Consent management platforms (CMP)

Borlabs Cookie

WordPress consent plugin from a German software supplier

GermanyEU♻ Ownership reviewed, controller unresolved

Scope verdict

Ownership reviewed, controller unresolved

Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg, is registered at Amtsgericht Hamburg under HRB 171030, VAT DE 347062761. Benjamin A. Bornschein is the named managing director. Current shareholder percentages and voting control were not established. Management, German incorporation and a reported related holding company do not establish European ultimate control. The supplier terms select German law and Hamburg jurisdiction, subject to mandatory consumer protections.

How we classify services

Borlabs Cookie runs in WordPress and blocks configured scripts and embedded content until consent. Visitor consent data stays on the customer's server according to the company, while the Scanner and Library use Borlabs Service.

Borlabs GmbH supplies the plugin, with Paddle acting as Merchant of Record. Mandatory telemetry includes installation URLs, software versions and settings. Local consent storage does not make the entire product and purchase process free of external services.

Pricing

Personal starts at €49 per year for one website, excluding VAT. Larger site-count licences include the same features. Contracts renew for 12 months unless cancelled before expiry; there is no trial and a 30-day first-purchase refund is advertised. The pricing FAQ says local features continue after expiry, but the terms require plugin deletion on termination. Continued-use rights need clarification.

Data and operations

Infrastructure and email path

Verified operational dependencies, shown separately from ownership and from the service's core data hosting.

Core service hosting

Customer's WordPress host

Provider control not verified
Observed
The company says the consent interface and visitor consent data are stored on the customer's server. Location and hosting provider depend on that customer's deployment.

Supporting services

Borlabs Service

Provider control not verified
Observed
Scanner and Library require the hosted service. Telemetry is mandatory and includes installation URLs, software versions and settings; the company says it deletes telemetry when the site is removed from its licence. Exact endpoints, full subprocessor schedule and backup regions remain unverified.

Public website

Hetzner Online GmbH

European provider
Observed
Google Public DNS on 16 September 2026: borlabs.io A 178.63.134.49. RIPEstat identifies AS24940 Hetzner. This is the vendor website, not proof of every service or customer's hosting region.

Authorised outbound email

Amazon Simple Email Service

US-controlled cloud
Observed
SPF includes amazonses.com. The vendor's privacy policy separately names Amazon SES with United States processing. This does not establish every actual mail route.

Why this matters

This domain authorises Amazon Simple Email Service, infrastructure under US ultimate ownership, to send email. If active, recipient details and message content can be processed there. SPF does not prove active use, the selected AWS region, or use of the separately operated AWS European Sovereign Cloud.

Public DNS records identify visible providers and routes, not every backend location or private data-region setting.

Infrastructure checked:

More from Germany