Switch from Cookiebot to Cookiequiet

Switching from Cookiebot to Cookiequiet is mostly a matter of replacing one script tag, because Cookiequiet reads the data-cookieconsent attribute Cookiebot uses to mark scripts: statistics becomes analytics, preferences becomes functional, marketing stays marketing. The parts that need your attention are iframes marked with data-cookieblock-src, custom code that listened to Cookiebot's callbacks, the cookie declaration script, and one scope question: if you used Cookiebot as a certified CMP for Google AdSense or Ad Manager ads, keep a certified CMP for those ads, because Cookiequiet is not one.

The markup you already have

Cookiebot's manual implementation marks scripts by changing type to text/plain and adding data-cookieconsent with one or more of preferences, statistics and marketing:

html
<script type="text/plain" data-cookieconsent="statistics"
  src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>

This tag works with Cookiequiet unchanged. The marking logic reads data-cq-category, then data-cookiecategory, data-cookieconsent and data-category, takes the first category listed, and maps the aliases: statistics and performance to analytics, preferences to functional, marketing (and advertising, targeting) to marketing. When the visitor grants the category, the script is activated in place.

Two differences to know. Cookiebot allows a comma-separated list of categories on one tag; Cookiequiet uses the first one, so a tag marked "statistics, marketing" is treated as analytics. Split such tags or pick the stricter category (marketing). And scripts marked data-cookieconsent="ignore", which told Cookiebot's automatic mode to leave them alone, are simply not blocked by Cookiequiet when they have a normal type; remove the attribute or leave it, it has no effect.

Iframes

For embeds, Cookiebot's support article on iframe consent (the YouTube example) replaces src with data-src, or data-cookieblock-src when data-src is taken by a lazy loader, plus data-cookieconsent="marketing". Cookiequiet looks for data-cq-src. Rename the attribute and keep the category attribute, which is still read:

An iframe marked for Cookiebot:

html
<iframe data-cookieblock-src="https://www.youtube-nocookie.com/embed/VIDEO_ID"
  data-cookieconsent="marketing" width="560" height="315"></iframe>

The same iframe for Cookiequiet:

html
<iframe data-cq-src="https://www.youtube-nocookie.com/embed/VIDEO_ID"
  data-cookieconsent="marketing" width="560" height="315"></iframe>

A search and replace of data-cookieblock-src and data-src (on consent-gated iframes only) for data-cq-src does it. The YouTube guide shows the placeholder pattern.

Automatic blocking

If you relied on Cookiebot's automatic blocking mode rather than manual markup, the equivalent is Cookiequiet's auto-blocker, enabled in the dashboard or with data-auto-block="1" on the snippet. It intercepts scripts and iframes created by JavaScript whose host is in the provider database of about 80 trackers and holds them until consent. A tracker hard-coded in the HTML above the consent script runs before anything can stop it, so the snippet goes first in the head and tags above it are marked by hand. Details in the script blocking guide.

Custom code and callbacks

Cookiebot's developer documentation describes events such as CookiebotOnAccept and CookiebotOnTagsExecuted, and a Cookiebot.consent object with per-category booleans. The equivalents:

• window.addEventListener('cq:consent', e => ...) fires on every choice, with e.detail.categories listing the granted categories;
• window.Cookiequiet.on(callback) registers for changes and returns an unsubscribe function;
• window.Cookiequiet.get() returns the stored choice (or null);
• window.Cookiequiet.showPreferences() replaces the renew call used by "Change your consent" links, or give the link the data-cq-show-preferences attribute.

The cookie declaration

Cookiebot's cd.js script renders a cookie declaration on a page of your site. Cookiequiet generates the cookie policy, including the cookie table, from its scan, hosted at a stable address or copied as Markdown or HTML into your own page. Remove the declaration script and link to the new policy from the banner and the footer. The cookie policy guide explains what the page should contain.

Google tags and Consent Mode

Cookiebot sends Consent Mode signals, and so does Cookiequiet when the snippet carries data-consent-mode="1": defaults denied before any Google tag runs, updates on every choice, with marketing driving ad_storage, ad_user_data and ad_personalization, analytics driving analytics_storage, and functional driving functionality_storage and personalization_storage. Tag Manager triggers based on Cookiebot's dataLayer events should move to the cq_consent event with its category flags. See the Consent Mode guide.

The scope question: TCF and Google ads

Cookiebot is a Google-certified CMP for the IAB Transparency and Consent Framework. Cookiequiet is not: websites that show Google AdSense, Ad Manager or AdMob ads to visitors in the EEA, the UK or Switzerland need a certified CMP for those ads. Google Analytics 4, Google Ads conversion tracking, Meta Pixel, embedded videos and chat widgets work with Cookiequiet's Consent Mode integration. If your site runs AdSense for European visitors, the switch is not for that site.

Order of operations

Prepare the attribute renames and the custom code on staging. Then, in one release, remove the Cookiebot script tag (the uc.js tag with your data-cbid) and the declaration script, and add the Cookiequiet snippet first in the head. Visitors see the new banner once, since the stored choice lives in a different cookie. Run a scan afterwards: it should report no other consent tool and Consent Mode present.

What visitors will notice

The banner changes appearance, and returning visitors are asked once more. If your Cookiebot configuration already showed a Deny button next to Allow all, the acceptance rate should barely move; if it did not, expect it to settle lower, with the compliance risk going the same way. Visitors outside consent countries stop seeing a banner if you set geo-targeting to regulated countries only, and visitors in US states with a privacy law see an opt-out notice instead.

A rollback plan

Keep the Cookiebot account for a week and the old script tag in version control. Reverting is one deployment: remove the Cookiequiet snippet and restore the uc.js tag; your data-cookieconsent markup never stopped being valid for either tool. The usual problems after a switch are smaller than that: an iframe whose attribute was not renamed, or a Tag Manager trigger still listening for a Cookiebot event.