A consent management platform (CMP) is software that captures, stores, and signals user consent for cookies, tracking pixels, and personal-data processing. CMPs enforce GDPR, CCPA, LGPD, and Google Consent Mode v2 by showing a consent banner, recording user choices, and passing those signals into your tag manager, ad platforms, and analytics stack.
Privacy is not optional infrastructure any more. Since Google Consent Mode v2 shipped in March 2024, sites without a compliant CMP see Google Ads audiences empty out and conversion modelling drop. It went from a compliance checkbox to a measurement problem overnight.
What is a consent management platform?
A consent management platform is software that sits between your visitors and your tracking stack. When a user lands on your site, the CMP displays a consent banner asking permission for specific categories — strictly necessary, analytics, marketing, and personalisation. Their choice is recorded, timestamped, stored, and then broadcast to every downstream tag as a consent signal.
Modern CMPs do four things: collect consent (banner + preferences UI), store proof (audit log of who consented to what and when), signal downstream (Google Consent Mode, IAB TCF strings, tag firing rules), and refresh periodically (re-prompting after 6-12 months as required by regulators).
Since March 2024, Google requires sites serving EEA/UK traffic to pass four consent signals: ad_storage, analytics_storage, ad_user_data, and ad_personalization. Without them, Google Ads remarketing audiences empty out and conversion tracking degrades within weeks.
Why a CMP matters for marketers
Five reasons privacy compliance has become a marketer's problem, not just legal's:
- Fines are real. GDPR penalties can reach €20 million or 4% of global annual revenue. Meta, TikTok, and Google have each paid nine-figure fines for consent failures.
- Google Consent Mode v2 is now mandatory. Without proper signals, Google Ads audience sizes and conversion modelling collapse for EEA/UK traffic.
- Consent-mode conversion recovery. Sites with correctly configured Consent Mode v2 see 10-30% more conversions modelled versus sites without it, because Google fills the gap with observed patterns from consenting users.
- Trust equity. A clear, honest consent banner improves the accept rate compared to dark-pattern designs and builds long-term trust.
- Multi-jurisdiction complexity. GDPR, CCPA, LGPD, PIPEDA, Australia's Privacy Act — a CMP centralises rule enforcement so you configure once, comply everywhere.
How a CMP actually works
Every CMP runs the same four-step loop.
Page load → CMP script loads first
# Step 2 — Geo detection triggers appropriate rules
IP geo → "EU visitor" → Show opt-in banner
IP geo → "US visitor" → Show opt-out link
# Step 3 — User makes choice, CMP records it
User clicks "Accept" → Consent stored
# Step 4 — CMP signals downstream tags
gtag('consent', 'update', { ad_storage: 'granted' })
IAB TCF string → Ad exchanges
Tag Manager → Fires allowed tags only
Downstream integration
The CMP typically injects a global window.dataLayer event or updates gtag() consent state. Google Tag Manager, Adobe Launch, or Tealium listens for the event and fires or blocks tags accordingly. Ad exchanges read the IAB TCF v2.2 consent string directly from the auction request.
Types of CMPs and their fit
| Category | Examples | Best for | Price range |
|---|---|---|---|
| Enterprise CMPs | OneTrust, Didomi, Sourcepoint | Multi-domain, multi-jurisdiction sites | $500-$5,000+/mo |
| Mid-market CMPs | Cookiebot, Usercentrics, TrustArc | Growth-stage brands, agencies | $10-$500/mo |
| Open-source CMPs | Klaro, Orestbida CookieConsent | Devs who want full control | Free |
| Free-tier CMPs | Cookiebot Free, Iubenda Free | Sub-100k monthly visitors | $0 |
| Ecosystem CMPs | Shopify, WordPress consent plugins | CMS-native small sites | Included/cheap |
Real CMP implementation examples
1. EU-focused SaaS company
A B2B SaaS company with 70% EU traffic deployed Didomi with IAB TCF v2.2, Google Consent Mode v2, and geo-based rules. Their Google Ads modelled conversions recovered by 24% within six weeks, and their DPA passed a spot audit without findings.
