What is a consent management platform?
A consent management platform is a tool that sits between your visitors and the third-party scripts on your website. Before Google Analytics, the Meta Pixel, a chat widget or an embedded video can set a cookie, the CMP asks the visitor whether they agree. It then enforces the answer: scripts that were refused stay blocked, scripts that were accepted are released.
The CNIL, the French data protection authority, lists the term in its glossary as a "plateforme de gestion du consentement". In practice, a CMP does three things:
- Collect: show the information and the choices, usually through a banner and a preferences panel.
- Store: remember the choice (so the banner does not reappear on every page) and keep a dated record of it.
- Share: pass the choice to the tags and partners that depend on it.
A CMP is a category of software, not a single product. Cookiebot, Axeptio, Didomi, OneTrust, Usercentrics, CookieYes, the open-source tarteaucitron.js and FlowConsent are all CMPs, with very different scopes and prices. If you already know you need one and want to compare options, read our guide on how to choose a consent management platform. The rest of this article stays on the definition and the mechanics.
Why websites need a CMP: the legal basis
No law says "you must buy a CMP". The obligation comes from the rules on consent, and a CMP is the practical way to meet them.
The ePrivacy Directive
Article 5(3) of the ePrivacy Directive requires consent before storing or reading information on a user's device, unless it is strictly necessary for the service the user asked for. Each country has transposed it: Article 82 of the French Data Protection Act, the TDDDG in Germany (formerly TTDSG), PECR in the United Kingdom, the LSSI in Spain.
The GDPR definition of consent
The GDPR defines what valid consent is: freely given, specific, informed and unambiguous, given by a clear affirmative action (Article 4(11)). Article 7(1) adds that the controller must be able to demonstrate that consent was given. Article 7(3) requires that withdrawing consent be as easy as giving it.
What regulators expect
National authorities turn these principles into concrete requirements. The CNIL guidelines on cookies (2020) state that refusing must be as easy as accepting, and that continuing to browse does not count as consent. The ICO and the German DSK say much the same. In 2023, the EDPB cookie banner taskforce published a report listing banner practices that authorities consider problematic, such as the missing reject button on the first layer.
Meeting all of this by hand is possible on a very small site, but it quickly becomes fragile. A CMP turns the legal requirements into a repeatable mechanism.
How a CMP works, step by step
The details differ between products, but almost every CMP follows the same sequence.
- Inventory. The CMP (or you) lists the cookies and scripts on the site and sorts them into categories: strictly necessary, preferences, analytics, marketing. Many CMPs include a scanner for this.
- Default state. On the first visit, only strictly necessary cookies are allowed. Everything else waits.
- Banner. The visitor sees the purposes, the main partners, and buttons to accept, refuse or customize.
- Blocking and release. Non-essential scripts are held back until the visitor accepts the matching category. Technically, this is done by changing the script type, by wrapping tags, or by controlling a tag manager.
- Signals. The choice is passed to the tools that need it, for example through Google Consent Mode v2 or the IAB TCF string.
- Memory. The choice is stored, usually in a first-party cookie, so the banner does not reappear on every page.
- Proof. A dated record of the choice is kept on the server side. See what this record should contain in our article on proof of cookie consent.
- Withdrawal and renewal. A permanent link or button reopens the preferences, and consent is asked again after a set period or when the purposes change.
Step 4 is where most of the compliance risk sits. A banner that looks correct but lets Google Analytics load before the click does not protect you. FlowConsent, for example, blocks scripts before consent and only releases them once the visitor has accepted the matching category, which you can check in the network tab of your browser.
CMP, cookie banner, cookie policy: what is the difference?
These three terms are often used as synonyms. They are not.
- The cookie banner is the visible part: the message and buttons shown on the first visit.
- The CMP is the whole system behind the banner: blocking, signals, storage, proof, withdrawal.
- The cookie policy is a page that documents the cookies you use, their purpose and their duration. A CMP can generate or update it, but it is a separate document.
A home-made banner that only shows a message and an "OK" button is a banner without a CMP. It informs, but it does not enforce anything.
