> How to choose a consent management platform: script blocking, Consent Mode v2, TCF, proof of consent, performance, pricing models and a CMP checklist. > > Canonical: https://www.flowconsent.com/en/blog/how-to-choose-consent-management-platform [Comparisons](https://www.flowconsent.com/en/blog?category=comparisons) # How to choose a consent management platform (CMP) in 2026 By FlowConsent · Published 3 March 2026 · Updated 23 October 2026 · 11 min read In short A [consent management platform](https://www.flowconsent.com/) (CMP) is the tool that shows your cookie banner, blocks scripts until visitors choose, passes consent signals to tags like Google's and keeps proof of every decision. To choose the right CMP, test real script blocking first, then check Google Consent Mode v2 support, proof of consent and where it is stored, integrations with your stack, performance and the pricing model at your traffic level. This guide walks through each criterion, the main types of CMP on the market, a five-step evaluation process and a checklist you can use with any vendor. ## What is a consent management platform (CMP)? A consent management platform is software that collects, stores and enforces visitors' choices about cookies and similar trackers. The visible part is the cookie banner and its settings panel. The invisible part does the real work: it keeps analytics, advertising and social scripts from running until the visitor agrees, releases only the categories accepted, transmits the choice to tags and keeps a log you can show a regulator. For a full definition with examples, read our explainer [what is a consent management platform (CMP)](https://www.flowconsent.com/en/blog/what-is-consent-management-platform-cmp). A CMP is therefore not just a design element. It sits between your website and every third-party tool that wants to set cookies. If you are looking for a consent management platform built for small and mid-sized sites, FlowConsent is one option, and the criteria below will help you judge it against the others. The banner the CMP displays has its own legal requirements (purposes at the first level, equal "Accept" and "Reject" buttons, withdrawal at any time). Our [complete GDPR cookie banner guide](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) covers them in detail. This article focuses on the tool behind it. ## Why you need a CMP You can build a cookie banner yourself. Some developers do, with a few lines of JavaScript and a cookie that stores the choice. The difficulty is not the banner, it is everything around it: - **Blocking.** Every script that sets non-essential cookies must wait for consent, including tags added later by marketing teams and embeds such as YouTube or Google Maps. - **Signals.** Google Ads and GA4 expect Consent Mode v2 signals. Advertising networks working with the IAB framework expect a TCF string. - **Proof.** The GDPR requires you to demonstrate consent (Article 7(1)). That means a timestamped, tamper-resistant log, not a cookie in the visitor's browser. - **Maintenance.** Trackers change, regulators update their guidance, new languages and new sites appear. A CMP handles these jobs as a product. A homemade banner works until the day someone adds a new tag without telling the developer. There is also a commercial reason. Since March 2024, Google requires Consent Mode v2 to keep using measurement and personalization features for users in the European Economic Area, and since January 2024 publishers using AdSense, Ad Manager or AdMob to serve ads in the EEA and the UK must use a Google-certified CMP integrated with the IAB TCF. If you depend on Google advertising, the CMP choice directly affects your revenue or your campaign data. ## What a CMP does, and what it does not do ### What a good CMP should do - Display a compliant banner and settings panel, in the languages of your site. - Block non-essential scripts technically until consent, not just hide them visually. - Send consent signals to tags (Google Consent Mode v2, and TCF if you work with programmatic advertising). - Store timestamped proof of each choice, exportable for an audit. - Let visitors change or withdraw consent at any time. - Detect cookies on your site and help you classify them. ### What a CMP will not do for you A CMP does not write your privacy policy or your cookie policy. It does not decide on its own whether a tracker is strictly necessary: an initial audit and your judgment are still needed. It does not make your site compliant just by being installed: configuration, categories and testing remain your responsibility. And it does not replace legal