Conversant Consent Tool
Conversant Consent Tool is a JavaScript consent management platform operated by Conversant LLC, an Epsilon and Publicis Groupe company based in the United States. Registered with the IAB Transparency and Consent Framework v2.2 under CMP ID 24, it is mainly deployed on Conversant Media properties and partner publisher sites to collect cookie and advertising consent, relay TCF strings to ad vendors and emit Google Consent Mode v2 signals.
What does Conversant Consent Tool do?
What is the Conversant Consent Tool
The Conversant Consent Tool is a consent management platform (CMP) operated by Conversant LLC, an Epsilon and Publicis Groupe company headquartered in the United States. It is registered with the IAB Europe Transparency and Consent Framework v2.2 as CMP ID 24. The tool is deployed mainly on Conversant Media properties and partner publisher sites where Conversant supplies advertising inventory. Functionally it is a JavaScript banner that collects user consent for cookies and advertising vendors, stores a first party consent cookie, builds a TCF v2.2 consent string and relays Google Consent Mode v2 signals to gtag based tags.
How it works technically
The CMP loads from Conversant infrastructure (commonly tags.crwdcntrl.net and conversantmedia.com). On first visit the banner reads the IAB Global Vendor List, displays purposes and vendors, captures the user choice, writes a consent cookie and exposes the TCF API (__tcfapi) so downstream ad and analytics SDKs can read the consent string. It can also push default and update commands to Google Consent Mode v2. The proof of consent (timestamp, identifier, choices, TCF string version) is stored on Conversant servers in the United States.
Legal basis and consent
The CMP itself is consent infrastructure. Its operation does not require prior consent under Art 5(3) ePrivacy because the cookie used by the CMP is strictly necessary to provide a service explicitly requested by the user (recording the consent choice). The legal basis is Art 6(1)(c) GDPR to comply with the obligation to demonstrate consent under Art 7(1), and Art 6(1)(f) GDPR for fraud prevention and integrity of the banner. Consent is, however, required for every third party vendor that the CMP gates (advertising, audience, measurement).
International data transfers
Consent records and connection metadata (IP, user agent, timestamp) are transferred to Conversant infrastructure in the United States. Epsilon Data Management LLC, the parent group, is self certified under the EU US Data Privacy Framework, so transfers from the EEA rely on the DPF adequacy decision of 10 July 2023. Standard Contractual Clauses with a transfer impact assessment remain a fallback for jurisdictions not covered by DPF (notably Switzerland under the Swiss US DPF, and the United Kingdom under the UK Extension).
Risk assessment for publishers
The CMP itself is low risk: limited personal data, consent infrastructure role, recognised TCF v2.2 registration. The medium overall risk rating reflects the tight coupling with the Conversant advertising and Epsilon audience businesses. Publishers should ensure the CMP is not implicitly enabling Conversant audience tags without separate consent, that the vendor list is restricted to vendors actually used, and that the data processing addendum properly identifies Conversant as processor for the CMP function and as separate controller (or joint controller) for any advertising services activated on the same site.
Alternatives and migration
Conversant Consent Tool is a niche CMP tied to the Conversant ad ecosystem. Publishers seeking a vendor neutral CMP often consider Didomi (France), OneTrust (US), Cookiebot by Usercentrics (Denmark and Germany) or the open source Klaro. Migration paths usually involve exporting the existing vendor list, re collecting consent (TCF strings are not always portable between CMPs) and updating the cookie policy and DPA to reflect the new processor.
Conversant Consent Tool and the GDPR
- Legal basis
- Art 6(1)(c) GDPR for keeping proof of consent under Art 7(1); Art 6(1)(f) GDPR for security, fraud prevention and correct display of the banner. The CMP itself does not require consent, but the third party vendors it manages do.
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive 2002/58/EC, IAB TCF v2.2, EU US Data Privacy Framework, German TTDSG, French CNIL cookie guidelines, Spanish LSSI CE.
Impact assessment (DPIA)
A dedicated DPIA for the Conversant Consent Tool itself is generally not required under Art 35 GDPR because the CMP is consent infrastructure with limited personal data (a pseudonymous consent identifier, IP for geo, timestamp and TCF string). A DPIA is, however, strongly recommended for the underlying advertising stack that the CMP gates, especially when Conversant Media audience or measurement tags are used on the same site, given the systematic monitoring and US transfers involved. Document retention of consent proofs, the legal basis for the banner itself (Art 6(1)(c) and (f)), the Conversant role as processor for the CMP function, and any controller role for adjacent ad services.
Sample text for your banner
We use cookies and similar technologies on this site, including the Conversant Consent Tool, to remember your consent choices and to broadcast them to advertising vendors via the IAB Transparency and Consent Framework v2.2 and Google Consent Mode v2. The CMP itself stores a consent identifier, a timestamp and your preferences. You can review or withdraw your consent at any time from the cookie settings link in the footer.
What Conversant Consent Tool sets and contacts
- Tracking method
- JavaScript banner, IAB TCF v2.2 CMP (Conversant CMP ID 24), Google Consent Mode v2 signal relay, first party consent cookie, integration with the Conversant ad stack and Epsilon audience platform.
- Server location
- United States (Conversant / Epsilon infrastructure on AWS, primarily us-east regions).
- Cookieless mode available
- Yes
- Data transferred outside the EU
- Consent signals and proof of consent are stored on Conversant infrastructure in the United States. Transfers from the EEA, UK and Switzerland rely on the EU US Data Privacy Framework (Epsilon Data Management LLC is DPF certified) or Standard Contractual Clauses where DPF is unavailable.
