2026, Cookiebot's public pricing is charged per domain and the tier is set by the number of subpages (unique URLs) its scanner finds on that domain. Traffic and user seats are unlimited; the price is driven by how many pages your site has.
The published tiers (per domain, per month, in EUR) are a free plan for up to 50 subpages on a single domain, then Premium tiers that step up by subpage count to roughly €90/month for very large sites. In August 2025 Cookiebot roughly doubled its base Premium price, so older reviews quoting the previous figures are out of date. Cookiebot also auto-upgrades a domain's tier when its scanner discovers more subpages, which means your bill can rise as your site grows even if your traffic and revenue don't.
The subpage model is predictable for a small brochure site and gets expensive fast for large content sites, documentation portals, e-commerce catalogues, or anyone running several domains. Always price it against your actual URL count, not your traffic.
How CookieBeam Prices: Flat Per Domain, Plus a Usable Free Tier
CookieBeam charges a flat, transparent price per domain (a few euros per domain per month) regardless of how many subpages that domain has. A 40-page site and a 40,000-page site pay the same per-domain rate. The free tier is genuinely functional for a small site: it includes real script blocking, automated cookie scanning, and consent logging rather than a stripped-down banner. There's a 14-day trial on paid capabilities and no sales call to get started.
Neither model is universally cheaper. If you have a tiny site and never plan to grow it, Cookiebot's free 50-subpage tier is hard to beat. If you have a large or growing site, multiple domains, or a catalogue with thousands of URLs, flat per-domain pricing is usually more predictable. The practical takeaway: count your subpages and your domains, then price both tools against those numbers.
CookieBeam vs Cookiebot (as of mid-2026)
| Capability | CookieBeam | Cookiebot (Usercentrics) |
|---|---|---|
| Pricing model | Flat per domain (a few euros/domain/month); usable free tier with script blocking, scanning and consent logs | Per domain, priced by subpage count; free tier up to 50 subpages on 1 domain; Premium tiers scale to ~€90/domain/month |
| Cookie scanning | Headless-browser scanning (Chrome via CDP) with full JavaScript rendering. Multi-layer classification: URL/domain pattern matching (140+ domains), inline script content analysis (23+ vendor patterns), external cookie database, and WordPress plugin/theme source grouping (~300 known sources). Captures cookies, scripts, and network connections. | Automated scanning, mature and well-known; scans in 40+ languages |
| Script blocking | 5-layer automatic interception engine: createElement override, DOM insertion hooks, MutationObserver fallback, Worker/SharedWorker blocking, and anti-tamper locking. Works from scan-derived script maps, not third-party block lists. Blocked scripts are neutralized and queued, then revived in order when consent is granted. | Automatic prior blocking of known scripts; manual tagging for unknowns |
| Consent Mode v2 | Native, with regional defaults and advanced mode out of the box | Native support, well-documented Google integration |
| IAB TCF | TCF 2.2 integration available | IAB-certified CMP; long track record with publishers |
| Regional consent | Full regional engine: per-country rules with GDPR, CCPA, US opt-out, LGPD, PIPEDA and UK GDPR presets plus custom overrides | Geo-targeting and region-based banner behaviour |
| Server-side tagging | Offers hosted server-side GTM / server-side tagging as a metered product | Not a server-side tagging host; CMP only |
| A/B consent testing | Built-in experiment designer to test banner variants and consent models | Not offered natively |
| Connection-level blocking | Wraps fetch(), XMLHttpRequest, navigator.sendBeacon(), WebSocket, and EventSource at the API level. Blocks outbound tracking connections (not just script loading) per consent category. Includes first-party bypass and infrastructure host exclusion. This goes beyond what most CMPs enforce. | Not offered. Script blocking only. |
| Drift detection | Continuous client-side monitoring for new cookies, scripts, and network connections between scans. Runs in every visitor's browser. Auto-promotes to inventory after 5 sightings. | Periodic re-scans detect changes; no continuous client-side drift monitoring. |
| Compliance modes | Learning mode (default): allows unknown scripts while building inventory. Strict mode: blocks all unclassified scripts (fail-closed). | Automatic prior blocking of known scripts; manual tagging for unknowns. |
| GPC / DNT enforcement | Built-in GPC and DNT detection with per-region overrides. EU: GPC sets default deny, explicit opt-in overrides. US opt-out states: follows CPRA 7025(b)(3), requiring a deliberate, right-specific in-banner opt-in to override a privacy signal. | GPC signal detection available; limited per-region override control. |
| Blocked content placeholders | Shield engine renders visual placeholders on blocked iframes explaining why content is blocked. Replaced with real content on consent. | Placeholder support for blocked content. |
| Language coverage | Multi-language banner with on-demand translation loading | Very broad: 47+ languages, a genuine strength for global content sites |
Where Cookiebot Is the Better Choice
We'd rather you pick the right tool than pick us for the wrong reasons. Cookiebot is a strong choice when:
- You need very broad language coverage. Cookiebot's 47+ scanning and banner languages are a real advantage if you publish content in many locales.
