Glossary Term

Consent Management Platform

glossary consent management platform featured

A consent management platform (CMP) is software that collects a user’s choices about tracking, stores them as an auditable record, and signals those choices to every tag and vendor on the site. CMP stands for consent management platform. The banner is only the visible part. The enforcement and signaling behind it are what the software actually does.

What a CMP Does

A CMP handles five jobs that a hand-built banner usually does not.

  • Scans and categorizes trackers. It crawls the site, finds every cookie and script, and sorts them into categories such as necessary, analytics, and marketing.
  • Captures the choice. It renders the notice, records what the user selected, and re-prompts when the vendor list or purposes change.
  • Blocks scripts until consent. This is the enforcement layer. Tags stay inert until a choice exists, which is the part most homemade banners skip.
  • Stores proof. Each decision is logged with a timestamp, the banner version shown, and the consent string produced. Regulators ask for this record, not for a screenshot of the banner.
  • Signals downstream. It passes the result to ad vendors, tag managers, and analytics tools in a format they already understand.

Because a CMP holds page tags until a choice is made, measurement that happens before the page loads is unaffected by it. A click recorded at the redirect, as in link analytics, is captured before the destination page or its banner ever executes.

How Consent Signals Reach Vendors

Vendors read consent through a standard API rather than the banner’s own code. Under the IAB Transparency and Consent Framework (TCF), the CMP encodes every purpose and vendor permission into a single TC string, then exposes it through __tcfapi:

__tcfapi('getTCData', 2, function (tcData, success) {
  console.log(tcData.tcString);            // encoded consent passed to vendors
  console.log(tcData.purpose.consent[1]);  // true if purpose 1 was accepted
});

TCF v2.2 became mandatory for participants on 20 November 2023. It removed legitimate interest as a basis for advertising and content personalization, so vendors now need actual consent for purposes 3 through 6. Google tags read consent separately through Consent Mode, which most certified CMPs set automatically.

Types of Consent Management Platforms

  • Enterprise privacy suites. OneTrust, TrustArc, and Didomi. These extend past the banner into data mapping, vendor risk, and subject access requests. Priced for organizations with a privacy team.
  • Website-focused CMPs. Cookiebot, CookieYes, iubenda, Termly, Cookie Script, and Complianz. These cover scanning, the banner, blocking, and consent records for a single site or a small portfolio. Most have free tiers with page or session limits.
  • Publisher and ad-tech CMPs. Sourcepoint, Consentmanager, and Quantcast-style tools built for TCF-heavy programmatic setups, where vendor lists run to hundreds of entries.
  • Google’s Privacy & messaging tool. Built into AdSense, Ad Manager, and AdMob, free, and certified. It covers Google’s own requirement but manages consent only for those products.

Google Certified CMP List

Google requires a certified CMP integrated with the TCF for publishers serving ads through AdSense, Ad Manager, or AdMob. The requirement took effect on 16 January 2024 for the EEA and UK, and on 31 July 2024 for Switzerland.

The consequence of ignoring it is narrower than most summaries claim. Traffic from a non-certified CMP is not blocked outright. It becomes eligible only for non-personalized or limited ads, which usually means lower revenue rather than none.

Google publishes the certified list on its CMP Partner Program site, currently just over 50 partners sorted into Gold, Silver, and Bronze tiers. Google states the tiers reflect objective criteria including customer support and ease of technical integration, not privacy quality, so a Bronze CMP is no less compliant than a Gold one. Gold partners include Cookiebot, CookieYes, Didomi, iubenda, OneTrust, Termly, TrustArc, and Usercentrics.

CMP vs Consent Mode

They are not alternatives, and a site running Google Ads in the EEA generally needs both. The CMP asks the question. Consent Mode is how Google’s tags behave once the answer exists.

Attribute CMP Consent Mode
Role Collects and stores the choice Reacts to the choice
Scope Every tag and vendor on the site Google tags only
Output TC string, consent record Adjusted tag behavior, modeled conversions
Works alone Yes, without Google products No, it needs a consent source

Consent Mode has no interface and cannot collect anything. Without a CMP or banner feeding it, the signals never change from their default state.

Do You Need a Consent Management Platform?

A CMP is mandatory in two situations. First, serving ads to EEA, UK, or Swiss users through AdSense, Ad Manager, or AdMob, where Google requires a certified one. Second, setting non-essential cookies for users covered by GDPR and the ePrivacy Directive, which require prior consent that you can prove.

Below those thresholds the answer is less absolute:

  • US-only traffic. State laws such as CCPA use an opt-out model, so a full consent banner may not be required. A “Do Not Sell or Share” mechanism usually is.
  • Analytics only, no ad tech. Obligations still exist under GDPR, but a lightweight tool or a free tier normally covers them.
  • No cookies beyond the essential. No consent is needed for strictly necessary cookies. Most sites overestimate how many of theirs qualify.

The practical test is whether you could produce, on request, a record showing what a specific visitor agreed to on a specific date. Hand-built banners rarely can.

Frequently Asked Questions

What does CMP stand for?

CMP stands for consent management platform. It refers to the software that collects consent, enforces it by blocking scripts, and transmits the result to vendors. The term is used interchangeably with “consent management provider” in IAB documentation, which lists registered CMPs by ID number.

Is a CMP the same as a cookie banner?

No. The banner is the interface a CMP displays. A cookie consent banner on its own is just markup, and a banner that appears while tags fire anyway provides no compliance value. The CMP is the layer underneath that blocks scripts, stores the record, and signals vendors.

Are consent management platforms free?

Several are. Google’s Privacy & messaging tool is free for its own publisher products, and CookieYes, Cookiebot, and Complianz all run free tiers capped by pages, sessions, or domains. Paid plans typically start around 10 to 50 euros per month per domain, and enterprise suites move into five figures annually.

Does a CMP cover CCPA as well as GDPR?

Most do, but the mechanism differs. CCPA works on opt-out rather than prior consent, and it requires honoring the Global Privacy Control browser signal. California’s first CCPA enforcement action, a $1.2 million settlement with Sephora announced on 24 August 2022, cited failure to treat GPC signals as valid opt-out requests. Confirm that any CMP detects GPC automatically.

To keep campaign tagging consistent across regions that apply different consent rules, build your links with the free UTM builder at linkutm.

Back to Glossary