advice on questions of interpretation. ## How to choose a consent management platform: the criteria that matter ### 1. Real script blocking before consent This is the first criterion and the one that eliminates the most tools. Some solutions show a banner but let scripts run until the visitor clicks, or block only scripts they recognize. Check how blocking works (rewriting script tags, a tag manager waiting for a consent trigger, or both), and test it yourself: open a private window, refuse everything, and look at the cookies and network requests in your browser's developer tools. No non-essential request should leave the page. ### 2. Google Consent Mode v2 and Google certification If you use Google Ads, GA4 or Floodlight, the CMP must support Consent Mode v2 natively, with all four parameters (ad\_storage, analytics\_storage, ad\_user\_data, ad\_personalization) and a default state set to "denied" before the choice. Our [Google Consent Mode v2 implementation guide](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide) explains the mechanics, and our comparison of [basic vs advanced Consent Mode](https://www.flowconsent.com/en/blog/consent-mode-basic-vs-advanced-which-to-choose) helps you pick the right setup. If you run Google ad inventory as a publisher, also check that the vendor appears in Google's list of certified CMPs. ### 3. IAB TCF 2.2 support, if you need it The Transparency and Consent Framework is the standard used by programmatic advertising to pass consent between publishers and ad vendors. You need it if you sell ad space through networks that require it. Most brand and e-commerce sites that only buy ads do not. Our guide to [TCF 2.2](https://www.flowconsent.com/en/blog/tcf-2-2-transparency-consent-framework-guide) explains who needs it and what it changes in the banner. ### 4. Proof of consent and data location Ask what the CMP records for each choice (identifier, timestamp, categories, banner version), how long it keeps it, whether you can export it and where it is stored. Hosting consent logs in Europe avoids adding a data transfer question to your compliance file. Our article on [proof of cookie consent](https://www.flowconsent.com/en/blog/proof-of-cookie-consent-what-to-store) details what a useful record contains, and FlowConsent's [proof report documentation](https://www.flowconsent.com/en/doc/proof-report) shows what a dated, printable piece of audit evidence can look like. ### 5. Cookie scanning and classification A built-in scanner detects the cookies on your pages and suggests a category for each one. It saves time at setup and catches new trackers added by plugins, tag changes or marketing tools. Check how often it runs, how many pages it covers and whether it tests the page after a refusal. Before choosing a CMP, you can run an independent [cookie scanner](https://www.flowconsent.com/en/scan) to see what your site sets today, and follow our [website cookie audit guide](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide) for a complete inventory. ### 6. Banner design and compliance by default The CMP should make it easy to stay compliant: "Reject all" on the first layer, same style as "Accept all", no pre-ticked boxes, a permanent way to reopen the settings. Be careful with tools that encourage high acceptance rates through design tricks. Our article on [cookie dark patterns](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited) lists what regulators sanction, and our [GDPR cookie banner examples](https://www.flowconsent.com/en/blog/gdpr-cookie-banner-examples-best-practices) show balanced layouts. Also check visual customization (colors, fonts, position, mobile behavior) and the number of languages. ### 7. Performance The CMP script loads on every page, often before anything else. A heavy script, synchronous loading or a banner that pushes content down can hurt Largest Contentful Paint and Cumulative Layout Shift. Measure the script size and test your pages with and without it. Our analysis of [CMP impact on Core Web Vitals](https://www.flowconsent.com/en/blog/cmp-web-performance-impact-core-web-vitals) explains what to look for. ### 8. Integrations with your stack Check how the CMP installs on your platform: native app or plugin, script tag, Google Tag Manager template, or a package for a JavaScript framework. Our platform guides cover [cookie consent on Webflow](https://www.flowconsent.com/en/blog/webflow-cookie-consent-gdpr-guide), [cookie consent on WordPress](https://www.flowconsent.com/en/blog/wordpress-cookie-consent-gdpr-guide), [Shopify cookies and GDPR](https://www.flowconsent.com/en/blog/shopify-cookies-gdpr-compliance-guide) and [Next.js cookie consent](https://www.flowconsent.com/en/blog/nextjs-cookies-gdpr-compliance-guide). If you manage several sites, also check multi-site and team features. ### 9. Regulatory coverage If your audience is European, GDPR and ePrivacy rules are the baseline. If you also serve California, you need opt-out handling and support for Global Privacy Control. Some CMPs adapt the banner to the visitor's location. Our comparison [CCPA vs GDPR for cookies](https://www.flowconsent.com/en/blog/ccpa-vs-gdpr-cookie-differences) explains the differences, and our guide to [cookie rules outside Europe](https://www.flowconsent.com/en/blog/lgpd-popia-pdpa-dpdpa-cookies-outside-europe) covers other markets. ### 10. Pricing model and total cost CMPs charge in different ways: per page view, per session, per domain, per number of pages scanned, or a flat fee with feature tiers. The same site can cost very different amounts depending on the model, and the price often jumps when you cross a traffic threshold or need a second domain, more languages or proof export. Before deciding, compare the cost of your current CMP with the [CMP cost calculator](https://www.flowconsent.com/en/compare) using your real traffic, then check what each plan includes: script blocking and consent logs should never be paid add-ons. ## Free CMP or paid CMP? Free CMPs exist, and for a small site they can be enough. The question is not the price but what the free plan leaves out. Typical limits are a cap on traffic or page views, a single domain, one or two languages, a banner with the vendor's branding, manual scans only, a short history of consent logs, or no export of proof. Some free plans also stop blocking or stop showing the banner once you exceed the traffic cap, which is the worst possible failure because it is silent. Read the free plan's limits with three questions in mind. What happens when I exceed the quota? Can I export my consent records at any time? Does the free plan block scripts before consent in exactly the same way as the paid plan? If the answer to the last question is no, the free plan is a demo, not a compliance tool. ## Questions to ask a CMP vendor Before signing, ask each vendor the same questions in writing: - How exactly are scripts blocked, and what happens to a tag you do not know about yet? - Which Consent Mode v2 parameters do you set, and what is the default state? - What is stored for each consent, where, and for how long? - How do I export consent records, and in which format? - What is the size of your script, and does it load asynchronously? - How is the price calculated, and what happens if my traffic doubles? - How do I leave, and what do I keep when I do? Clear, specific answers are a good sign. Vague answers about "full compliance" are not. ## The main types of CMP on the market There are dozens of CMPs. They fall roughly into three groups, and the right one depends more on your size and constraints than on brand. ### Enterprise privacy suites OneTrust, TrustArc and Didomi target large organizations with many brands, complex legal requirements and dedicated privacy teams. They often cover more than cookies (data mapping, data subject requests, preference centers) and support IAB TCF. The trade-off is cost, setup time and complexity. Our comparisons [OneTrust vs FlowConsent](https://www.flowconsent.com/en/comparison/onetrust-vs-flowconsent) and [Didomi vs FlowConsent](https://www.flowconsent.com/en/comparison/didomi-vs-flowconsent) set out the differences. ### Mid-market CMPs Usercentrics and Cookiebot (both part of the same group), Axeptio, iubenda and CookieYes serve a broad market, from SMEs to large sites, with self-service plans and integrations for common platforms. Features and pricing models vary a lot from one to another. See our comparisons [Cookiebot vs FlowConsent](https://www.flowconsent.com/en/comparison/cookiebot-vs-flowconsent), [Axeptio vs FlowConsent](https://www.flowconsent.com/en/comparison/axeptio-vs-flowconsent), [CookieYes vs FlowConsent](https://www.flowconsent.com/en/comparison/cookieyes-vs-flowconsent) and [Usercentrics vs FlowConsent](https://www.flowconsent.com/en/comparison/usercentrics-vs-flowconsent). If you use iubenda mainly for its banner, our guide to [iubenda alternatives](https://www.flowconsent.com/en/blog/best-iubenda-alternatives) compares eight CMPs on price, languages, domains and IAB TCF. ### Lightweight and open-source tools Open-source scripts such as tarteaucitron.js give full control at no license cost, but you handle hosting, updates, proof of consent and Consent Mode integration yourself. Lightweight hosted CMPs aim for a simple setup and a small script. Our [tarteaucitron vs FlowConsent comparison](https://www.flowconsent.com/en/comparison/tarte-au-citron-vs-flowconsent) shows where each approach fits. For a side-by-side view of all the tools we have compared, browse the [CMP comparison hub](https://www.flowconsent.com/en/comparison). ## How to evaluate a CMP in five steps 1. **List your constraints.