- You have a small, static site that fits the free 50-subpage tier. For a simple brochure site, Cookiebot free is a legitimate zero-cost option.
- You want a long-established, IAB-certified name for procurement or publisher requirements, and the subpage-based bill lands in a range you're comfortable with.
Where CookieBeam Pulls Ahead
CookieBeam tends to fit better when:
- Your site is large or growing. Flat per-domain pricing doesn't climb with your URL count, so a big catalogue or docs site won't push you into a higher tier.
- You need blocking beyond scripts. CookieBeam's connection-level blocking wraps fetch, XHR, beacon, WebSocket, and EventSource at the API level. This catches tracking that happens through network calls, not script tags. Few if any CMPs do this.
- You want visibility between scans. Drift detection runs in every visitor's browser, catching new cookies, scripts, and connections as they appear. After 5 sightings, they're auto-promoted to your inventory. You don't have to wait for the next scan to know something changed.
- You run (or want to run) server-side tagging. CookieBeam can host your server-side GTM and tie it to consent state; Cookiebot is a CMP only. See our guide on server-side consent enforcement.
- You want to experiment with your banner. The built-in A/B designer lets you test banner variants and consent models to lift consent rates without guessing. Pair it with consent-rate optimisation without dark patterns.
- GPC compliance matters. Built-in GPC/DNT enforcement with per-region overrides follows CPRA 7025(b)(3) for US opt-out states: a privacy signal requires a deliberate, right-specific opt-in to override.
- You need granular regional rules. Per-country presets for GDPR, CCPA, LGPD, PIPEDA and UK GDPR let one banner adapt globally. Learning mode lets you build your inventory safely; Strict mode locks down unclassified scripts. See regional consent for global sites.
- Blocked iframes need context. The Shield engine replaces blocked iframes with visual placeholders explaining why content is unavailable, so visitors aren't staring at blank spaces.
Before You Switch: Price Both on Your Real Numbers
Run this two-minute check before deciding:
- Count your subpages. Roughly how many unique URLs does each domain have? That number sets your Cookiebot tier.
- Count your domains. Both tools charge per domain, so multiply accordingly.
- Check your traffic. Cookiebot's tiers ignore traffic; make sure your consent-log and pageview volumes fit CookieBeam's plan.
- List your must-haves. Server-side tagging, A/B testing, 47-language coverage, or IAB certification can be the deciding factor before price even matters.
Migrating Between the Two
Switching CMPs is more than swapping a script tag: you need to preserve consent records, remap categories, and avoid breaking Consent Mode or your tag manager. If you're moving from Cookiebot to CookieBeam specifically, follow our step-by-step Cookiebot to CookieBeam migration guide. For the general principles that apply to any switch, see how to migrate your CMP without losing existing consent.
The Bottom Line
Cookiebot and CookieBeam are both real, compliance-grade CMPs. Cookiebot wins on language breadth, longevity, and its free tier for tiny sites; its subpage-based pricing is the main drawback for large or multi-domain sites. CookieBeam wins on flat per-domain pricing, a 5-layer script interception engine with scan-derived script maps, connection-level blocking (fetch, XHR, beacon, WebSocket, EventSource) that goes beyond what most CMPs enforce, continuous drift detection between scans, GPC/DNT enforcement with per-region overrides, hosted server-side tagging, and built-in A/B testing. Which one fits depends on your site's size, how important deep blocking and drift visibility are to you, and whether server-side tagging and experimentation matter. Price both against your real subpage and domain counts, and check current figures on each vendor's own pricing page before you commit.
Primary sources: Cookiebot pricing, Google Consent Mode developer docs, and IAB Europe TCF. Pricing verified as of mid-2026; check the vendor pages for current numbers.