Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
CookieConsent is the cookie Cookiebot, the consent platform from Usercentrics, uses to remember a visitor’s choices. If you see it on a site, that site runs Cookiebot. It’s a useful cookie to understand because it’s the one that makes a consent banner remember anything at all.
What Is the CookieConsent Cookie?
According to Cookiebot’s support article on consent logging, when a visitor submits a choice, Cookiebot stores the visitor’s consent state together with “a random, unique, anonymous and encrypted key” in a first-party cookie named CookieConsent. The site reads it on later page loads so it can respect the visitor’s choice without asking again.
The same consent state and key are also sent to Cookiebot’s servers for its consent log, along with an anonymized IP address, the date and time, the browser’s user agent and the page URL. The key in the cookie is what lets a site owner look up that log entry later as proof of consent.
What’s Inside It?
The value typically records whether the visitor accepted each category Cookiebot uses (necessary, preferences, statistics and marketing), plus the consent key, a timestamp and version details. You can read it in DevTools under the site’s cookies. Cookiebot also mentions a companion cookie, CookieConsentBulkSetting, used when consent is applied across multiple domains.
How Long Does CookieConsent Last?
Cookiebot says consent is retained for 12 months by default, and site owners can change the period in the Cookiebot manager. When the cookie expires, the banner appears again on the next visit. In Safari, WebKit’s tracking prevention caps script-set cookies at seven days; Cookiebot says its script resets the expiry each time the visitor returns within that window, until the configured date.
Does CookieConsent Itself Need Consent?
No. Storing a visitor’s consent choice is widely accepted as strictly necessary, because the site needs it to obey the law and the visitor’s wishes. European regulators have treated consent-preference cookies as exempt. It should still be listed in your cookie declaration, which Cookiebot generates.
The same logic applies to other platforms’ consent cookies, such as OneTrust’s OptanonConsent and Google’s FCCDCF.
What CookieConsent Doesn’t Prove
A stored “accepted” value shows what the visitor chose. It doesn’t prove your tags obeyed it. Common gaps:
- Tags hard-coded in templates that load before Cookiebot’s script runs.
- Scripts not marked for Cookiebot’s auto-blocking or not mapped to the right category.
- Consent that isn’t passed to Google Consent Mode or other vendors’ consent APIs.
- Global Privacy Control signals that aren’t honored for US visitors.
That’s why audits pair the consent record with a scan of what actually fires.
How to Reset or Delete CookieConsent
- Visitors: use the site’s “Cookie settings” link to change consent, or delete
CookieConsentandCookieConsentBulkSettingfor that domain. The banner will reappear. - Site owners testing the banner: open a private window, or delete the cookie, to see the first-visit experience.
- Developers: Cookiebot’s JavaScript API exposes methods to renew or withdraw consent from your own links.
Switching From Cookiebot
If you’re moving platforms, plan how existing consent records carry over, since the new platform won’t read CookieConsent. Our comparisons of Cookiebot alternatives, OneTrust vs Cookiebot and Cookiebot vs CookieYes cover the trade-offs. Captain Compliance’s consent banner stores choices in its own first-party cookie, keeps a consent log, honors Global Privacy Control and pairs with our cookie scanner to check that blocked tags really stay blocked. See our cookie consent best practices for setup guidance.
FAQ
Does CookieConsent track me?
No. It records your choices and a random key; it isn’t used for analytics or advertising.
Why does the banner keep reappearing in Safari?
Safari limits script-set cookies to seven days. If you don’t return within a week, the cookie expires and you’ll be asked again.
Is the consent key personal data?
It’s pseudonymous and links to a log entry with an anonymized IP, so treat it as personal data with low risk.
The CookieConsent cookie is the visitor’s side of the record. Whether your tags respected it is something only a scan of the live site can show.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
