Borlabs vs Real Cookie Banner: Technical Comparison

In-depth Comparative Analysis

In the WordPress ecosystem, cookie consent management is a cornerstone of GDPR and ePrivacy compliance. Two plugins dominate the French and European markets due to their robustness and features: Borlabs Cookie and Real Cookie Banner. Our technical and legal analysis, conducted by the CookieDetox Investigation Unit, aims to dissect their architectures, blocking mechanisms, and suitability for the strict requirements of the CNIL.

Philosophy and Technical Architecture

Borlabs Cookie adopts a modular approach, relying on a system of cookie groups and services. Its technical core lies in a script blocking mechanism based on specific HTML attributes (data-borlabs-cookie-type, data-borlabs-cookie-group). When the page loads, Borlabs intercepts scripts and replaces them with placeholders or simply blocks them until consent is obtained. This method requires meticulous configuration for each third-party script but offers exceptional granular control. Integration with caching systems is generally robust, with specific purging mechanisms to ensure consent consistency.

Real Cookie Banner, on the other hand, stands out with a database of pre-configured services and providers, greatly facilitating the detection and classification of cookies. Its architecture relies on a site scanning system to identify services and an intuitive user interface to manage them. Script blocking operates via a combination of URL rewriting, attribute modification (type="text/plain", data-cookie-consent), and iframe management. Its strength lies in its ability to quickly adapt to changes in third-party services and offer consent models compliant with the latest directives, reducing the manual configuration burden for the administrator.

Consent Management and Script Blocking

Compliance is not limited to displaying a banner; it requires proactive and granular blocking of trackers before any consent. Both solutions excel in this area, but with technical nuances.

Borlabs Cookie uses regular expressions and HTML attributes to identify and block scripts. For a Google Analytics script, for example, integration would involve modifying the original <script> tag to:

<script type="text/plain" data-borlabs-cookie-type="script/javascript" data-borlabs-cookie-group="statistics">
  // Your Google Analytics code here
</script>

Real Cookie Banner offers a more automated approach thanks to its extensive service library. For a service like YouTube, it can automatically rewrite the iframe or embed script to block it by default. Its 'Content Blocker' system is particularly effective for embedded content. It often uses attributes like data-cookie-consent="youtube" or data-cookie-consent-src="..." to defer loading. Automatic script detection and configuration suggestions are major assets for complex sites.

Regulatory Framework and CNIL Case Law

GDPR and ePrivacy compliance is not static. The CNIL, as the French supervisory authority, regularly publishes guidelines and issues sanctions that redefine standards. Understanding these developments is crucial for any CMP implementation.

Fundamental Principles of GDPR and CNIL

Key CNIL requirements include:

• Free, Specific, Informed, and Unambiguous Consent: The user must be able to choose freely, understand what they are consenting to, and their action must be clear (no implicit scrolling).
• Proof of Consent: The data controller must be able to prove that valid consent has been obtained.
• Right to Withdraw Consent: As easy as giving it.
• Prior Blocking: No non-essential cookies should be placed before consent.
• Clear Information: The purposes of processing and the identity of the issuers must be clearly indicated.
• No 'Dark Patterns': Interfaces must not mislead the user or force them to consent.

Major Case Law and Their Implications

CNIL decisions have had a significant impact on CMP practices. Here are some emblematic examples:

Official sources: CNIL decisions · SAN-2023-009 (Criteo, €40M) · SAN-2022-027 (TikTok, €5M) · DPC (LinkedIn, €310M)

These cases demonstrate the imperative of impeccable technical compliance and absolute transparency. CMPs must not only block cookies but also record proof of consent and offer simple and accessible withdrawal mechanisms.

Advanced Technical Audit Methodology

A rigorous audit is essential to validate your CMP's compliance. Here, we detail the key steps to follow, using browser developer tools and Google Tag Manager.

Audit Via Developer Tools (DevTools)

DevTools (Chrome, Firefox, Edge) are your best allies for checking cookie and script behavior.

1. Clear Cache and Cookies: Before each test, ensure you start with a clean slate. In DevTools > Application > Storage > Clear site data.
2. Network Monitoring: Network tab. Reload the page. Filter by 'Doc' or 'XHR' to see initial requests. Verify the absence of requests to third-party domains (Google Analytics, Facebook, etc.) before interacting with the banner.
3. Cookie Analysis: Application tab > Cookies. Verify that no non-essential cookies are placed before consent. Only technical cookies (session, language, CMP) are allowed.
4. DOM Inspection: Elements tab. Look for third-party scripts. Verify that their type attributes are correctly modified (e.g., type="text/plain") or that they are encapsulated in CMP-specific blocking tags.
5. Consent Test: Accept all cookies. Reload the page. Verify that third-party scripts and cookies are now loaded.
6. Refusal Test: Refuse all cookies. Reload the page. Verify that third-party scripts and cookies remain blocked.
7. Withdrawal Test: Find the consent withdrawal button. Withdraw consent. Reload the page. Verify that cookies are deleted and scripts are blocked again.

