What Is a CMP? What a Consent Management Platform Must Do

What is a consent management platform?

A consent management platform, or CMP, is the software on your website that asks visitors for consent, stores their choice, proves it and passes it on to every integrated service. The only visible part is the cookie banner. The real work happens behind it: the CMP makes sure that Google Analytics, Google Ads, the Meta Pixel and other services only set cookies or send data once the visitor has allowed it. It is often also called a consent manager or consent management tool. All of these terms mean the same thing.

In Germany, the legal basis is Section 25 of the Telecommunications Digital Services Data Protection Act (TDDDG), which was called the TTDSG until May 2024. It governs when a user’s device may be accessed, in other words when cookies may be set or read. Anything that is not strictly necessary generally requires consent. Article 7 of the EU General Data Protection Regulation (GDPR) also requires that you can prove this consent and that withdrawing it is as easy as giving it. This article is not legal advice; it explains the technology.

What tasks does a consent manager perform?

A consent manager handles six closely related tasks. If one fails, you face data protection issues or gaps in your numbers.

• Asking: The banner explains purposes clearly and offers accept and reject options equally.
• Storing: The decision is saved in the browser so the banner does not reappear on every page load.
• Proving: Each consent is logged with the time, banner version, and selected purposes.
• Passing on: The decision is sent to Google Consent Mode and all other dependent tags.
• Allowing withdrawal: Visitors can change their decision at any time, for example via a link in the footer.
• Scanning: A cookie scan shows which cookies and services actually appear on the page.

→ Cookie banner with Consent Mode v2: compliant, with no monthly license

Consent management and Google Consent Mode v2

For Google, the most important job of the CMP is passing the decision to Google Consent Mode v2, the interface through which Google tags learn the visitor’s choice. Consent Mode uses four signals: ad_storage and analytics_storage control whether cookies for advertising and analytics may be set. ad_user_data controls whether user data may be sent to Google for advertising purposes, and ad_personalization controls whether personalized ads are allowed. When the page loads, the CMP sets a default value for all four, usually “denied” in the EU. When the visitor clicks a button, it sends an update with the actual decision.

Since March 2024, Google has expected these signals to be sent for visitors from the European Economic Area whenever data is to be used for advertising and remarketing. Without them, Google Ads can only make limited use of audiences and conversions. Google distinguishes two variants. In the basic implementation, Google tags only load after consent. In the advanced implementation, they load immediately with the default “denied” and, without consent, send only cookieless measurements that Google uses to estimate the missing values. Choosing the right variant is a trade-off you should make deliberately.

Other services have their own mechanisms. Microsoft Advertising supports its own consent signal for Universal Event Tracking (UET). For Meta, LinkedIn, TikTok or Pinterest, the tag in Google Tag Manager is usually set to fire only after marketing consent. A good CMP provides its own event or variable in the Google Tag Manager container that triggers can reference.

A cookie scan is another job of a CMP. It visits your pages automatically and lists which cookies, local storage entries and services actually appear there. This matters because websites change all the time: a new plugin embeds a map, a video comes from a video platform, a chat window sets its own cookies. If a service shows up in the scan but not in the banner, the banner is not asking about something that happens anyway. The scan results also belong in the cookie table of your privacy policy, so visitors can read what they are consenting to.

How to recognize a good CMP

You can tell a good CMP by its technology and how it behaves day to day, not by how the banner looks. These points help you choose, whether you use an off-the-shelf consent management tool or have a solution set up for you.

• Consent Mode v2 is built in and sets the default value before any tag fires.
• “Reject all” is shown with equal prominence on the first layer, not hidden in the settings.
• The banner loads quickly: few files and nothing loaded from lots of third-party servers.
• Consent records are stored with as little data as possible, ideally without the IP address.
• Integration with Google Tag Manager is documented and works without custom code.
• Texts are available in the languages your site speaks.

Load time is often overlooked when choosing a CMP. Because the CMP has to load very early so that the default value is set before any other tag, every extra file delays the start of measurement and often the rendering of the page as well. So check on a test page how many files the banner loads and when it becomes visible. A banner that only appears on a phone after several seconds costs you visitors and hurts your Core Web Vitals.

→ Setting up Google Consent Mode v2 correctly: no warning in Tag Assistant

Typical mistakes and how to spot them

A common CMP mistake is a banner that appears but controls nothing. The tags in Google Tag Manager fire on page load, whatever the visitor decides. You can spot this if you click “Reject all” in a private window and still find cookies such as _ga or _fbp under Application in the developer tools. A second mistake is a missing default value: Consent Mode only receives a signal after the click, so the first hits are sent without any consent state.

It also happens that consent is stored but never passed on to Consent Mode as an update. Everything then stays at “denied,” and Google Analytics shows hardly any data even though many visitors consent. Wrongly assigned categories are common too: the Meta Pixel sits under “Statistics” instead of “Marketing,” or a service is not listed in the banner at all. In Google Tag Manager’s preview mode, the Consent tab shows which consent state applied at which moment.

Real-world example: a small WooCommerce store

A store selling coffee equipment uses WooCommerce, Google Analytics 4, Google Ads and the Meta Pixel. The banner was added years ago through a plugin, and the tags were added later through Google Tag Manager. Testing shows that the banner asks for consent correctly, but the Meta Pixel is also hard-coded in the theme and always loads. On top of that, the default value for Consent Mode is missing, which is why Google Ads sees hardly any conversions from the EU.

The fix takes three steps. The pixel is removed from the theme and fired only through Google Tag Manager, with a trigger for marketing consent. The CMP sets the default “denied” right at the start. Then every path is tested: no decision, reject and accept. Only when the right thing happens in all three cases does the change go live.

Have consent management set up

Trackum sets up consent so that it really works in your company’s Google Tag Manager: Consent Mode v2 with a default value, triggers for every advertising platform, and a test in preview mode with and without consent before anything goes live. Setup with Google Analytics 4 and Consent Mode v2 costs a one-time €150. The Trackum cookie banner, a single 6.6 KB file that loads nothing else, is available as an add-on for €50 plus €4.90 per month and is included in the subscription at €19 per month. All prices plus VAT.

If you first want to know whether your current CMP works properly, the free check (€0, no sign-up) tests your site in a real browser with and without consent and shows you each finding with a fixed price.