Consent management platform: what it does and what it does not
Where it sits among other tools is on the ecommerce marketing technology stack page.
What does a consent management platform do?
A visitor lands on your shop. A banner asks what they allow. The CMP stores the answer and tells your tags what they may do.
Three jobs sit inside that:
- Ask. Show the banner, in the right language, with the choices you configured.
- Record. Keep the visitor's choice so you can show later what was agreed.
- Pass on. Send the choice to the tags that need it, so analytics and ad tags behave accordingly.
The third job is where marketing feels it. Google's Consent Mode is the mechanism: the banner hands the visitor's choices to Google tags, which change how much and what kind of data they send. Google's EU user consent policy names two separate consent fields: one for sending user data to Google for advertising, and one for ad personalisation1.
Why do e-commerce brands use it?
Because the banner and the tags have to agree. Google's EU user consent policy applies to advertisers that receive data from end users in the EEA1. To keep using Google tags for measurement, ad personalisation and remarketing, the policy says you must collect consent from those users1.
That also touches your first-party data. Orders, accounts and email sign-ups are yours. What you may send to an ad platform from them is a consent question. Enhanced conversions send hashed customer data to Google, so the same question applies. Your counsel decides what consent you need for that.
Google also runs consent audits under this policy and publishes help on fixing the issues they raise2. Our view: treat an audit as Google's check, not as legal advice. Your counsel decides.
How do we implement it?
List every tag
Write down what runs on your site before choosing a tool. You cannot wire a banner to scripts nobody has listed.
Set up in your account
The CMP account and admin access sit with your company, so you can change supplier or agency without losing your records.
Configure and test
Set categories, wording, languages and defaults. Then check that each choice reaches Google tags, Meta tags and anything else you run.
Retest on every change
Each new tag or script needs a place in the banner. Your counsel decides what the banner must say and do.
When should you not use it?
Our view: with EEA traffic, going without a CMP is not something we would recommend, and your counsel decides what you need. These are the cases where we would slow down:
What does it cost in effort?
We give no figures. Prices differ by vendor and by traffic, and we do not compare vendors here.
The effort has four parts:
- Choice. Pick a tool that supports Consent Mode and the signals you need.
- Configuration. Categories, wording, languages, default states, and a test of every tag.
- Wiring. Check that the choice reaches Google tags, Meta tags and anything else you run.
- Upkeep. Every new tag or script needs a place in the banner.
Someone on your side should own the account. A CMP that only the agency can open is a risk.
Pitfalls
Treating the tool as compliance
A CMP does not make you lawful. Configuration decides. Your counsel decides what your banner must say and do.
Signals that do not arrive
One trade-press article describes a single account whose Google Ads conversions dropped sharply because the banner's choices never reached Google tags3. We do not generalise from one case. We do say: test the signal, do not assume it.
Tags that ignore the banner
A script added by hand after launch may fire regardless.
Banner copy nobody can read
Your counsel decides the wording. Marketing can still ask for it to be readable.
Mixing up two questions
"Do we have a banner?" and "do our tags respect it?" are not the same question.
Our take: Core
We rate CMPs Core for brands with EEA traffic. This is our view, not a market fact.
Why Core? Under Google's policy, measurement and remarketing with Google tags depend on consent being collected from EEA users1. Without a working consent signal, the rest of the tracking work is built on sand.
The IAB TCF layer is different. TCF is IAB Europe's Transparency and Consent Framework, and some CMPs sell "TCF v2.2" support as an extra layer. Our view: it matters mainly for publishers and programmatic buying, so we rate that layer Selective. If you sell through your own shop and run search and social ads, it is not your first question.
Our view: a CMP is the first item in a tracking review, not the last.
FAQ
What is Google's EU user consent policy?
It is Google's policy for advertisers that receive data from end users in the EEA. It requires consent for using Google tags for measurement, ad personalisation and remarketing, with separate consent fields for user data and ad personalisation1.
Do I need an IAB TCF v2.2 CMP?
Not by default, in our view. TCF matters mainly for publishers and programmatic buying. A shop running its own search and social ads should start with Consent Mode. Your counsel decides what your set-up requires.
Is a CMP the same as Consent Mode?
No. The CMP is the banner and the record. Consent Mode is how the choices reach Google tags.
Does a CMP make my site compliant?
No. It is a tool, and compliance depends on how it is configured. Your counsel decides.
Who should own the CMP account?
You. Admin access and the account should sit with your company, so you can change supplier or agency without losing your records.
Can a CMP hurt my ad measurement?
It can, if the choices do not reach your tags. Test after every change.
Let’s find what’s actually working.
Next step. Want a second opinion on whether your consent set-up reaches your tags? Talk to us about your consent set-up. Or read about our Analytics & tracking service.