Consent management platform (CMP)
Also known as: CMP, cookie banner, cookie consent tool, consent management, cookie consent manager
A consent management platform (CMP) is the software behind most cookie banners.
It asks visitors for consent to cookies and tracking, records their choices, and tells analytics and advertising tools what they're allowed to do. While a banner looks like a simple pop-up, the CMP's real job is making sure consent decisions actually reach the tags firing in the background. That's where many websites fail.
Consent management platform (CMP), explained at three levels
At home
When a website shows a pop-up asking about cookies, that's usually a consent management platform at work. You can accept, reject, or choose which types of cookies to allow, and the site should remember your choice.
At work
If your website uses analytics or advertising tools, you likely need a CMP to ask visitors for consent, especially if you have visitors from Europe or Quebec. It also stores proof of consent in case a regulator asks.
At home
In the EU, rejecting cookies should be as easy as accepting them. Regulators have fined companies for hiding the 'reject' button or making it grey and small. If you only see 'accept' and 'settings,' the banner may not meet the rules.
At work
A CMP should block non-essential scripts until consent is given, categorize cookies, store consent records with timestamps and versions, re-prompt when purposes change, and pass signals to tools through standards like the TCF or Google Consent Mode. Testing whether tags actually respect choices is critical, since many sites fire trackers before the banner loads.
At home
Some sites offer 'pay or consent,' asking you to pay a fee if you don't want tracking. Regulators have pushed back, and the EU fined Meta under the Digital Markets Act over its version. In my view, these models show how far consent can drift from a free choice when a business depends on tracking.
At work
CMPs interact with server-side tracking, which can bypass browser controls if not configured carefully. Consent signals also need to reach data warehouses and ad platforms for downstream processing. Global sites typically configure CMPs by region: opt-in banners for the EU, UK, and Quebec, opt-out links and Global Privacy Control support for US states, and lighter notices elsewhere.
Real-world examples
At home
Sophie visited a news site that only offered 'Accept all' or 'Manage settings.' Inside the settings, every option was pre-selected. She turned them all off, but suspected the design was meant to discourage people from doing the same.
At work
Carlos runs digital marketing at a Montreal clothing retailer. After an audit showed that analytics tags fired before visitors made a choice, his team reconfigured the CMP to block scripts until consent, satisfying Quebec's Law 25 and GDPR requirements for European shoppers.
Common confusions
- Having a cookie banner means a site is compliant. — Compliance depends on whether tracking actually stops until consent and whether rejecting is as easy as accepting.
- Essential cookies need consent too. — Strictly necessary cookies, such as those for logins or shopping carts, generally don't need consent under EU rules.
- Consent lasts forever. — Consent should be refreshed periodically and when purposes change, and people can withdraw it at any time.
For analysts
Audit what your site does, not what the banner says. I'd run a simple test: reject all cookies, then check which network requests still fire. That one test finds more compliance gaps than any policy review.
History & origin
The EU's ePrivacy Directive was amended in 2009 to require consent for storing non-essential cookies, but enforcement was weak and early banners were often decorative. GDPR in 2018 raised the bar for valid consent, and the CJEU's Planet49 ruling in 2019 confirmed that pre-ticked boxes don't count. The ad industry's Transparency and Consent Framework, launched by IAB Europe in 2018 and updated several times, gave CMPs a standard way to pass consent signals to ad vendors. In 2022, the Belgian data protection authority found problems with that framework, and in 2024 the EU's top court ruled that the consent strings it uses can be personal data. Google also required Consent Mode v2 for advertisers in the EEA from March 2024. In my opinion, cookie banners are proof that compliance without good design produces annoyance rather than meaningful choice.