Automatic cookie blocking

• Intro
• How does it work?
• Am I using automatic cookie blocking?
• How do I switch from manual to automatic cookie blocking?
• How long does it take to implement?
• How do I know it's working?
  • Check your scan report
  • Manual check via the browser
• Troubleshooting: why are cookies still being set?

Intro

Automatic cookie blocking is a feature that can be enabled in Cookiebot CMP. With automatic cookie blocking, Cookiebot blocks all cookies - except those strictly necessary - from being set, until a user has provided consent. Based on the user's consent choices and the categories that they opt in to, Cookiebot allows cookies in the approved categories to be set.

How does it work?

The Cookiebot scanner crawls through the website and identifies all cookies being set, the related scripts, iframes, videos, images, etc., as well as several other methods used to track users and set cookies, including pixels. For more information about this topic see: What kinds of cookies and tracking technologies does the Cookiebot scanner find?

Based on the scan results and the cookie classification, a configuration file is automatically built and made available to the consent banner script implemented on the website.

Every time the website is scanned and changes are made to the settings, the configuration file is updated and the latest information is applied when automatically blocking cookies.

When your website is accessed by a user, our consent banner instantly reads and applies the configuration file, allowing all necessary cookies and blocking the rest, until all, some or none are allowed, based on the consent given by the user's interaction with the banner.

In technical terms, each cookie-setting resource, such as scripts, is registered and given a unique identifier so that it can be identified at a later stage. Our algorithm includes several methods by which it identifies and verifies scripts, including, but not limited to: consent checksums, files, paths and keyword matchings.

If a script has been identified as the initiator of several cookies and these cookies belong to different categories, then this script is blocked unless all categories that the cookies belong to have been consented to.

To exemplify:

The script abc.js is the source of two cookies: a preference cookie named favorite_page and a statistics cookie named visitor_stats.

If the user visiting the website decides to give their consent to only preference cookies, opting out of statistics and marketing cookies, all scripts setting statistics and marketing cookies are blocked.

In our example abc.js is blocked as well and favorite_page is not set, despite the user opting in to preference cookies.

Am I using automatic cookie blocking?

<script
  id="Cookiebot"
  src="https://consent.cookiebot.com/uc.js"
  data-cbid="00000000-0000-0000-0000-000000000000"
  type="text/javascript"
  async
></script>

<script
  id="Cookiebot"
  src="https://consent.cookiebot.com/uc.js"
  data-cbid="00000000-0000-0000-0000-000000000000"
  data-blockingmode="auto"
  type="text/javascript"
></script>

How do I switch from manual to automatic cookie blocking mode?

<script
  id="Cookiebot"
  src="https://consent.cookiebot.com/uc.js"
  data-cbid="00000000-0000-0000-0000-000000000000"
  type="text/javascript"
  async
></script>

<script
  id="Cookiebot"
  src="https://consent.cookiebot.com/uc.js"
  data-cbid="00000000-0000-0000-0000-000000000000"
  data-blockingmode="auto"
  type="text/javascript"
></script>

How long does it take to implement?

Once you've added your domain to the Cookiebot Manager it takes up to 24 hours for the first scan and analysis of your website to complete. When you add the Cookiebot script to your website, several predefined known cookies are blocked right away until cookie consent has been obtained. The rest of your cookies are controlled by Cookiebot as soon as the scan has completed.

Changes to categorization of cookies in the manager may take up to two minutes to show on your website.

How do I know it's working?

If you're unsure whether your consent banner is working properly and whether your cookies are held back by our automatic cookie blocking function, you can do the following to check whether the solution is working as intended:

1. Check your latest cookie scan report for issues
2. Do a manual check via your browser

1. Check your scan report for issues

We added built-in compliance checks to our scanner to make sure you are automatically notified of any issues per cookie in your scan reports. Every month we advise you to check your scan report and keep an eye out for the following three issues:

1. Unclassified cookies found
2. Cookies not blocked before consent is given
3. Cookies that send data to inadequate countries

1.1. Unclassified cookies

To make sure your cookies are blocked correctly, they need to be classified in one of the four categories:

1. Necessary
2. Marketing
3. Statistics
4. Preference

For more information on unclassified cookies and how to manually categorize them, see: Check your unclassified cookies.

