What is a consent management platform (CMP)?

What a CMP does

A CMP sits between the visitor and every tag on the site, and has four jobs. It explains which cookies and trackers the site uses and why, takes the visitor’s choice purpose by purpose (refusing has to be as easy as accepting), keeps that choice as a consent record, and tells the rest of the site what was chosen, so analytics and advertising tags only run where consent allows.

The last job is the one that most often fails in practice. A banner that records “reject” while the tags fire anyway gives you a record that proves the breach. A CMP is only as good as its control over the tags behind it.

• Notice. Plain-language purposes, a list of the cookies and vendors behind each purpose, and a link to the full cookie policy.
• Choice. Accept, reject and per-purpose settings, with no purpose switched on before the visitor acts.
• Record. A timestamped entry for each decision, tied to the version of the notice the visitor saw.
• Enforcement. Scripts blocked or held until consent, and consent signals passed to tools that read them.

Why websites need one

Article 5(3) of the ePrivacy Directive requires consent before storing or reading information on a visitor’s device, unless it is strictly necessary for a service the visitor asked for. The GDPR sets what valid consent looks like: freely given, specific, informed and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give. In Planet49 (C-673/17, 2019) the Court of Justice confirmed that a pre-ticked box is not consent.

Regulators look at how the banner is designed as well as whether there is one. In 2022 France’s CNIL fined Google €150 million and Facebook €60 million because on their sites refusing cookies took more clicks than accepting them.

Advertising platforms add their own rules. Since 16 January 2024 Google has required publishers serving personalised ads to users in the EEA and the UK to use a Google-certified CMP integrated with the IAB Transparency and Consent Framework (TCF), and Switzerland was added in July 2024.

What to check when choosing a CMP

Start with what the regulator or auditor will ask to see: the consent record for a given visitor, the notice they were shown, and proof that tags did not run before consent. Then check the integrations your marketing stack depends on.

• Scans the site and keeps the cookie list current as tags change.
• Holds scripts back until consent is given, rather than only stopping them after a refusal.
• Keeps consent records you can export with the notice version attached.
• Supports the signals your tools read, such as Google Consent Mode, the IAB TCF and the Global Privacy Control.
• Handles the laws of the regions you serve, including opt-out models such as California’s.
• Sits next to your records of processing, so a cookie purpose and the processing it feeds are documented once.

Where it sits in a privacy programme

Cookie consent is one lawful basis for one kind of processing. The same programme also needs records of processing, answers to data subject requests, DPIAs for high-risk processing and contracts with processors. Auditors for ISO 27701, and customers sending privacy questionnaires, will ask how consent is collected and evidenced alongside the rest.

Cookie consent for your websites is part of Certifyi. It sits in the workspace that holds your privacy frameworks and privacy risks, so consent is handled inside the privacy programme rather than in a separate tool.

Related terms

Cookie consent

A visitor’s permission for a website to store or read cookies and similar trackers on their device. Required in the EU and the UK before any cookie that is not strictly necessary.

Google Consent Mode v2

The way a website tells Google’s tags what a visitor agreed to, through four signals set by the consent banner. Version 2 added the signals Google needs for advertising to users in the EEA.

Data subject access request (DSAR)

A person’s request for a copy of the personal data an organisation holds about them and how it is used. Under the GDPR it must be answered within one month, normally free of charge.

Data Protection Impact Assessment (DPIA)

A GDPR-required assessment of processing likely to result in a high risk to individuals, recording the risks and the measures that reduce them before the processing starts.