Borlabs Cookie Review: Test Results and Recommendations

One of the better-known consent tools for websites is Borlabs Cookie, built specifically for WordPress sites. This hands-on test reveals the strengths and weaknesses of Borlabs.

Introduction

A hands-on test is a simple and good way to judge whether a product is fit for purpose. That is why I picked two websites below and took a close look at their consent prompts, which were implemented with Borlabs Cookie. One of the two websites is looked after by a data protection officer I know. I happen to know, not least because I once gave a consultation for that officer's client, that the client, as the website operator, takes data protection very seriously.

You may think that two examples are perhaps not representative. If you want to see more real-world examples, you will find them in my large hands-on test of consent tools. Since I can name numerous further cases that show the same symptoms as the following websites and those from the hands-on test, I can safely say that the findings presented here are highly representative.

Real-world examples of Borlabs Cookie

Example from April 2025

By popular request, here is a current example. It is the first website I spontaneously searched for and found that uses the Borlabs plugin. Further examples could be found in any number.

It goes wrong right from the start (layer 1 of the consent prompt):

Once again, the mandatory notice about the option to withdraw consent (Art. 7(3) GDPR) is missing. Does Borlabs expect the website operator to know this? Or perhaps Borlabs does not know it itself? One can only guess, so let us get back to the examination.

Unfortunately, neither the website operator nor the provider of the "Cookie Box" seems to understand that this is not only about cookies. It is about a consent prompt. Tracking with events (without cookies) requires consent just like non-essential cookies do. This follows from the legal bases in Art. 6(1) GDPR. The product name "Borlabs Cookie" alone suggests that the focus is wrongly placed on cookies instead of on all processing that requires consent. Until the EU-US Data Privacy Framework took effect, for example, embedded Google Fonts required consent (or were at least highly questionable), because Google evaluates the telemetry data of website visitors for its own purposes. Since this EU-US data agreement is once again on shaky ground, one would wish to be better protected than by a "Cookie Box".

Further down in the "box" shown above, it says "Individual privacy settings". Why does it not consistently say "Individual cookie settings"? That would be just as wrong. After clicking it, this appears:

Again, only cookies are mentioned. Again, wrong.

If you click "Essential", surprisingly this appears:

So the name of the cookie is supposedly "Borlabs Cookie" or "Google Analytics". Everyone can see that this is wrong. Services are not mentioned anywhere. The purpose field does refer to them, but what is really meant are the cookies. The service itself is not explained here (a problem under Art. 12 GDPR, the transparent information of the data subject).

Google Analytics is supposedly "essential", then. Anyone who is reasonably sensible and knows a little about data protection will see this differently. Whether this misjudgment comes from the website operator or from Borlabs is unclear. In any case, the website visitor does not care why they are informed wrongly, in a misleading way or insufficiently.

Then the duration is not given per cookie but as a blanket value for all cookies. Unfortunately, that is not sufficient.

To cut it short, here are further problems with the consent prompt:

• Several cookies are attributed to Google Tag Manager that actually belong to Google Analytics.
• A Facebook service (probably the FB pixel) is not attributed any cookies at all, which is wrong. Instead, the service is simply labelled "Facebook". That is as sweeping as calling cars a "pile of matter".
• Outrageously, "Facebook" is given the purpose: "Used to unblock Facebook content." Data protection authorities consider such trivialization inadmissible because the user is deceived.

The user is the fool here. The second fool is the website operator, because they are the one responsible to the outside world. Apparently the Borlabs plugin does not really help to make one's own website GDPR-compliant. How else can these massive errors be explained? But probably Borlabs is just a supplier of a plugin and says: "Dear website operator: you have to do everything yourself. We only give you a popup and a way to manage consents. But please do not bother Borlabs with data protection questions, you have to handle those yourself."

Examples from further websites

As examples, I created screenshots of two websites, showing both the initial Borlabs prompt and the detail view. The detail view contains the information that is supposed to matter for consent.

Website 1

When visiting the first website, the following consent prompt appears.

