What is a CMP (consent management platform)?

The acronym stands for consent management platform. The most widespread confusion equates it with the cookie banner. The banner is the visible part. The CMP is the whole system: the scan that discovers which cookies and which vendors exist on the site, the logic that decides which notice to show depending on the visitor's country, the timestamped record of every decision and the route that allows it to be revoked later.

From there comes the second confusion, a considerably more expensive one. Installing a CMP does not make a website compliant. A CMP carries out a decision, it does not make one. If the notice offers categories that do not match the actual processing, if rejecting costs more effort than accepting, or if tags fire before the answer, the system will be working and the site will remain questionable.

It should also be distinguished from consent mode. The CMP obtains and stores the decision. Consent mode translates it into the signals Google tags understand. They are separate pieces that connect to each other, and neither covers the other's work.

The cycle starts with an inventory. The CMP crawls the site, detects cookies, pixels and external vendors, and groups them into categories. The notice is built on that inventory, with a short first layer and a second layer where the user can accept or reject by category or by vendor.

When the person answers, the platform stores the decision with a date, the version of the text shown and the scope, and exposes it to the rest of the site in two ways. On one side it blocks or releases scripts according to the category. On the other it emits signals towards external systems, among them the consent mode signals sent to Google tags.

In the advertising ecosystem that communication is standardised by IAB Europe's Transparency and Consent Framework. The CMP encodes the decisions in a text string, the TC String, which records the authorised purposes and the specific vendors from the Global Vendor List. Any participant in the framework reads that string and adjusts its processing. Version 2.3 of the framework was published in April 2025, with mandatory adoption for participants from 28 February 2026.

There is also a certification layer. Google requires a certified CMP integrated with the TCF in order to serve personalised advertising on AdSense, Ad Manager and AdMob inventory: since 16 January 2024 in the European Economic Area and the United Kingdom, and since 31 July 2024 in Switzerland. The list of certified platforms is public and is updated regularly.

The decision that depends on a CMP is one of data governance, not procurement. It determines what is measured and what is not, and therefore which part of the business is documented in the reports. A majority rejection that is implemented properly reduces analytics coverage visibly and honestly. A configuration that ignores that rejection produces complete data and an open risk.

For advertising, certification decides access. Without a certified CMP integrated with the TCF, the affected traffic stops being eligible for personalised ads in the Google products mentioned and is left with non-personalised or limited ads where the format allows it. For a publisher that translates into lower revenue per thousand impressions.

There is an internal consequence that tends to be underestimated. The record of decisions is the evidence shown when someone asks on what basis a specific piece of data was processed. If the platform does not keep that record in a retrievable and exportable form, the defence ends up resting on screenshots. Whether the approach is adequate in a specific case must be assessed by legal counsel.

• Rescan the site after every release, because a new vendor arrives unannounced through any marketing integration.
• Check that rejecting costs the same as accepting, measured in clicks and in button visibility.
• Verify in the browser that no non-essential cookie is written before the answer, instead of trusting the tool's dashboard.
• Connect the CMP to consent mode and confirm that the four signals genuinely switch when the user accepts and when the user rejects.
• Keep the record of decisions with date, text version and scope, and know how it is exported before you need it.
• Review the certification and the TCF version of the contracted platform every time the framework publishes a new version.

• Treating the site as compliant because the banner is in place, without checking what happens technically when someone rejects.
• Loading analytics or the advertising pixel before the decision and disabling them afterwards, once the cookie is already written.
• Highlighting the accept button and hiding the rejection behind a preferences menu.
• Choosing a platform without checking whether it appears on the certified list, when the business model depends on personalised advertising.
• Translating the notice and forgetting that scope and categories must match the actual processing in each market.