Consent Management for a Japan-Facing Website: Compare the Operating Fit Before Buying a Banner

A consent banner is not a compliance verdict. Cookiebot, CookieYes, and iubenda each document a consent management platform with different operating shapes: inventory scanning, regulation modes, Google Consent Mode support, geotargeting and language controls, consent records, and ongoing maintenance. A Japan-facing site should choose the platform whose operating fit matches how it will keep the inventory true, the records usable, and the banner correct over time. The CMP does not itself establish APPI or GDPR compliance, and it is not legal advice.

Independent guide. This assessment is based on current product documentation, not a hands-on test. Japan Legible has no commercial relationship with Cookiebot, CookieYes, or iubenda. All product links are direct, non-affiliate links. Pricing and features were checked on August 11, 2026. Evidence level C: research-based from published sources.

CookieYes-specific notice. This content is for informational and educational purposes only and is not legal advice. CookieYes is a technology platform that can assist with privacy-compliance operations; each user remains solely responsible for complying with applicable laws and regulations. Consult a qualified legal professional for advice specific to your situation.

Short answer

All three vendors document a workable consent surface: a banner, a consent record, and a scanner that looks for cookies and trackers. The decision is which operating model the team can sustain.

Cookiebot documents per-domain pricing driven by subpage count with no traffic pricing, EU and US regulation modes, Google Consent Mode integration, 47-plus languages, and regional banner distribution. CookieYes documents per-domain pricing driven by pageviews, with geo-targeting and scheduled scanning on higher tiers and explicit overage costs. iubenda documents per-site pricing driven by pageviews, monthly or hourly scanning, geo-targeting, consent records, and a cookie solution that markets prior blocking and consent logs.

Those facts describe product architecture. They do not tell the team which rules apply to its Japan traffic, what disclosures and purposes are correct, which data transfers need review, or which categories and storage periods are defensible.

The question behind the tool

The reader's question is practical: which consent management platform fits a website that serves Japanese visitors alongside other markets?

The useful answer has seven dimensions:

1. how consent inventory and setup work;
2. which regulation modes the platform documents;
3. how Google Consent Mode is supported;
4. how geotargeting and language controls work;
5. what consent records are kept and who can use them;
6. how scanning and maintenance run over time;
7. how pricing changes as the site grows.

A platform that scores well on a demo can still fail operationally if no one reviews the inventory each month, if the Japanese-language banner is never checked, or if pageview pricing produces a surprise invoice during a traffic spike.

Shared ground: consent is an operating record

Every consent workflow depends on the same chain: detect what the site loads, describe it to the visitor, capture a choice, block or allow accordingly, and keep a record. The chain is only as good as its weakest link.

If the inventory misses a tag, the banner can be correct and the site still wrong. If the record is stored but never retrievable, it is not useful evidence. If no one owns the review, the scanner's output becomes an unread queue. Those are operating facts, not legal conclusions.

What the vendors document

Cookiebot

Cookiebot's pricing page presents a free plan and paid tiers. The free plan is documented for up to 50 subpages and one domain, with no credit card required, unlimited users, and no traffic limits. Premium tiers are priced per domain by subpage count, from Premium Lite at EUR 7 per month through tiers up to more than 7,000 subpages. Plans automatically upgrade by subpage count, prices exclude VAT where applicable, and a 14-day trial covers premium features.

The same page documents an initial scan, automated configuration, GDPR and ePrivacy support, US state regulation support, Google Consent Mode integration, 47-plus languages, regional banner distribution, and consent and compliance reports. It uses "supports compliance" language, not a legal promise.

Cookiebot's official public page on Consent Mode V2 documents the mechanism: Consent Mode tailors Google services to consent choices, and V2 adds the ad_user_data and ad_personalization settings with granted or denied states. Cookiebot states that its CMP supports V2 signaling through Google Tag Manager templates, direct code, or TCF implementation. The specific support article URL from the brief was inaccessible on the check date (HTTP 403), so the verified official page is cited here and that gap is recorded as unknown.

CookieYes

CookieYes's pricing page documents Free at USD 0 per domain with 100 pages per scan and 5,000 pageviews per month, Basic at USD 10 per domain, Pro at USD 25, and Ultimate at USD 55, with overage at USD 0.30 per 1,000 extra pageviews from Basic. Geo-targeting and monthly scheduled scanning appear on Pro, weekly scanning and branding removal on Ultimate. The page documents a 14-day free trial, annual plans with two months free, and local taxes added.

CookieYes's documentation hub covers setup, customization, feature documentation, legal requirement guidance, and partner programs. Its documentation site explicitly states that its information is not legal or regulatory advice and recommends consulting a lawyer or law firm. The vendor provides features, not a verdict.

iubenda

iubenda's live pricing page documents per-site plans with pageview limits: Essentials at EUR 4.99 or USD 5.99 monthly when billed yearly with up to 25,000 pageviews, one language, and monthly scans; Advanced at EUR 19.99 or USD 24.99 with 50,000 pageviews, all available languages, monthly scans, and geo-targeting; Ultimate at EUR 79.99 or USD 99.99 with 150,000 pageviews, hourly scans, full branding, a mobile SDK, analytics, and consent recovery. Overage is EUR 0.05 per 1,000 pageviews, and prices exclude VAT.

Its cookie solution page documents scanning for cookies, pixels, and trackers, prior blocking, region-specific settings, consent logs, automated legal updates, Google Consent Mode V2 support, and IAB TCF integration. This guide does not repeat vendor language such as "audit-proof" as a guarantee.

