A consent management platform sits between your visitors and your trackers, collecting choices and gating execution. The market offers dozens of options, but the compliance outcome is decided less by which CMP you buy than by how you wire it in. Regulators have fined companies running well-known CMPs, because a banner that displays correctly while tags fire underneath collects invalid consent at industrial scale.
| Rule source | GDPR Arts. 4(11), 7; ePrivacy Art. 5(3) |
|---|---|
| Max penalty | EUR 20M or 4% of global annual turnover |
| Key industry standard | IAB TCF v2.2 |
| Official text | EUR-Lex CELEX 32016R0679 |
Selection criteria that matter
Evaluate candidates against the requirements the law actually imposes:
- Blocking architecture. The CMP must prevent tag execution before consent, via tag manager integration, script rewriting, or both. Ask vendors specifically how they block hard-coded scripts, which banner-only products miss.
- First-layer reject. The product must support Accept and Reject with equal prominence out of the box, since that is the enforcement standard in France, Spain, and Italy.
- Consent records and export. Article 7(1) makes you prove consent. The platform needs per-event records and an export path.
- Geo-targeting. Different rules per region: opt-in for the EU/UK, opt-out signals like GPC for US states, LGPD for Brazil. One banner logic per regime.
- TCF and Consent Mode support. Mandatory in practice if you run programmatic advertising or Google’s ad stack in the EEA.
- Signal integrations. Honoring Global Privacy Control matters for US state law compliance and is increasingly expected in Europe.
Configuration is where compliance lives
The recurring audit findings are configuration errors, not product defects: the CMP set to “notice only” mode for EU visitors, tags loaded directly in the page bypassing the CMP’s blocking, purposes pre-toggled on, vendor lists that have not been synchronized in a year, and consent state not propagated to server-side tagging. Each produces invalid consent while the banner looks perfect.
The Belgian DPA’s IAB Europe decision (2022) added a structural lesson: the TC string, the consent signal itself, is personal data, and the framework transmitting it needed redesign. TCF v2.2 is the response. If your stack predates it, your CMP configuration needs updating.
Verify, then keep verifying
Treat the CMP like any security control: test it adversarially. Load your site fresh, reject everything, and watch the network tab; then accept and compare. Repeat by region if you geo-target. Then schedule it, because drift is the norm: every new marketing tag is a chance to reintroduce pre-consent firing. A free scan automates the pre-consent check and identifies every third party receiving data. Pair this guide with GDPR consent requirements for the legal standard your configuration must meet.