Cookiebot exposes two distinct consent models: its own native categories (necessary, preferences, statistics, marketing) and a Google Consent Mode v2 integration that maps those categories to Google's six signals. The mapping is mostly automatic but with three quirks worth knowing.

The Cookiebot native categories

The mapping to Consent Mode v2

When Cookiebot's Google Consent Mode v2 integration is enabled, the categories map as follows:

Quirk 1: marketing collapses three signals

Cookiebot's "marketing" maps to three Google signals at once. There is no way to grant ad_storage but deny ad_personalization through the Cookiebot UI. If you need that distinction, you have to override after Cookiebot writes the state.

Quirk 2: default state varies by region

Cookiebot detects the visitor's region via IP and applies different defaults: deny for EU/UK, granted for some non-EU regions. This is correct under most regulatory frameworks but can confuse teams who test from one location and see different behaviour from another.

Quirk 3: the update event timing

When the user accepts or denies via the Cookiebot banner, Cookiebot fires the CookiebotOnAccept or CookiebotOnDecline event. Subscribe to these to push the consent state into your data layer for downstream tags. Without this subscription, your tags fire before the consent state updates and behave wrong.

window.addEventListener('CookiebotOnAccept', function() {
  window.dataLayer.push({event: 'consent_updated'});
});

For reading the state server-side, the cookie parsing pattern is documented separately.