Consent signals: Google Consent Mode v2 and the IAB TCF
A modern CMP does more than block and release scripts. It also tells other systems what the visitor decided.
Google Consent Mode v2
Google Consent Mode v2 passes four parameters to Google tags: ad_storage, analytics_storage, ad_user_data and ad_personalization. Google requires these signals for advertisers who want to keep audience and measurement features for EEA users. The CMP sets the default values before any tag loads and updates them after the visitor's choice. Our Google Consent Mode v2 guide explains the basic and advanced modes.
The IAB Transparency and Consent Framework
The TCF is a standard used mainly by publishers who sell advertising space through programmatic networks. The CMP encodes the visitor's choices, per purpose and per vendor, in a "TC string" that ad partners read. Only CMPs registered with IAB Europe can generate valid TC strings. Since January 2024, Google also requires publishers using AdSense, Ad Manager or AdMob to serve ads in the EEA and the UK to use a Google-certified CMP integrated with the TCF. If you do not sell ad space, you probably do not need the TCF at all. Our TCF 2.2 guide goes into the details.
Do you need a CMP?
You need a consent mechanism as soon as your site sets cookies or uses trackers that are not strictly necessary, and has visitors in the EU, the EEA or the UK. That covers most sites running analytics, advertising pixels, embedded videos, maps or chat widgets.
You may not need one if your site only uses strictly necessary cookies (session, cart, load balancing, security), or a privacy-friendly analytics tool configured within the CNIL exemption for audience measurement. The question is covered in detail in do I need a cookie banner on my website?.
Before deciding, look at what your site actually sets. Many owners discover marketing cookies they did not know about, added by a plugin, a theme or an embed.
The main types of CMP
CMPs fall into a few broad families.
- Plugins and CMS apps. Installed from the WordPress, Shopify or Webflow marketplace. Quick to set up, but tied to one platform.
- SaaS scripts. A JavaScript snippet added to any site, configured from an online dashboard. This is the most common model (Cookiebot, Axeptio, CookieYes, FlowConsent).
- Enterprise suites. Consent management is one module among others: data mapping, subject access requests, vendor risk. OneTrust and TrustArc are typical examples. Yes, OneTrust is a CMP, but its consent module is part of a much broader privacy platform.
- Open-source libraries. tarteaucitron.js and Klaro are free and self-hosted. You manage updates, the consent log and the configuration yourself.
- TCF-registered CMPs. Required if you monetize your site with programmatic advertising. Didomi, Sourcepoint and Usercentrics are well-known examples.
Are consent management platforms free?
Some are. Open-source libraries are free, and many SaaS CMPs offer a free tier, usually limited in traffic, domains, languages or features such as the consent log. Paid plans are priced per domain, per page view, per session or per month, and enterprise suites are usually quoted on demand. The total cost depends on your traffic and on how many sites you manage. Compare the cost of your current CMP with our CMP cost comparison tool, or browse our CMP comparison pages for side-by-side reviews.
Does a CMP slow down a website?
It can. The banner script loads on every page, and a poorly loaded CMP can affect Core Web Vitals, in particular CLS and LCP. Lightweight scripts, asynchronous loading and a banner that does not push content down limit the impact. We look at these effects in CMP and Core Web Vitals.
What a CMP does not do
A CMP is a tool, not a compliance certificate. It does not decide which cookies are strictly necessary for your site, it does not write your privacy policy, and it does not cover the other GDPR obligations (records of processing, data subject rights, transfers outside the EU). It also does not fix a bad configuration: a script you forgot to categorize can still load before consent. Testing after installation, and again after each new tag or plugin, remains your job.
How FlowConsent handles consent management
FlowConsent is a CMP that covers the full sequence described above: an automatic cookie scan, a configurable banner, blocking of scripts before consent, Google Consent Mode v2 built in, and an exportable proof of consent. It is hosted in Europe and integrates with Webflow, WordPress, Shopify, Wix, Framer and Google Tag Manager. Installation takes about ten minutes.
It is free up to 25,000 sessions per month, then €14.99 per month on the Pro plan up to 100,000 sessions. To get started, follow the quick installation guide.