After clicking Individual privacy settings, the following screen appears. For the screenshot, I expanded the External media section:

Defects that can be detected automatically

What do I mean by defects that can be detected automatically? I recently developed a tool that can analyze consent prompts automatically. Here is the criticism for website 1 as determined automatically by my tool.

Tools, cookies and files loaded without consent

My tool automatically detects the following unlawful loading processes, mind you despite Borlabs Cookie:

• Google reCAPTCHA
• Google Fonts

Using Google reCAPTCHA without consent violates Section 25 TDDDG (formerly TTDSG, and before that Art. 5(3) of the ePrivacy Directive in conjunction with Section 15(3) of the German Telemedia Act). If you want to know more, you can read it in my article on Google reCAPTCHA. Note: this is not my opinion, but verifiable and provable!

Loading external Google Fonts without consent makes no sense, but it is unlawful nonetheless. It clearly violates Art. 5 GDPR, which requires data minimization. In my article on Google Fonts, I prove that a legitimate interest for external Google Fonts is ruled out. Again, this is not my opinion but proof. The solution would be simple, yet for many agencies it apparently comes close to rocket science: include the fonts locally. Any halfway competent web agency can do that.

Files loaded without consent

My tool automatically detects that dozens of files are loaded from third-party servers without consent. Among others, files are loaded from the following domains:

• rocketcdn.me
• google.com

I do not examine either of them in detail here, but I assume that this is clearly unlawful: the Google domain is highly critical because of Google's corporate structure and its non-transparent data processing, and the rocketcdn.me domain is not named in the website's privacy policy and has a different owner than the website using it. I dispute that a data processing agreement exists for it.

Unclear or incomplete information

My tool automatically detects the following statements as incomprehensible or incomplete and therefore insufficient.

According to Art. 12 GDPR, information must be provided

The following statements do not meet this standard and can certainly be called unlawful in their entirety. The automatically identified objections are often accompanied by automatically generated questions:

• Service Borlabs Cookie: Unclear description of the cookie/service Borlabs Cookie: Saves the visitors preferences selected in the Cookie Box of Borlabs Cookie. What is meant by this? Is this the description of the service or of the cookie? Mind you, this is a German-language website. English explanations have no place there in the context of mandatory information.
• Service Borlabs Cookie: For the cookie borlabs-cookie, the mandatory information on its lifetime is not given in German. The statement reads: 1 Year
• Service Google Analytics: The provider is given as Google LLC. The full company name including country is missing! Please provide the missing information.
• Service Google Analytics: For the cookies _ga, _gat, _gid, the duration is given as 2 years as a collective statement. Is that correct as stated?
• Service Facebook: Unclear description of the cookie/service Facebook: Used to unblock Facebook content. What is meant by this? Is this the description of the service or of the cookie?
• Service Facebook: The provider is given as Facebook. The full company name including country is missing! Please provide the missing information.
• Service Google Maps: Unclear description of the cookie/service Google Maps: Used to unblock Google Maps content. What is meant by this? Is this the description of the service or of the cookie?
• Service Google Maps: The provider is given as Google. The full company name including country is missing! Please provide the missing information.
• Service Instagram: Unclear description of the cookie/service Instagram: Used to unblock Instagram content. What is meant by this? Is this the description of the service or of the cookie?
• Service Instagram: The provider is given as Facebook. The full company name including country is missing! Please provide the missing information.
• Service OpenStreetMap: Unclear description of the cookie/service OpenStreetMap: Used to unblock OpenStreetMap content. What is meant by this? Is this the description of the service or of the cookie?
• Service OpenStreetMap: The provider is given as OpenStreetMap Foundation. The full company name including country is missing! Please provide the missing information.
• Service OpenStreetMap: For the cookies _osm_location, _osm_session, _osm_totp_token, _osm_welcome, _pk_id., _pk_ref., _pk_ses., qos_token, the mandatory information on their lifetime is missing
• Service Twitter: Unclear description of the cookie/service Twitter: Used to unblock Twitter content. What is meant by this? Is this the description of the service or of the cookie?
• Service Twitter: The provider is given as Twitter. The full company name including country is missing! Please provide the missing information.
• Service Twitter: For the cookies __widgetsettings, local_storage_support_test, the duration is given as Unlimited as a collective statement. Is that correct as stated?
• Service Vimeo: Unclear description of the cookie/service Vimeo: Used to unblock Vimeo content. What is meant by this? Is this the description of the service or of the cookie?
• Service Vimeo: For the cookie vuid, the mandatory information on its lifetime is not given in German. The statement reads: 2 Years
• Service YouTube: Unclear description of the cookie/service YouTube: Used to unblock YouTube content. What is meant by this? Is this the description of the service or of the cookie?
• Service YouTube: The provider is given as YouTube. The full company name including country is missing! Please provide the missing information.
• For all services and cookies, a clear statement of purpose seems to be missing. What is the purpose of each service and of each cookie named?

