Cookiebot banners need a domain group ID

Cookiebot documents uc.js?cbid= as one install. The other install puts the UUID in data-cbid, not the query. The Cookie Declaration on /{cbid}/cd.js is vendor/cookiebot-declaration.

cbid is a UUID

Cookiebot documents the domain group ID as a UUID. A query install with a non-UUID cbid is not a banner.

Rule: vendor.cookiebot.param.cbid.invalid

What this pack matches

Hosts: consent.cookiebot.com
Paths: /uc.js
Vendor docs: www.cookiebot.com/en/developer/

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`cbid`	recommended	It is the Cookiebot domain group ID. Cookiebot documents uc.js?cbid= as one install. The other install puts the same UUID in data-cbid, not the query. Fix: For a query install, put the domain group ID on the URL as cbid=. For a tag-attribute install, data-cbid carries it instead.	`vendor.cookiebot.param.cbid.missing` `vendor.cookiebot.param.cbid.empty` `vendor.cookiebot.param.cbid.invalid`	docs
`type`	optional	Documented dialog-type override. The loader passes nonempty query values to the banner without changing case. Presence diagnostic severity: warning. Fix: Use a documented dialog type, or omit the override to use the account or HTML configuration.	`vendor.cookiebot.param.type.empty` `vendor.cookiebot.param.type.invalid`	docs
`level`	optional	Documented consent-level override. The loader passes nonempty query values to the banner without changing case. Presence diagnostic severity: warning. Fix: Use implied or strict, or omit the override to use the account or HTML configuration.	`vendor.cookiebot.param.level.empty` `vendor.cookiebot.param.level.invalid`	docs
`framework`	optional	The pinned 2.140.0 loader accepts these case-insensitive framework aliases and normalizes them to its current TCF implementation. The current support guide recommends TCF; the older developer table names IAB. Presence diagnostic severity: warning. Evidence: vendor template. Fix: Use framework=TCF for the current documented integration, or a supported legacy alias. HTML data-framework remains a separate carrier.	`vendor.cookiebot.param.framework.empty` `vendor.cookiebot.param.framework.invalid`	docs
`blockingmode`	optional	Documented automatic or manual cookie blocking. The loader compares auto without case sensitivity. A none query value does not undo automatic blocking already enabled by the HTML data-blockingmode attribute. Presence diagnostic severity: warning. Fix: Use auto for automatic blocking or none for manual markup, or carry the setting in data-blockingmode.	`vendor.cookiebot.param.blockingmode.empty` `vendor.cookiebot.param.blockingmode.invalid`	docs
`consentmode`	optional	Documented Google Consent Mode disable override. The loader accepts disabled without case sensitivity. Omission preserves the configured default. Presence diagnostic severity: warning. Fix: Use disabled to disable Google Consent Mode, or omit this override.	`vendor.cookiebot.param.consentmode.empty` `vendor.cookiebot.param.consentmode.invalid`	docs
`consentmode-dataredaction`	optional	The pinned 2.140.0 loader reads this exact query key or the data-consentmode-dataredaction attribute and explicitly warns for other populated values. The accepted strings are case-sensitive. Presence diagnostic severity: warning. Evidence: vendor template. Fix: Use true, false or dynamic, or omit the override to retain the configured value.	`vendor.cookiebot.param.consentmode-dataredaction.empty` `vendor.cookiebot.param.consentmode-dataredaction.invalid`	docs

Validate a payload

pixellint validate url "$ARTIFACT" --rulepack vendor/cookiebot

Try this failing payload in the playground. An example with a validation finding.

https://consent.cookiebot.com/uc.js

cargo install pixellint · npm install pixellint