** Platforms and tag manager, Google Ads or not, programmatic ads or not, countries served, languages, number of sites, monthly traffic. 2. **Shortlist three tools** that match those constraints, using the criteria above and the comparison pages. 3. **Install each one on a staging site or a test page.** Most CMPs have a free plan or a trial. 4. **Run the refusal test.** Refuse everything in a private window and check cookies and network requests. Then accept only statistics, then everything. Confirm Consent Mode signals in Google Tag Assistant if you use Google tags. 5. **Check proof and exit.** Export a consent log, read it, and ask how you would migrate away. A CMP you cannot leave easily is a long-term risk. ## Switching from one CMP to another Changing CMP is common: prices change, a site outgrows a plugin, or a team wants better script blocking. The main risks are a gap where scripts run without consent during the switch, two banners appearing at once, and lost consent history. Plan the move: recreate your categories and services in the new tool, match the banner texts, deploy the new snippet and remove the old one in the same release, then test the three scenarios again. Keep exports of the old consent logs for as long as you may need to prove past consents. FlowConsent's guide to [migrating from another banner](https://www.flowconsent.com/en/doc/migrating-from-other-banner) describes these steps in order. If you are leaving Cookiebot in particular, our comparison of [Cookiebot alternatives](https://www.flowconsent.com/en/blog/best-cookiebot-alternatives) sets nine CMPs side by side on public prices, free plans and IAB TCF support. ## Common mistakes when choosing a CMP **Choosing on price alone.** A free tool that does not block scripts or keep proof of consent leaves you exposed. Compare what is included, not just the monthly price. **Assuming the banner means compliance.** Seeing the banner appear proves nothing. Only a refusal test in the browser tools shows whether scripts are really blocked. **Ignoring Consent Mode.** Without proper Consent Mode v2 signals, Google Ads and GA4 lose modeling and remarketing capabilities for EEA users. **Paying for features you do not need.** TCF support, geo-targeted banners or a full privacy suite matter for some organizations, not all. Start from your constraints. **Forgetting the exit.** Check that consent logs can be exported and that removing the tool is simple before you commit. ## CMP selection checklist 1. Scripts blocked before consent, verified with a refusal test. 2. Google Consent Mode v2 supported natively, default state "denied". 3. TCF 2.2 supported if you sell ad inventory programmatically. 4. Timestamped, exportable proof of consent, hosted in the EU. 5. "Reject all" on the first layer, same style as "Accept all". 6. Cookie scanner included, with regular automatic scans. 7. Lightweight script, no layout shift. 8. Native integration with your platform and tag manager. 9. Languages and regulations you need covered. 10. Pricing that stays sustainable at your traffic, with no hidden add-ons for core features. 11. A documented way to migrate in and out. ## How FlowConsent handles consent management FlowConsent is a CMP built for sites that need solid compliance without enterprise complexity. It blocks every non-essential script before consent, includes Google Consent Mode v2, scans your cookies automatically and stores exportable proof of each consent, hosted in Europe. The banner shows "Accept all" and "Reject all" on the first layer by default. Installation takes about ten minutes on Webflow, WordPress, Shopify, Wix, Framer or through Google Tag Manager. Pricing is simple: free up to 25,000 sessions per month, then Pro at €14.99 per month up to 100,000 sessions. To compare it with your current tool, use the [CMP cost calculator](https://www.flowconsent.com/en/compare), and see the [free vs Pro documentation](https://www.flowconsent.com/en/doc/free-vs-pro) for what each plan includes. [Back to the blog](https://www.flowconsent.com/en/blog) Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fhow-to-choose-consent-management-platform) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fhow-to-choose-consent-management-platform) Questions ## Common questions on this topic. Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What is a consent management platform? A consent management platform (CMP) is software that displays the cookie banner, blocks non-essential scripts until the visitor decides, passes the choice to tags such as Google Consent Mode and stores timestamped proof of each consent. It sits between your website and the third-party tools that want to set cookies, so that only the categories the visitor accepted are activated. ### Are consent management platforms free? Some are, at least for small sites. Free plans usually limit traffic, domains, languages or the history of consent logs, and some show the vendor's branding. Before choosing one, check that the free plan blocks scripts before consent, stores exportable proof and keeps working when you exceed the quota. FlowConsent is free up to 25,000 sessions per month, then €14.99 per month. ### Do I need a Google-certified CMP? You need a Google-certified CMP integrated with the IAB TCF if you are a publisher serving ads through AdSense, Ad Manager or AdMob to users in the EEA or the UK, a requirement in force since January 2024. If you only buy Google Ads or use GA4, what matters is that your CMP sends correct Google Consent Mode v2 signals, which any good CMP can do without certification. ### Is OneTrust a consent management platform? Yes. OneTrust offers a consent management platform as part of a wider privacy suite that also covers data mapping, data subject requests and preference management. It mainly targets large organizations with dedicated privacy teams. Smaller sites often find simpler and cheaper CMPs better suited to their needs, which is why comparing features and pricing models against your real constraints is essential. ### How do I test whether a CMP really blocks cookies? Open your site in a private browser window, refuse all cookies, then open the developer tools. In the Application or Storage tab, check that no analytics or advertising cookies appear, and in the Network tab, check that no requests go to Google Analytics, Meta or other ad domains. Repeat with partial acceptance and full acceptance, and reload the page each time. ### Can I switch CMP without losing consent records? Yes, if you plan the migration. Export the consent logs from your current CMP before cancelling it and keep them as long as you may need to prove past consents. Then recreate your categories in the new tool, deploy the new script and remove the old one in the same release, and test refusal and acceptance again so that no script runs without consent during the switch. Read next ## Keep reading. [All articles](https://www.flowconsent.com/en/blog) [Best practices · 9 October 2026](https://www.flowconsent.com/en/blog/what-is-consent-management-platform-cmp) ### [What is a consent management platform (CMP)? Definition and how it works](https://www.flowconsent.com/en/blog/what-is-consent-management-platform-cmp) [A consent management platform (CMP) asks visitors for permission before cookies run, enforces their choice and keeps proof of it. Here is what a CMP does, why the law requires one, and how it works.](https://www.flowconsent.com/en/blog/what-is-consent-management-platform-cmp) [Read the article ](https://www.flowconsent.com/en/blog/what-is-consent-management-platform-cmp)· [Marketing tools · 28 March 2026](https://www.flowconsent.com/en/blog/consent-mode-basic-vs-advanced-which-to-choose) ### [Consent Mode v2: basic vs advanced mode, which one to choose?](https://www.flowconsent.com/en/blog/consent-mode-basic-vs-advanced-which-to-choose) [Consent Mode v2 offers two modes: basic (strict blocking) and advanced (anonymized pings). Differences, GDPR implications and choosing guide.](https://www.flowconsent.com/en/blog/consent-mode-basic-vs-advanced-which-to-choose) [Read the article ](https://www.flowconsent.com/en/blog/consent-mode-basic-vs-advanced-which-to-choose)· [Best practices · 6 April 2026](https://www.flowconsent.com/en/blog/cmp-web-performance-impact-core-web-vitals) ### [CMP and Web Performance: What Impact on Your Core Web Vitals?](https://www.flowconsent.com/en/blog/cmp-web-performance-impact-core-web-vitals) [Is your CMP slowing down your site? CMP script weight benchmarks and their impact on CLS, LCP, and INP. Comparison and best practices.](https://www.flowconsent.com/en/blog/cmp-web-performance-impact-core-web-vitals) [Read the article](https://www.flowconsent.com/en/blog/cmp-web-performance-impact-core-web-vitals) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)