# Switch from Cookiebot to Cookiequiet

> Cookiebot's data-cookieconsent markup keeps working with Cookiequiet: replace the script tag, rename data-cookieblock-src to data-cq-src and re-check the site.

Source: https://cookiequiet.com/guides/switch-from-cookiebot
Published: 2026-10-20
Publisher: Cookiequiet

## Steps

1. **Create the site and scan it** Add the website in Cookiequiet and run the scan to rebuild the provider and cookie table; check the categories it assigns against your Cookiebot declaration.
2. **Reproduce the banner texts and design** Copy custom wording and colours into the banner designer, for each language your audience uses.
3. **Export your Cookiebot records** Download the consent statistics or logs available in your Cookiebot account and archive them with your compliance files.
4. **Keep the script markup, split multi-category tags** Scripts with type text/plain and data-cookieconsent keep working. Where a tag lists several categories, keep the strictest or split the tag.
5. **Rename iframe attributes** Replace data-cookieblock-src (or data-src on gated iframes) with data-cq-src; the data-cookieconsent category attribute is still read.
6. **Replace callbacks and the declaration** Move custom code to the cq:consent event or Cookiequiet.on, replace renew links with data-cq-show-preferences, and link to the generated cookie policy instead of cd.js.
7. **Swap the scripts in one release** Remove the Cookiebot uc.js tag and add the Cookiequiet snippet first in the head with Consent Mode and auto-blocking on.
8. **Verify** Check before any click, after Reject all and after Accept all in a private window, then run a scan to confirm no other CMP remains.

Switching from Cookiebot to Cookiequiet is mostly a matter of replacing one script tag, because Cookiequiet reads the `data-cookieconsent` attribute Cookiebot uses to mark scripts: `statistics` becomes analytics, `preferences` becomes functional, `marketing` stays marketing. The parts that need your attention are iframes marked with `data-cookieblock-src`, custom code that listened to Cookiebot's callbacks, the cookie declaration script, and one scope question: if you used Cookiebot as a certified CMP for Google AdSense or Ad Manager ads, keep a certified CMP for those ads, because Cookiequiet is not one.

## The markup you already have

Cookiebot's manual implementation marks scripts by changing `type` to `text/plain` and adding `data-cookieconsent` with one or more of `preferences`, `statistics` and `marketing`:

```html
<script type="text/plain" data-cookieconsent="statistics"
  src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>
```

This tag works with Cookiequiet unchanged. The marking logic reads `data-cq-category`, then `data-cookiecategory`, `data-cookieconsent` and `data-category`, takes the first category listed, and maps the aliases: statistics and performance to analytics, preferences to functional, marketing (and advertising, targeting) to marketing. When the visitor grants the category, the script is activated in place.

Two differences to know. Cookiebot allows a comma-separated list of categories on one tag; Cookiequiet uses the first one, so a tag marked `"statistics, marketing"` is treated as analytics. Split such tags or pick the stricter category (marketing). And scripts marked `data-cookieconsent="ignore"`, which told Cookiebot's automatic mode to leave them alone, are simply not blocked by Cookiequiet when they have a normal type; remove the attribute or leave it, it has no effect.

## Iframes

For embeds, Cookiebot's support article on iframe consent (the YouTube example) replaces `src` with `data-src`, or `data-cookieblock-src` when `data-src` is taken by a lazy loader, plus `data-cookieconsent="marketing"`. Cookiequiet looks for `data-cq-src`. Rename the attribute and keep the category attribute, which is still read:

An iframe marked for Cookiebot:

```html
<iframe data-cookieblock-src="https://www.youtube-nocookie.com/embed/VIDEO_ID"
  data-cookieconsent="marketing" width="560" height="315"></iframe>
```

The same iframe for Cookiequiet:

```html
<iframe data-cq-src="https://www.youtube-nocookie.com/embed/VIDEO_ID"
  data-cookieconsent="marketing" width="560" height="315"></iframe>
```

A search and replace of `data-cookieblock-src` and `data-src` (on consent-gated iframes only) for `data-cq-src` does it. The [YouTube guide](/guides/youtube-embeds-and-consent) shows the placeholder pattern.

## Automatic blocking

If you relied on Cookiebot's automatic blocking mode rather than manual markup, the equivalent is Cookiequiet's auto-blocker, enabled in the dashboard or with `data-auto-block="1"` on the snippet. It intercepts scripts and iframes created by JavaScript whose host is in the provider database of about 80 trackers and holds them until consent. A tracker hard-coded in the HTML above the consent script runs before anything can stop it, so the snippet goes first in the head and tags above it are marked by hand. Details in [the script blocking guide](/guides/block-scripts-until-consent).

