Feroot vs Cookiebot (2026): Which Detects Pre-Consent Violations?
Ott Ristikivi | Founder & CEO of SecureSpells
10 min read
SecureSpells
Feroot vs Cookiebot: the short answer
Feroot and Cookiebot detect pre-consent violations in different ways. Cookiebot is a consent management platform: its scanner finds cookies so its own banner can block them, and its monthly scan report flags cookies not blocked before consent. Feroot is an independent audit layer: it loads your pages as a visitor and reports what fires before, and after, a consent choice.
They are not substitutes. Cookiebot collects consent and blocks tags. Feroot states that its consent audit product does not replace a CMP. The practical question is not "which one", but "who checks that the blocking works".
Scope: EU/EEA GDPR and the ePrivacy Directive (Article 5(3), consent before non-essential storage and access). Feroot also maps findings to US and other non-EU laws; this article does not assess those. Educational content, not legal advice.
- Pre-consent violation
A non-essential cookie, script, pixel, or request that runs before the visitor has made a consent choice — for example an analytics or ad tag that fires on first page load while the banner is still showing.
- Consent management platform (CMP)
Software that shows the consent banner, records the visitor's choice, and enables or blocks tags based on that choice. Cookiebot is a CMP.
- Independent consent audit
A check run by a tool other than your CMP that observes what actually loads in a browser in each consent state. Feroot DXComply and SecureSpells both work this way.
Methodology and sources
This comparison is based on vendor documentation read on 2026-10-02, not on hands-on scans of either product. Where a capability is not described in the vendor's own documentation, we say so instead of guessing. Features and names change; check the linked pages before you buy.
- Cookiebot: Automatic cookie blocking, How does auto-blocking work?, Scan schedule, Compliance test.
- Feroot: DXComply, Free cookie consent scanner, Free scanners overview, Consent management audit.
- SecureSpells: capabilities checked against our own audit engine (check registry and audit worker), not marketing copy.
Quick comparison table
| Dimension | Cookiebot | Feroot (DXComply + free scanner) |
|---|---|---|
| Product type | CMP: banner, consent records, tag blocking | Consent audit layer that runs alongside your CMP |
| Who checks the blocking | The same platform that does the blocking | A tool independent of your CMP |
| How pre-consent is reported | Scan report flags cookies not blocked before consent, listed per cookie | Free scan flags trackers and cookies that fire before consent for a first-time visitor |
| Consent states covered | Pre-consent (scan report) | DXComply: Default, Accept All, Reject All, Global Privacy Control (GPC) |
| Cadence | First scan when the domain is added, then monthly (daily optional) | DXComply: continuous, repeated audits |
| Coverage | Website (scanner crawls the site) | Websites, web apps, and native mobile apps (no SDK, per Feroot) |
| Evidence | Scan report per cookie (category, initiator, issue) | Dated findings with session recordings and reasoning logs (vendor, trigger, destination) |
| Free option | Compliance test; detailed results require an email address | Free cookie consent scanner; Feroot states no signup and results in under a minute |
How Cookiebot detects pre-consent cookies
Cookiebot's detection exists to feed its own blocking. According to its support documentation:
- The scanner crawls the site and identifies cookies and the scripts, iframes, images, and pixels that set them.
- A configuration file is built from the scan. The banner script reads it on every page view and holds back anything not classified as necessary until the visitor consents.
- Scans repeat monthly (or daily, if chosen). The first scan runs on the day the domain is added.
- Each scan report includes built-in compliance checks, with three issues to watch: unclassified cookies, cookies not blocked before consent, and cookies that send data to countries without adequacy.
The documentation is candid about where pre-consent leaks come from in a Cookiebot setup:
- Load order: "Any element that loads before the Cookiebot script can set cookies without consent." The script must be the first script on the page and must not use
asyncordefer. - Before the first scan, the auto-blocker has no instructions and falls back to a list of known trackers.
- Unclassified trackers are not blocked before consent, because they might be necessary.
- Server-set cookies (initiator: webserver) must be held back with your own server-side code.
- Tag manager setups must check consent state before loading tags.
Cookiebot itself recommends confirming the scan report with a manual browser check: incognito window, DevTools, look at cookies before and after the banner choice.
What this means for detection: Cookiebot's pre-consent check is the CMP reporting on its own configuration, on a monthly cycle, issue by issue per cookie. It is a useful first signal for Cookiebot customers. It is not an independent verification of what your site sends.
How Feroot detects pre-consent violations
Feroot approaches the same problem from outside the CMP.
- Free cookie consent scanner: per Feroot, it "loads your page as a first-time visitor and flags every tracker and cookie that fires before consent". It returns a prioritized remediation list and needs no signup. Feroot lists GDPR, CCPA/CPRA, HIPAA, PIPEDA, and LGPD as evaluated frameworks.
