Consent management platform (CMP)
Also known as: CMP, cookie banner, cookie consent tool, consent management, cookie consent manager
A consent management platform (CMP) is the software behind most cookie banners.
It asks visitors for consent to cookies and tracking, records their choices, and tells analytics and advertising tools what they're allowed to do. While a banner looks like a simple pop-up, the CMP's real job is making sure consent decisions actually reach the tags firing in the background. That's where many websites fail.
Consent management platform (CMP), explained at three levels
At home
Think of a consent management platform as a doorman for a website's trackers. Before analytics or advertising tools can come in and set cookies, the doorman asks you whether to let them through, writes down your answer, and enforces it on every page. The pop-up banner is just the doorman's question. The real work is keeping out the tools you didn't approve.
At work
A CMP is software that collects, stores, and enforces visitors' consent choices for cookies and tracking. It shows the banner, logs each decision as proof, and passes the choice to analytics and advertising tools so they behave accordingly. Businesses care because EU, UK, and Quebec rules require consent for non-essential tracking, and regulators check what actually happens, not what the banner promises.
At home
A CMP's banner sorts cookies into categories, such as strictly necessary, analytics, and advertising, and records your choice in a small cookie of its own so you aren't asked again on every page. In the EU, valid consent must be a clear action, so pre-ticked boxes don't count, and rejecting should be as easy as accepting. Regulators have fined sites that hid the 'reject' option behind extra clicks or made it hard to see.
At work
Under the hood, a CMP works with a tag manager. It holds back non-essential scripts until a visitor consents, then releases only the approved categories. It stores consent records with timestamps and banner versions, re-prompts when purposes change, and passes signals downstream through standards such as IAB Europe's Transparency and Consent Framework, whose encoded 'TC string' tells ad vendors what's allowed, and Google Consent Mode, which adjusts how Google tags behave.
At home
Some sites offer 'pay or consent': accept tracking or pay a fee for a version without personalized ads. Regulators have pushed back, and the EU fined Meta €200 million under the Digital Markets Act over its version in 2025. Critics say consent isn't freely given if refusing costs money. In my view, these models show how far consent can drift from a free choice when a business depends on tracking.
At work
Common failure modes sit outside the banner. Tags hard-coded into pages fire before the CMP loads, server-side tracking can forward data even when the browser blocks it, and consent signals often fail to reach data warehouses and ad platforms downstream. Global sites typically configure CMPs by region: opt-in banners for the EU, UK, and Quebec, opt-out links and Global Privacy Control support for US states, and lighter notices elsewhere.
Real-world examples
At home
Sophie visited a news site that only offered 'Accept all' or 'Manage settings.' Inside the settings, every option was pre-selected. She turned them all off, but suspected the design was meant to discourage people from doing the same.
At work
Carlos runs digital marketing at a Montreal clothing retailer. After an audit showed that analytics tags fired before visitors made a choice, his team reconfigured the CMP to block scripts until consent, satisfying Quebec's Law 25 and GDPR requirements for European shoppers.
Common confusions
- Having a cookie banner means a site is compliant. — Compliance depends on whether tracking actually stops until consent and whether rejecting is as easy as accepting.
- Essential cookies need consent too. — Strictly necessary cookies, such as those for logins or shopping carts, generally don't need consent under EU rules.
- Consent lasts forever. — Consent should be refreshed periodically and when purposes change, and people can withdraw it at any time.
For analysts
Audit what your site does, not what the banner says. I'd run a simple test: reject all cookies, then check which network requests still fire. That one test finds more compliance gaps than any policy review.
History & origin
The EU's ePrivacy Directive was amended in 2009 to require consent for storing non-essential cookies, but enforcement was weak and early banners were often decorative. GDPR in 2018 raised the bar for valid consent, and the CJEU's Planet49 ruling in 2019 confirmed that pre-ticked boxes don't count. The ad industry's Transparency and Consent Framework, launched by IAB Europe in 2018 and updated several times, gave CMPs a standard way to pass consent signals to ad vendors. In 2022, the Belgian data protection authority found problems with that framework, and in 2024 the EU's top court ruled that the consent strings it uses can be personal data. Google also required Consent Mode v2 for advertisers in the EEA from March 2024. In my opinion, cookie banners are proof that compliance without good design produces annoyance rather than meaningful choice.