1.2. Cookies not blocked before consent is given

If a cookie is not blocked until consent has been given, this is stated in your scan report:

If you can see any cookies referring to this issue, it is important to check up on the cause of this. As a first step, see if you can reproduce the issue by running a manual check via your browser (see also step 2 in this article). Can you also see the cookie set before consent is given via your browser? This is most likely due to an issue with the banner script implementation and you can use the following checklist to discover the cause:

If you are using automatic cookie blocking;

✔ Is Cookiebot the first script on the page to load

Make sure that the Cookiebot script is the very first script to load on your website. This is essential for our script’s ability to hold back cookies until consent has been obtained.

✔ Has the Cookiebot script been implemented multiple times

Both the banner and declaration script should only be implemented once, otherwise this may cause issues with auto-blocking.
Example: You are using WordPress and have enabled Cookiebot via the plugin AND added the script inline to your website code.
Example: You use Google Tag Manager on your website and have enabled Cookiebot via your Tag Manager setup AND have also added the banner script inline to your source code.

✔ Check your Google Tag Manager setup

Are you using GTM to implement Cookiebot on your website? Ensure your GTM is configured to check consent settings before loading tags which set cookies.
Review our GTM installation guide here.

✔ Check whether the cookie is set by the webserver

In your Cookie report you may have cookies that are set by your webserver, also known as “server-side cookies”, these are marked like this:

Initiator: Webserver

These you will have to block by adding server-side code, to withhold these cookies until consent has been given. You may have to contact your web host or web solution vendor to find out more about these cookies. See the "Server Side Usage" section of our developer documentation for adding server-side Cookiebot logic.

1.3. Cookies that send data to inadequate countries

This issue is reported per cookie and you can see the following text added:

For more information regarding adequate countries, see: Send personal data to "adequate" 3rd countries.

2. Manual check via the browser

Note, all below examples are from Google Chrome on Windows. Other browsers and other operating systems have similar options, but you find small deviations to the method mentioned.

1. Open a new session of your browser in private or incognito mode. In your browser hit CTRL+SHIFT+N
2. Navigate to your website and check that the consent banner appears as expected.
3. Hit F12 in your browser to open developer mode. In the new window navigate to "Application" ❶ in the top menu bar and choose "Cookies" ❷ in the left hand menu under Storage.If Cookies show up, mark them with your mouse and delete them until no cookies are present on your website.
4. Now reload your website hitting F5 in your browser. You see the banner, and possibly some cookies appear, like this:Click a link or two on your website, to navigate to other pages, without interacting with the cookies banner. If the banner disappears, you may have "Implied consent" configured. Log in to your account, navigate to Settings -> Dialog and change this to "Explicit consent" if you want the banner to stay until consent is given through a click on the OK button.
   
   Notice how no other cookies than the few strictly necessary cookies you may have on your website are being set.
5. Activate the consent banner by choosing which categories you want to opt in to and click OK. You now see more cookies being set.

Troubleshooting: why are cookies still being set?

✔ Check your script

Make sure that you are using the automated blocking mode (Check your script and blocking mode)

✔ Wait 24 hours

When you first sign up for Cookiebot and implement our services on your website it may take up to 24 hours for our scans to complete and for all cookies to be under the control of the automatic cookie blocker. We are able to block a large amount of cookies as soon as our script is on your site, but for full coverage an initial scan and analysis of your website is required. This happens automatically within the first 24 hours.

✔ My scan report says "Prior consent enabled: "no"

The very first scan of your website is used to analyze your cookies and apply our algorithms to make sure all cookies are held back, except for those that are strictly necessary, until consent has been given. Your first scan report reflects the state of your website before this analysis has been completed. It is a reflection of the state of your website before full coverage was created by the scan. When you receive the report, the analysis has completed and you have full coverage. Your next report, created upon completion of your next scan, shows the state of your website with automatic cookie blocking fully implemented.

✔ Our compliance test says "Not compliant"

Make sure you wait at least 24 hours from signing up and implementing until you use the compliance test to scan your website.

✔ Cookies are still not blocked

Make sure that you have inserted the Cookiebot script at the very top of your website, as the very first element inside your <head>-element. 
Also make sure that your Cookiebot script does not contain the async attribute on the script tag.

Contact us