## Custom code and callbacks

Cookiebot's developer documentation describes events such as `CookiebotOnAccept` and `CookiebotOnTagsExecuted`, and a `Cookiebot.consent` object with per-category booleans. The equivalents:

- `window.addEventListener('cq:consent', e => ...)` fires on every choice, with `e.detail.categories` listing the granted categories;
- `window.Cookiequiet.on(callback)` registers for changes and returns an unsubscribe function;
- `window.Cookiequiet.get()` returns the stored choice (or null);
- `window.Cookiequiet.showPreferences()` replaces the renew call used by "Change your consent" links, or give the link the `data-cq-show-preferences` attribute.

## The cookie declaration

Cookiebot's `cd.js` script renders a cookie declaration on a page of your site. Cookiequiet generates the cookie policy, including the cookie table, from its scan, hosted at a stable address or copied as Markdown or HTML into your own page. Remove the declaration script and link to the new policy from the banner and the footer. The [cookie policy guide](/guides/how-to-write-a-cookie-policy) explains what the page should contain.

## Google tags and Consent Mode

Cookiebot sends Consent Mode signals, and so does Cookiequiet when the snippet carries `data-consent-mode="1"`: defaults denied before any Google tag runs, updates on every choice, with marketing driving `ad_storage`, `ad_user_data` and `ad_personalization`, analytics driving `analytics_storage`, and functional driving `functionality_storage` and `personalization_storage`. Tag Manager triggers based on Cookiebot's dataLayer events should move to the `cq_consent` event with its category flags. See [the Consent Mode guide](/guides/google-consent-mode-v2).

## The scope question: TCF and Google ads

Cookiebot is a Google-certified CMP for the IAB Transparency and Consent Framework. Cookiequiet is not: websites that show Google AdSense, Ad Manager or AdMob ads to visitors in the EEA, the UK or Switzerland need a certified CMP for those ads. Google Analytics 4, Google Ads conversion tracking, Meta Pixel, embedded videos and chat widgets work with Cookiequiet's Consent Mode integration. If your site runs AdSense for European visitors, the switch is not for that site.

## Order of operations

Prepare the attribute renames and the custom code on staging. Then, in one release, remove the Cookiebot script tag (the `uc.js` tag with your `data-cbid`) and the declaration script, and add the Cookiequiet snippet first in the head. Visitors see the new banner once, since the stored choice lives in a different cookie. Run a scan afterwards: it should report no other consent tool and Consent Mode present.

## What visitors will notice

The banner changes appearance, and returning visitors are asked once more. If your Cookiebot configuration already showed a Deny button next to Allow all, the acceptance rate should barely move; if it did not, expect it to settle lower, with the compliance risk going the same way. Visitors outside consent countries stop seeing a banner if you set geo-targeting to regulated countries only, and visitors in US states with a privacy law see an opt-out notice instead.

## A rollback plan

Keep the Cookiebot account for a week and the old script tag in version control. Reverting is one deployment: remove the Cookiequiet snippet and restore the `uc.js` tag; your `data-cookieconsent` markup never stopped being valid for either tool. The usual problems after a switch are smaller than that: an iframe whose attribute was not renamed, or a Tag Manager trigger still listening for a Cookiebot event.

## Questions

### Do I have to re-mark my scripts?

No. Tags marked with type text/plain and data-cookieconsent are read by Cookiequiet, with statistics mapped to analytics and preferences to functional. Only tags listing several categories need a decision, since the first category listed is used.

### What replaces the Cookiebot cookie declaration?

The cookie policy Cookiequiet generates from its scan, with the cookie table, hosted at a stable address or copied into your own page. Remove the cd.js script and update the links.

### What if my site serves Google AdSense to European visitors?

Keep a Google-certified CMP for the IAB TCF for those ads; Cookiequiet is not certified for that framework. The rest of the stack (GA4, Google Ads conversions, Meta Pixel, embeds) works with its Consent Mode integration.

### Will the stored consent carry over?

No. The choice is stored in a different cookie, so returning visitors are asked once more. That is normal when the consent tool changes.

## Sources

- [Cookiebot, Manual implementation (prior consent markup)](https://www.cookiebot.com/en/manual-implementation/)
- [Cookiebot Support, Iframe cookie consent with YouTube example](https://support.cookiebot.com/hc/en-us/articles/360003790854)
- [Google, Set up consent mode on websites](https://developers.google.com/tag-platform/security/guides/consent)
- [Google, EU user consent policy](https://www.google.com/about/company/user-consent-policy/)