The two iubenda help URLs from the brief returned page-not-found on the check date, so the live official pricing and cookie-solution pages are cited instead. That is recorded as a source gap.

Japan's legal ground

The Personal Information Protection Commission's official Laws and Policies page publishes the Act on the Protection of Personal Information, with a consolidated text as of April 1, 2023, and notes that only the original Japanese text has legal effect. It also links supplementary rules for personal data transferred from the EU and UK under adequacy decisions.

Those materials show the operator's responsibility. A CMP does not decide which Japanese law applies to a tag, whether a purpose is disclosed correctly, whether a data transfer is lawful, or which category a tracking event belongs to. The operator must determine the rules, purposes, disclosures, transfers, and categories, with qualified advice where needed. This guide is not legal advice.

Comparison table

| Dimension | Cookiebot (documented) | CookieYes (documented) | iubenda (documented) | | --- | --- | --- | --- | | Inventory and setup | Initial scan, automated configuration, dashboard | Documentation hub, implementation guides | Scanner for cookies, pixels, trackers; one-click setup | | Regulation modes | GDPR/ePrivacy, US state laws, TCF, Consent Mode and more | GDPR UK/EU, CCPA/CPRA, IAB TCF v2.3, Consent Mode and more | GDPR/ePrivacy, US state laws, LGPD, nFADP, TCF, Consent Mode V2 | | Google Consent Mode | Documented V2 support via GTM, code, or TCF | Listed in regulation solutions; detail unverified on check date | Documented as built in with no extra setup | | Geotargeting and language | Regional banner distribution; 47-plus languages | Geo-targeting from Pro; language detail unverified on check date | Geo-targeting from Advanced; all available languages from Advanced | | Consent records | Consent and compliance reports documented | Record keeping documented in feature materials | Consent logs and records marketed as core | | Scanner and maintenance | Initial scan; reporting; scanning cadence detail not fully verified | Monthly scanning from Pro, weekly from Ultimate | Monthly scans on Essentials/Advanced, hourly on Ultimate | | Pricing architecture | Per domain, driven by subpage count; no traffic pricing | Per domain, driven by pageviews and pages per scan | Per site, driven by pageviews with overage fees |

The table is a planning map, not a scorecard. Verify each cell for the team's actual setup because some detail cells are unverified on the check date.

What a CMP does not solve

A CMP can inventory what it finds, but an incomplete or stale inventory is the operator's risk. It can store consent records, but record retention and evidence weight depend on the operator's rules and the regulator's expectations. It can show banners in multiple languages, but the Japanese copy still needs native review. It can signal consent states to Google, but the site's Google configuration must be correct and tested.

The explicit boundary: a CMP does not itself establish APPI or GDPR compliance. It is not legal advice. The operator must determine the rules, purposes, disclosures, transfers, and categories that apply to the site and its data flows.

Build the upstream system map before choosing the banner: the translated-privacy-policy analysis explains why a CMP records decisions but does not replace a data-transfer plan.

Counterargument

The strongest objection is that a CMP is "just a banner," so the cheapest option is enough and legal discussion is overkill. That conflates the banner with the operating record. A banner that lets tags fire early, stores no retrievable record, or cannot be maintained after a tag update is not a consent system; it creates an appearance of control without the evidence behind it.

The reverse objection is that the largest feature list is automatically safer. The official pages do not support that. Features are documented capabilities; whether they make the site compliant depends on the operator's rules, disclosures, and ongoing review.

Who should not choose one

A CMP is a weaker fit when:

• the site loads few or no third-party cookies and trackers, making inventory and blocking work mostly overhead;
• the team cannot assign someone to review scans, maintain disclosures, and test the banner;
• the pricing model conflicts with the site's traffic shape;
• the team expects the platform to replace legal analysis;
• the site needs rules that the platform's documented regulation modes do not address.

Those conditions do not condemn the vendors. They mean the bottleneck is not the banner.

Unknowns and verification checklist

Before purchase, verify what the official pages could not:

1. how each platform's scanner handles the site's actual tags, embeds, and first-party storage;
2. which Japanese-language banner strings and legal texts are provided and reviewed;
3. how geotargeting behaves for Japan traffic and for visitors from other regions;
4. how Consent Mode signals are tested in the site's actual Google setup;
5. what consent record fields are stored, for how long, and how they can be exported;
6. what happens at pageview or subpage limits and overage rates;
7. which regulation modes actually map to the team's Japan and non-Japan traffic;
8. what the operator's own rules require for purposes, disclosures, transfers, and categories.

Run a pilot with the real site: install the script, scan, review the inventory, test the Japanese banner, make and revoke a choice, export a record, and re-scan after a tag change. That pilot is the evidence the decision can support.

Final recommendation

Choose the platform whose operating shape matches the site: Cookiebot when subpage-based pricing and regional banner controls fit; CookieYes when pageview-based pricing and scheduled scanning fit expected traffic; iubenda when per-site pageview limits, hourly scanning, and language and geotargeting breadth matter. Verify the current pages, assign an owner to inventory and records, and keep legal analysis outside the tool. The banner is the start of the work, not the end.

For the browser-and-network verification after a visitor rejects, use the rejection audit field guide.

Review Cookiebot's current plans on the official site. Review CookieYes's current plans on the official site. Review iubenda's current plans on the official site.