- DXComply (paid): continuous consent auditing across websites, web apps, and native mobile apps. Each audit compares vendor behavior across four consent states: Default (no choice), Accept All, Reject All, and Global Privacy Control. Country-specific opt-in, opt-out, and do-not-sell mechanisms are also covered.
- Evidence: findings are dated and exportable, with session recordings and reasoning logs that identify the vendor, the trigger, and the data destination.
- Relationship to the CMP: Feroot's own FAQ says DXComply does not replace your consent platform. It "independently tests whether those choices are honored on live pages and app screens."
What this means for detection: Feroot checks what happens after each consent choice, not just before it. It is not tied to any one CMP's classification. That is the structural difference from a CMP's self-check.
Which one better detects pre-consent violations?
If the question is independent detection, Feroot's approach is the stronger design. A CMP scan report can only describe the CMP's view of the site, on the CMP's schedule. An independent audit observes what the browser actually sends, whatever the CMP believes it is blocking.
If the question is prevention, you still need a CMP. Detection does not collect consent or hold tags back. Cookiebot does both.
| Your situation | What to use |
|---|---|
| You run Cookiebot and want a first signal that blocking works | Cookiebot's monthly scan report + a manual DevTools check after every tag change |
| You need evidence that does not come from the vendor doing the blocking | An independent audit layer (Feroot, SecureSpells, or a documented manual test) |
| You must test Global Privacy Control or native mobile apps | Feroot DXComply (documented coverage); SecureSpells does not test GPC or native apps |
| You audit many EU client websites and need a risk-scored report per site | A runtime compliance audit with scheduled re-scans (see below) |
Where SecureSpells fits
SecureSpells is a runtime compliance auditing platform. It is CMP-agnostic, so it works the same whether a site uses Cookiebot, another CMP, or a custom banner. Verified against our own audit engine:
- What it checks: cookies set before consent, third-party embeds that set cookies before consent, cookies that still appear after "Reject", a missing reject control, and pre-checked opt-ins.
- How: it runs the page in a real Chromium browser (desktop and mobile viewports), observes network requests, cookies, and storage, and also samples up to 25 same-origin linked pages for cookie and banner checks.
- Output: findings with evidence and a 1–5 Risk Score built for EU/EEA enforcement priorities, plus scheduled re-scans so a new tag does not go unnoticed. Agencies can record verification decisions on findings in the Auditor Workbench.
- What it does not do: it does not block tags or replace a CMP, test Global Privacy Control, audit native mobile apps, or record user sessions.
The free scan needs no signup. Post-reject results appear in the paid report, not the free view; see what the free scan includes.
Check what fires before consent on your site. Works with Cookiebot, Feroot-audited, or any other consent setup.
Check it yourself in five minutes
Whichever tool you use, a manual check is the baseline evidence every vendor's numbers should match:
- Open an incognito window, open DevTools first, and tick Preserve log in the Network tab.
- Load the page without touching the banner. Note every third-party request (analytics, ad, social, session-replay domains) and every cookie under Application → Cookies.
- Click Reject all and reload. Nothing non-essential should appear.
- In a fresh incognito window, click Accept all. The tags you consented to should now load.
- Repeat after every release that touches tags, the tag manager, or the CMP configuration.
For the detailed version, see how to detect cookies loading before consent and how trackers bypass cookie consent.
Frequently asked questions
Does Feroot offer a free cookie consent scanner?
Yes. Feroot offers a free cookie consent scanner that, per its own page, needs no signup and returns results in under a minute. It loads the page as a first-time visitor and flags trackers and cookies that fire before consent. Feroot also lists free PCI checkout and ROPA scanners on its free scanners page.
Does Cookiebot detect cookies set before consent?
Yes, for its own customers. Cookiebot's scan report includes a built-in check for cookies not blocked before consent, reported per cookie. Cookiebot recommends confirming it with a manual browser check. The free public compliance test requires an email address to see detailed results.
Is Feroot's cookie consent scanner accurate?
We have not run a benchmark of Feroot's scanner and know of no independent public accuracy study. The reliable way to judge any scanner, including ours, is to compare its findings against the five-minute manual check above on a page where you know what should load.
Can I use Feroot and Cookiebot together?
Yes. That is how Feroot positions DXComply: your CMP (for example Cookiebot) collects and enforces consent, and the audit layer independently tests whether those choices are honored. The same pairing applies to SecureSpells.
Which is better for an EU agency managing client sites?
It depends on what you must prove. If clients need GPC or native-app coverage, Feroot documents it. If you need a CMP-agnostic, EU-focused risk score and repeatable evidence per client website, a runtime compliance audit fits. Every client still needs a CMP to collect consent.