I removed some further automatically detected points of criticism because they name the website operator.

As you can see, the list is very long. I invite you to the following thought experiment:

1. You are a website operator and use the cookie plugin from Borlabs for your website.
2. My tool runs over your website and spits out the above points of criticism as questions
3. You receive these questions and have to answer them
4. You are also asked why your website uses some tools in an unlawful way
5. You have four weeks to answer all the questions and put your website in order
6. After that, a complaint to a supervisory authority and possibly a private cease-and-desist letter against you are due

What do you do now? How do you rate the value of Borlabs for your website from now on?

Please read Article 7 GDPR. Under paragraph 2, on the conditions for consent, it says among other things:

As you can easily see for yourself, large parts of the consent prompt of website 1 are therefore invalid.

If you are still not convinced, look at the following further points of criticism, which my tool finds entirely on its own and which you, as the operator of a website that uses Borlabs, can have thrown at you:

Linked privacy policies written in English

My tool identified the following privacy policies, linked via Borlabs on website 1, as invalid because they are written in English and thus inaccessible to German readers:

• Service Google Maps: https://policies.google.com/privacy?hl=en&gl=en
• Service OpenStreetMap: https://wiki.osmfoundation.org/wiki/Privacy_Policy
• Service Vimeo: https://vimeo.com/privacy

Just click through the links and read for yourself. Vimeo even says so directly:

Additional defects found

My tool finds many problems automatically, but of course not all of them. My brief review of the website turned up the following further defects:

Accessibility of the privacy policy

The privacy policy only becomes accessible after the cookie popup has been clicked away. On a smartphone it looks like this:

As you can see, you see nothing, except the consent prompt. The privacy policy should absolutely be accessible without having to consent or decline. After all, strict standards apply to the accessibility of the privacy policy.

Missing notice on withdrawal of consent

Wherever consent is requested, the option to withdraw it must be pointed out. This is regulated bindingly and unambiguously in Article 7 GDPR. This notice is missing (see the 1st screenshot for website 1). The mention of the option to withdraw is therefore missing as well. The entire consent prompt could thus be called into question and possibly (that is for a court to decide, I look forward to the ruling) be regarded as completely invalid.

Website 2

Now to the second of many possible examples, which in my experience all show the same basic problems. On the second website the look is somewhat different from the first one. The consent prompt appears like this when the website is opened:

If you click Individual cookie settings, the following detail screen appears.

The screenshot shows the expanded External media category. Here you can already see numerous English texts. In addition, an attentive viewer can tell at a glance that the information content is extremely low and certainly not GDPR-compliant.

For the Marketing category, the following is displayed:

Defects that can be detected automatically

Unclear or incomplete information

My tool automatically detects the following statements as incomprehensible or incomplete and therefore insufficient. I am reproducing the output of my tool directly here, without changing a single character:

1. Service Borlabs Cookie: Unclear description of the cookie/service Borlabs Cookie: Speichert die Einstellungen der Besucher, die in der Cookie Box von Borlabs Cookie ausgewählt wurden. What is meant by this? Is this the description of the service or of the cookie?
2. Service Borlabs Cookie: The provider is given as Eigentümer dieser Website (owner of this website). Who is the owner of the website? That is not apparent from the consent prompt. Is "Website" the same as "Webseite"?
3. Service OpenStreetMap: Unclear description of the cookie/service OpenStreetMap: Wird verwendet, um OpenStreetMap-Inhalte zu entsperren. What is meant by this? Is this the description of the service or of the cookie?
4. Service OpenStreetMap: The provider is given as OpenStreetMap Foundation. The full company name including country is missing! Please provide the missing information.
5. Service OpenStreetMap: For the cookies _osm_location, _osm_session, _osm_totp_token, _osm_welcome, _pk_id., _pk_ref., _pk_ses., qos_token, the duration is given as 1-10 years as a collective statement. Is that correct as stated?
6. Service YouTube: Unclear description of the cookie/service YouTube: Wird verwendet, um YouTube-Inhalte zu entsperren. What is meant by this? Is this the description of the service or of the cookie?
7. Service YouTube: The provider is given as YouTube. The full company name including country is missing! Please provide the missing information.
8. For all services and cookies, a clear statement of purpose seems to be missing. What is the purpose of each service and of each cookie named?

It should be noted that the website uses only two services, namely OpenStreetMap and YouTube videos. Even so, my tool finds eight points of criticism purely automatically, for the explanations in the consent prompt alone.

Another automatically detected defect is a linked privacy policy written in English and therefore unavailable to German readers. It is the privacy policy of OpenStreetMap. My tool detects this automatically and formulates the following data subject request:

Additional defects found

For this second website I spare myself a detailed explanation and refer to my remarks on website 1 for details.

The defects that can be established directly are (this is certainly an incomplete list):

• The legally required notice on the option to withdraw consent is missing
• The privacy policy is not directly accessible because the cookie popup covers it

Conclusion on Borlabs Cookie

Originally, I also wanted to write something about the strengths of Borlabs Cookie. Because of the numerous defects and the provider's apparently limited data protection expertise, explained further below, I can and want to do so only briefly. The plugin is built exclusively for WordPress websites and can therefore intervene more specifically in technical conditions than a general-purpose plugin. I was told that the configuration options are diverse. That is all there is to say about the strengths, which, given the overall result, are of no relevance to me.

In my assessment, the provider of Borlabs Cookie is a passionate programmer who enjoys working with WordPress and gained programming experience building this consent management system. They then recognized a business idea, in my opinion, and created and marketed the Borlabs plugin. Nothing more, because:

Apparently the provider of Borlabs Cookie does not understand enough about data protection. This is shown on the one hand by the practical examples above and on the other by the further examples from my hands-on test. One could now object that, as delivered by default, Borlabs requires the website operator to fill the cookie popup and its descriptions with their own content.

In any case, the Borlabs website says in its FAQ:

Nowhere on the entire product page for the supposed GDPR solution Borlabs Cookie does it say that the explanations in the consent prompt absolutely must be adapted. Instead, it claims (in the context of Google Analytics, among others): "You just have to enter your tracking ID and Borlabs Cookie does the rest."

Even on the Borlabs website itself, the legally mandatory notice on withdrawal of consent is missing from the consent prompt. Here is the proof as a screenshot of the consent prompt on the website https://de.borlabs.io/borlabs-cookie/:

So I claim:

If you take data protection seriously, stay away from this consent tool!

If you would like to dive deeper into the topic of consent tools, I recommend the following reading:

• Checklist for legally compliant consent prompts, also as a PDF
• Hands-on test of OneTrust
• Cookiegeddon: The failure of the well-known consent tools
• Five reasons why cookie blockers fail
• The funniest cookie descriptions
• Consent requirements for selected tools

If you would rather do something sensible and stop using consent tools, I recommend instead:

• Alternatives to Google tools
• Use a privacy-friendly solution instead of Google Maps
• Use my free consent tool, which names the risks to you, raises your awareness of the core problem and does not pretend that you only have to embed a tool and your website is already GDPR-compliant
• Wait until my reCAPTCHA replacement is available
• Remove all tools from the website that you do not really (!) need

You will find further consent tools put to the test in the overview of cookies and consent.