What is Consent Management Platform (CMP)?

A CMP has four jobs. First, presentation: rendering the right consent experience for each visitor — opt-in banners for the EU, Do Not Sell or Share mechanics for California — in the right language, with accurate purpose descriptions. Second, capture: recording the choice with timestamp, banner version, and scope, because under GDPR the site bears the burden of proving consent existed.

Third — and where weak CMPs fail — enforcement. The recorded choice must control actual script behavior: marketing tags held until marketing consent, analytics until analytics consent, everything re-suppressed if the visitor later withdraws. CMPs enforce through tag-manager integration (consent mode signals, blocking triggers), script rewriting, or SDK APIs that other code queries. A CMP that records 'rejected' while the Meta Pixel fires anyway is documentary evidence against you.

Fourth, signal handling: modern CMPs must consume the Global Privacy Control header as a valid opt-out, emit Google Consent Mode v2 states so Google's tags behave correctly, and — for sites in the programmatic advertising ecosystem — pass consent downstream through the IAB's Transparency and Consent Framework (TCF) strings that ad-tech vendors read.

Choosing a CMP is mostly a question of enforcement depth and evidence quality: does it verifiably block pre-consent firing on your actual stack, does it keep exportable consent records, and does it stay synchronized with what your site really sets — which requires an integrated or companion scanner. Pricing and vendor lists matter less than whether the platform can prove, for any given visitor, what they consented to and what actually fired.