Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
FlexCMP is a consent management platform developed in Italy and registered with IAB Europe under the Transparency and Consent Framework. It displays a cookie banner and preference centre, blocks tagged scripts until the visitor consents, generates the IAB TCF consent string for advertising partners, and stores a record of each choice. Being operated from the European Union, it keeps consent data inside the EU, which removes the international transfer concern that comes with US based consent tools.
FlexCMP is a consent management platform built in Italy and registered with IAB Europe as a TCF compliant CMP. It provides a configurable cookie banner, a granular preference centre, automatic blocking of tagged scripts, and consent logging, and it is widely used by Italian publishers and agencies that need IAB Transparency and Consent Framework support. A single JavaScript include loads the banner, applies the publisher configuration and records the visitor decision.
FlexCMP stores the visitor decision in first party cookies, typically a flexcmp cookie holding the consent state and, when the IAB framework is active, the euconsent-v2 cookie that carries the standard TCF consent string shared with advertising vendors. It keeps a consent record with a pseudonymous identifier, a timestamp and the purposes and vendors accepted. These values describe preferences and consent rather than identifying a person by name.
The cookies FlexCMP uses to remember the choice are strictly necessary to operate the consent mechanism, so they are exempt under article 5(3) of the ePrivacy Directive. FlexCMP exists to enforce the requirement that analytics and advertising trackers stay blocked until the visitor opts in, in line with the Italian Garante cookie guidelines and the EDPB position on consent. Keeping the consent record satisfies the accountability duty of GDPR article 5(2) and the proof of consent expected by article 7.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Configure FlexCMP so that every non essential vendor and purpose is off by default and only fires after the visitor accepts, and make refusing as easy as accepting. When you use the IAB TCF, the consent string is shared with the advertising vendors you declare, so list those vendors and their purposes in your privacy policy. Because FlexCMP is operated from the European Union, the consent data itself is processed in the EU and does not rely on a third country transfer mechanism.
Keep the vendor and cookie list current by re scanning the site after changes, align the descriptions shown in the preference centre with your cookie policy, and set a consent lifetime so that you ask again after a reasonable period. Test the banner to confirm that nothing non essential loads before consent, expose a persistent link to reopen the preferences, and export the consent log when a supervisory authority requests evidence.
Websites using FlexCMP must obtain user consent under GDPR regulations.
DPIA considerations
FlexCMP records consent rather than profiling visitors, so it rarely needs a standalone DPIA. A DPIA at the level of your tag governance is recommended when you run the IAB TCF with many advertising vendors, because large scale behavioural advertising can be high risk under GDPR art. 35. Document the vendor list, the purposes enabled, the consent retention and the EU location of the consent data.
Sample consent text
This website uses FlexCMP to manage your cookie choices. It stores strictly necessary cookies that remember your preferences and, when advertising is enabled, an IAB Transparency and Consent Framework string shared with the vendors we list. FlexCMP is operated from the European Union, so your consent data stays in the EU. No analytics or advertising cookie is set until you accept it, and you can change or withdraw your choice at any time from the cookie settings link.
Third-party domains contacted
flexcmp.comcdn.flexcmp.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| flexcmp | First party, persistent | 6 months | Stores the visitor consent state for each cookie category so the banner can apply and remember the choice. |
| euconsent-v2 | First party, persistent | 1 year | Holds the IAB TCF 2.2 consent string shared with the declared advertising vendors when the framework is enabled. |
| flexcmp_status | First party, persistent | 6 months | Records whether the banner has already been answered so it is not shown again unnecessarily. |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
FlexCMP stores your decision in a first party flexcmp cookie that holds the consent state, and when the IAB framework is enabled it also sets euconsent-v2 carrying the standard TCF consent string. These cookies record your preferences and a consent identifier, not your name, and are needed for the banner to remember your choice.
No. The cookies FlexCMP uses to run the banner are strictly necessary and exempt under article 5(3) of the ePrivacy Directive. FlexCMP is the tool that gathers consent for other trackers, so configure it so analytics and advertising stay blocked until the visitor opts in.
Operating the banner relies on the ePrivacy exemption for strictly necessary cookies, while the consent record relies on your accountability and consent obligations under GDPR articles 5(2) and 7. The trackers FlexCMP gates require consent under GDPR article 6(1)(a) and ePrivacy article 5(3).
FlexCMP is operated from the European Union, so the consent data it stores stays in the EU and does not depend on a third country transfer mechanism. International transfers, if any, come from the advertising or analytics vendors you enable through the TCF once consent is given, not from FlexCMP itself.
A standalone DPIA is rarely required for the CMP itself. A DPIA at the level of your overall advertising stack is recommended when you enable the IAB TCF with many vendors, since large scale behavioural advertising can be high risk under GDPR article 35.
Set every non essential purpose and vendor off by default, enable script blocking, make refusing as easy as accepting and expose a persistent link to reopen the preference centre. List the TCF vendors and purposes in your privacy policy and keep the consent log enabled.
Other European CMPs include Didomi, Axeptio, Usercentrics, Cookiebot, iubenda and the open source Klaro and Orejime. Like FlexCMP, several of them keep consent data in the EU and support the IAB TCF, so choose based on vendor coverage, languages and integration.
Re scan your site regularly, review the detected cookies and vendors, and publish the updated list in your cookie policy. Whenever you add a tag or an advertising vendor, update the FlexCMP configuration, confirm the blocking rule and refresh the policy before the change goes live.