Integration and Verification with Google Tag Manager (GTM)

GTM is a critical integration point. Incorrect configuration can bypass your CMP.

Principle: Use the dataLayer to transmit consent status to GTM and trigger tags conditionally.

Example of dataLayer pushed by the CMP (after consent):

window.dataLayer = window.dataLayer || [];
window.dataLayer.push({
  'event': 'consent_update',
  'consent_status': {
    'analytics': 'granted',
    'marketing': 'denied',
    'preferences': 'granted'
  }
});

GTM Verification:

1. GTM Preview Mode: Activate preview mode.
2. Consent Test: On your site, refuse then accept cookies. Observe the dataLayer in the DevTools console and in the GTM preview interface. Verify that the consent_update event is correctly pushed with the right statuses.
3. Conditional Triggers: Ensure that your tags (e.g., Google Analytics, Facebook Pixel) have triggers based on these consent_update events and corresponding consent_status variables. For example, a GA tag should only fire if consent_status.analytics is 'granted'.
4. Consent Mode (Google): If you are using Google's Consent Mode, verify that the gtag('consent', 'update', {...}) commands are correctly executed by your CMP or via GTM, depending on the consent status.

Compliance Optimization and Implementation Strategies

Beyond auditing, a proactive strategy is necessary to maintain a high level of compliance and anticipate regulatory changes.

Management of Consent Proofs (Consent Receipt)

The CNIL requires the ability to prove consent. Modern CMPs generate 'Consent Receipts,' which are timestamped records of user consent.

Example JSON structure for a Consent Receipt:

{
  "consent_id": "uuid-v4-generated-id",
  "timestamp": "2026-08-09T14:30:00Z",
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
  "ip_address_hashed": "sha256-hashed-ip-address",
  "consents": {
    "statistics": "granted",
    "marketing": "denied",
    "preferences": "granted",
    "essential": "granted"
  },
  "cmp_version": "Borlabs Cookie 2.2.3",
  "consent_dialog_version": "1.0",
  "page_url": "https://www.cookiedetox.fr/article-audit-cmp"
}

This data must be stored securely and be accessible in case of a request from the CNIL or a user exercising their right of access. Both CMPs offer mechanisms to store this proof, either in a database or via third-party integrations.

Preventive Blocking of Third-Party Scripts (JavaScript DOM Blocking)

For complex cases where a script is not directly managed by the CMP, a JavaScript DOM blocking approach can be considered, although this should be a last resort solution and not an alternative to proper CMP configuration.

Example of JS blocking before DOM loading:

(function() {
  // List of domains or script IDs to block by default
  const blockedKeywords = ['googletagmanager.com/gtm.js', 'facebook.com/tr'];

  // Function to check if consent is given (simplified)
  function hasConsentFor(category) {
    // Implement CMP consent verification logic
    // Ex: return window.BorlabsCookie.getConsentStatus('marketing');
    // Or: return window.RealCookieBanner.getConsentStatus('marketing');
    return false; // By default, block
  }

  // Intercept script loading attempts
  const originalCreateElement = document.createElement;
  document.createElement = function(tagName) {
    if (tagName.toLowerCase() === 'script') {
      const script = originalCreateElement.apply(this, arguments);
      Object.defineProperty(script, 'src', {
        get: function() { return this._src; },
        set: function(value) {
          this._src = value;
          if (blockedKeywords.some(keyword => value.includes(keyword)) && !hasConsentFor('marketing')) {
            console.warn('Script blocked by default:', value);
            // Prevent execution by modifying the type or emptying it
            this.type = 'text/plain';
            this.setAttribute('data-blocked-by-cookiedetox', 'true');
            this.removeAttribute('src'); // Prevents loading
          }
        }
      });
      return script;
    }
    return originalCreateElement.apply(this, arguments);
  };
})();

This snippet, to be placed at the top of the <head>, intercepts the creation of <script> tags and can modify their behavior. This is an emergency or supplementary measure for particularly stubborn scripts, but the native configuration of Borlabs or Real Cookie Banner is always preferable.

In conclusion, the choice between Borlabs Cookie and Real Cookie Banner will depend on the complexity of your site, your preference for manual configuration, and the frequency of your audits. Both solutions are technically capable of achieving a high level of compliance, provided they are configured and maintained with the rigor that the CNIL demands. CookieDetox's expertise supports you in this critical process.