2. Ecommerce brand across EU + US + Brazil
A Shopify brand rolled out Cookiebot with three separate rulesets: opt-in for EU (GDPR), opt-out for California (CCPA), and opt-in for Brazil (LGPD). Ad platforms received region-specific signals, and cookie declaration pages auto-updated as new tags were added.
3. Small marketing agency site
A five-person agency deployed the free tier of Cookiebot with a minimal banner, four consent categories, and Consent Mode v2 wired through GTM. Total setup: 90 minutes. Compliance risk: nearly eliminated for the fraction of traffic that was EU.
CMP vs cookie banner — what's the difference?
Every CMP shows a cookie banner. Not every cookie banner is a CMP.
A full CMP
- Stores audit-ready consent proof
- Signals Google Consent Mode v2
- Broadcasts IAB TCF strings to ad exchanges
- Enforces geo-specific rulesets
- Refreshes consent every 6-12 months
- Blocks tags until consent, via tag manager
A basic cookie banner
- Displays a notice, nothing else
- No downstream signalling
- No audit log of who consented
- Same banner for every jurisdiction
- Never re-prompts users
- Tags fire regardless of choice
7 CMP best practices
- Turn on Google Consent Mode v2 first. Nothing else recovers modelled conversions like this. Ship it before optimising banner design.
- Use geo-based rulesets. Opt-in for GDPR/LGPD regions, opt-out for CCPA regions, no banner elsewhere. Reduces friction and lifts consent rates.
- Avoid dark patterns. Regulators fine sites that use pre-checked boxes, hidden reject buttons, or forced consent. Symmetric Accept/Reject buttons perform better legally and ethically.
- Audit tags before launch. Every tag firing without consent is a violation. Use tag manager's consent gating.
- Show a clear preferences page. Users should be able to change their mind. A permanent footer link to "Cookie preferences" is standard.
- Re-prompt every 12 months. Consent freshness matters legally. Configure your CMP to expire consent yearly.
- Load the CMP script asynchronously. A synchronous CMP tag blocks page render and hurts Core Web Vitals. Async + defer keeps CLS and LCP intact.
The most common CMP failure is loading Google Analytics or Meta Pixel tags before consent is captured. Regulators treat this as a full violation regardless of what happens next. Always gate tag firing on consent state through your tag manager.
Common CMP mistakes to avoid
- Pre-ticked consent boxes. The Planet49 CJEU ruling declared this invalid across the EU.
- Reject buttons hidden or harder to click. France's CNIL has issued €90M+ in fines for this dark pattern.
- Missing Google Consent Mode v2 signals. Google Ads modelling degrades within weeks.
- Same banner for every geography. Wastes conversion opportunity in low-risk regions.
- No audit log. When regulators ask "prove this user consented", you need timestamps + IPs + banner version.
- Ignoring mobile app SDKs. If you have a mobile app, mobile SDK consent is a separate configuration.
Frequently asked questions
If your site uses cookies or tracking for users in the EU/UK (GDPR), California (CCPA/CPRA), Brazil (LGPD), or 15+ other jurisdictions with active privacy laws, you need a compliant consent mechanism. A CMP is the standard way to implement it.
Since March 2024, Google requires sites serving EEA/UK traffic to pass four consent signals: ad_storage, analytics_storage, ad_user_data, and ad_personalization. Without these, Google Ads audiences and conversion modelling degrade sharply.
Free tiers exist (Cookiebot Free, Iubenda Free, Klaro open-source). Paid tiers run $10-$50/month for small sites, $500-$2,000+/month for enterprise setups with multi-domain, granular geo-rules, and IAB TCF support.
OneTrust, Didomi, Sourcepoint, Cookiebot, Usercentrics, and TrustArc are among the CMPs on the IAB Europe TCF registered vendor list. Certification is required to signal consent to ad exchanges using the IAB TCF v2.2 framework.
A CMP that blocks content or slows page load hurts SEO. A CMP configured to load asynchronously, avoid layout shift, and honour Consent Mode signals has zero SEO impact. Poor implementation is the risk, not the tool itself.
Related glossary terms
How theStacc helps
theStacc audits your full marketing stack — including CMP configuration, Google Consent Mode v2 signals, and tag firing rules. If your Google Ads audiences are shrinking or your analytics data looks broken, the CMP is often the root cause. We surface it and hand back a fix priority list.
Sources