Cookies set (3)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| conversant_consent | functional | 1 year | Stores user consent choices |
| _lr_geo | functional | 30 days | Geo targeted policy lookup |
| conversant_session | functional | session | Banner session and display logic |
Third-party domains contacted (3)
tags.crwdcntrl.netconversantmedia.comcdn.conversantmedia.com
Frequently asked questions about Conversant Consent Tool
Can't find your question? Write to us, we answer fast.
Which cookies does the Conversant Consent Tool set?
The CMP itself sets a small number of functional first party cookies: conversant_consent stores the consent choices and TCF string for around one year, _lr_geo holds the coarse geographic region used to determine the applicable policy for about 30 days, and conversant_session is a session cookie used for banner display logic. These are strictly necessary cookies for the consent function and do not themselves require prior consent.
Do I need user consent to load the Conversant Consent Tool itself?
No. The CMP banner is consent infrastructure and falls under the strictly necessary exception of Art 5(3) ePrivacy because the cookie used is essential to remember the user choice. You do, however, need valid consent before the CMP authorises any non essential vendor (advertising, analytics, audience). The Conversant Consent Tool ships with TCF v2.2 to collect that downstream consent in a standardised way.
What is the legal basis of the CMP processing?
Two grounds apply. Art 6(1)(c) GDPR (legal obligation) covers the recording and retention of proof of consent, which is mandated by Art 7(1) GDPR. Art 6(1)(f) GDPR (legitimate interest) covers fraud prevention, security and correct rendering of the banner across devices. The CMP is not based on consent itself, which is consistent with EDPB guidance on consent banners.
Are data transferred outside the EEA?
Yes. Consent records, pseudonymous identifiers and connection metadata are stored on Conversant infrastructure in the United States. Epsilon Data Management LLC is self certified under the EU US Data Privacy Framework, so transfers from the EEA primarily rely on the DPF. Standard Contractual Clauses with a transfer impact assessment cover the UK (UK Extension) and Switzerland (Swiss US DPF) and serve as fallback if DPF certification lapses.
Is a DPIA required for the Conversant Consent Tool?
A standalone DPIA is generally not required for the CMP function. The processing volume is limited, data are pseudonymous and the purpose is to enable users to exercise rights. A DPIA is, however, advisable when the CMP is deployed alongside Conversant Media advertising or audience tags, since the broader ad operation involves systematic monitoring and US transfers. Many supervisory authorities consider that combination triggers Art 35(3)(c) GDPR.
How is the Conversant Consent Tool implemented on a site?
Implementation is typically a script tag pointing to tags.crwdcntrl.net or conversantmedia.com, parameterised with the site identifier. The script registers __tcfapi for TCF v2.2 vendor signalling and a gtag based listener for Google Consent Mode v2 default and update commands. Conversant maintains the CMP ID 24 registration with IAB Europe, including the required CMP API surface and audit trail.
What are the main alternatives to the Conversant Consent Tool?
For publishers outside the Conversant ad ecosystem, the most common vendor neutral CMPs are Didomi (France), OneTrust (United States), Cookiebot by Usercentrics (Denmark and Germany) and the open source Klaro. All of them are IAB TCF v2.2 registered and support Google Consent Mode v2. Choice usually depends on vendor list management, server side capabilities and pricing.
How often should the cookie policy be updated when using this CMP?
Review the cookie policy at least every 12 months and whenever the vendor list, purposes or data flows change. The Conversant Consent Tool exposes the current vendor and purpose configuration in the preference centre, which should be cross referenced with the cookie policy. Document any change in a versioned log together with the corresponding TCF string version, so that proof of consent remains demonstrable.
Segment Consent Manager
Segment Consent Manager is a consent management platform (CMP) that helps websites comply with GDPR, CCPA, and global privacy regulations. It provides customizable cookie consent banners, preference centers, and automated compliance scanning. Segment Consent Manager manages user consent across tracking technologies, generates compliance reports, and integrates with tag management systems. With geo-targeted policies and TCF 2.0 support, Segment Consent Manager ensures worldwide privacy compliance.
Cookie Script
Cookie Script is a consent management platform (CMP) that helps websites comply with GDPR, CCPA, and global privacy regulations. It provides customizable cookie consent banners, preference centers, and automated compliance scanning. Cookie Script manages user consent across tracking technologies, generates compliance reports, and integrates with tag management systems. With geo-targeted policies and TCF 2.0 support, Cookie Script ensures worldwide privacy compliance.
Tealium Consent Management
Tealium Consent Management is a consent management platform (CMP) that helps websites comply with GDPR, CCPA, and global privacy regulations. It provides customizable cookie consent banners, preference centers, and automated compliance scanning. Tealium Consent Management manages user consent across tracking technologies, generates compliance reports, and integrates with tag management systems. With geo-targeted policies and TCF 2.0 support, Tealium Consent Management ensures worldwide privacy compliance.
Shopify Consent Management
Shopify Consent Management is a consent management platform (CMP) that helps websites comply with GDPR, CCPA, and global privacy regulations. It provides customizable cookie consent banners, preference centers, and automated compliance scanning. Shopify Consent Management manages user consent across tracking technologies, generates compliance reports, and integrates with tag management systems. With geo-targeted policies and TCF 2.0 support, Shopify Consent Management ensures worldwide privacy compliance.
VeraSafe
VeraSafe is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. VeraSafe integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, VeraSafe helps organizations maintain robust websites that meet user expectations and technical requirements.
Securiti
Securiti is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Securiti integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Securiti makes advanced AI accessible to all teams.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.