Cookiebot Not Blocking Cookies? Here's How to Debug and Fix It

If Cookiebot is visible but an analytics cookie still appears before you choose, first establish whether it is a fresh write. Clear site data, start a new session and repeat on the exact URL. An old cookie left after a previous acceptance can make a working configuration look broken.

Capture the request before changing settings

1. Open Network with Preserve log before loading the page. Do not interact with the banner.
2. Record the cookie name, domain and category, then locate the script or response that creates it.
3. Inspect the request initiator. Identify whether it comes from GTM, a plugin, the theme, an embed or a direct script.
4. Run the free cookie audit for a second passive observation. Remember that the server browser may use a different region from your browser.

Three causes to check first

1. A second tracker installation bypasses the gate

Search your theme, analytics plugins and GTM for the same measurement ID. Fixing the tag in GTM will not affect a separate hardcoded copy. After removing a duplicate, verify that acceptance starts the intended tracker once and rejection keeps it gated.

2. Automatic blocking has incomplete resource information

Cookiebot’s automatic blocking relies on knowing which resources need to be controlled. Review the latest scan inventory and classification, and inspect the live loader and script order against the official auto-blocking requirements. A newly added service may need configuration work before your next test.

3. The published page differs from your preview

Confirm the domain-group ID, production hostname and published configuration. Inspect the HTML delivered to a logged-out visitor, not only your admin session. After a fix, clear the relevant page or CDN cache and retest with the same region and browser conditions.

Manual blocking and GTM require separate checks

If you use manual script markup, check the inactive script type and data-cookieconsent category against the intended purpose. Look for an ordinary executable copy that escapes this markup. If GTM owns the integration, inspect consent settings and triggers in Preview. Follow the Cookiebot configuration audit for a complete test matrix.

For Google tags, a pre-choice network request is not automatically proof that Cookiebot failed. Advanced Consent Mode can send cookieless pings with denied consent. Compare the four Google consent fields, actual cookie writes and your intended basic or advanced implementation using Google’s guidance.

Retest each choice independently

What to send the implementation owner

Provide the affected URL, browser and region, reproduction steps, expected category behavior, cookie or endpoint, initiator and timestamp. Include a screenshot of the selected purposes. Use Initiator Trace for source clues and a redacted debug snapshot for handoff, then retest the same scenario after deployment.

Why does the result differ between scans?

A stored choice, geographic rule, blocked resource, login or slow-loading script can change the observation. Record those conditions rather than comparing only total cookie counts. One clean passive visit does not verify all consent flows.