EU Privacy Law EU/EEA and global

Consent Management Platforms: Selection, Configuration, and Audit Guide

How to choose and configure a CMP that produces legally valid consent: blocking behavior, TCF considerations, consent records, and the audit checklist.

Regulation

GDPR Articles 4(11) and 7; ePrivacy Directive Article 5(3)

Max Penalty

EUR 20 million or 4% of global annual turnover under GDPR

Enforcing Authority

National data protection authorities

Official Source

eur-lex.europa.eu

Executive Summary

  • A CMP is the tooling layer; the legal validity of the consent it collects depends entirely on configuration, and default configurations frequently fail.
  • The core technical requirement is real blocking: no non-essential tag may execute before consent, which requires integrating the CMP with the tag manager, not just displaying a banner.
  • The Belgian DPA's 2022 decision against IAB Europe found TCF consent strings themselves are personal data and the framework had validity defects; TCF v2.2 responded to that ruling.
  • Consent records (who saw what, chose what, when) are the evidence Article 7(1) requires you to hold.
  • CMPs drift: tags added outside the platform silently restore pre-consent tracking, so scheduled re-verification is part of the control.

A consent management platform sits between your visitors and your trackers, collecting choices and gating execution. The market offers dozens of options, but the compliance outcome is decided less by which CMP you buy than by how you wire it in. Regulators have fined companies running well-known CMPs, because a banner that displays correctly while tags fire underneath collects invalid consent at industrial scale.

Rule sourceGDPR Arts. 4(11), 7; ePrivacy Art. 5(3)
Max penaltyEUR 20M or 4% of global annual turnover
Key industry standardIAB TCF v2.2
Official textEUR-Lex CELEX 32016R0679

Selection criteria that matter

Evaluate candidates against the requirements the law actually imposes:

  1. Blocking architecture. The CMP must prevent tag execution before consent, via tag manager integration, script rewriting, or both. Ask vendors specifically how they block hard-coded scripts, which banner-only products miss.
  2. First-layer reject. The product must support Accept and Reject with equal prominence out of the box, since that is the enforcement standard in France, Spain, and Italy.
  3. Consent records and export. Article 7(1) makes you prove consent. The platform needs per-event records and an export path.
  4. Geo-targeting. Different rules per region: opt-in for the EU/UK, opt-out signals like GPC for US states, LGPD for Brazil. One banner logic per regime.
  5. TCF and Consent Mode support. Mandatory in practice if you run programmatic advertising or Google’s ad stack in the EEA.
  6. Signal integrations. Honoring Global Privacy Control matters for US state law compliance and is increasingly expected in Europe.

Configuration is where compliance lives

The recurring audit findings are configuration errors, not product defects: the CMP set to “notice only” mode for EU visitors, tags loaded directly in the page bypassing the CMP’s blocking, purposes pre-toggled on, vendor lists that have not been synchronized in a year, and consent state not propagated to server-side tagging. Each produces invalid consent while the banner looks perfect.

The Belgian DPA’s IAB Europe decision (2022) added a structural lesson: the TC string, the consent signal itself, is personal data, and the framework transmitting it needed redesign. TCF v2.2 is the response. If your stack predates it, your CMP configuration needs updating.

Verify, then keep verifying

Treat the CMP like any security control: test it adversarially. Load your site fresh, reject everything, and watch the network tab; then accept and compare. Repeat by region if you geo-target. Then schedule it, because drift is the norm: every new marketing tag is a chance to reintroduce pre-consent firing. A free scan automates the pre-consent check and identifies every third party receiving data. Pair this guide with GDPR consent requirements for the legal standard your configuration must meet.

Frequently Asked Questions

Does using a CMP make my site GDPR compliant?

No. A CMP is a tool for collecting and storing consent. If it is configured to fire tags before consent, hide the reject option, or misdescribe vendors, it collects invalid consent at scale. Configuration and verification decide compliance.

What is the IAB Transparency and Consent Framework?

An ad-industry standard (currently TCF v2.2) for transmitting consent signals to advertising vendors. The Belgian DPA found the earlier version had GDPR defects in 2022, and v2.2 tightened vendor disclosures and removed legitimate-interest for advertising purposes. If you run programmatic ads, your CMP likely needs TCF support.

What is Google Consent Mode and do I need it?

A Google mechanism where your CMP signals consent state to Google tags, which adjust behavior accordingly. Since 2024, Google requires Consent Mode v2 signals for advertising features aimed at EEA users, so sites using Google Ads or Analytics generally need their CMP to send it.

How should consent records be stored?

Per event: a timestamp, the banner text and version shown, the granular choices, and a pseudonymous identifier. Retain them as long as you rely on the consent plus a proof window. Exports must be available for regulator requests.

How often should we audit the CMP?

After every tag or vendor change, and on a schedule (quarterly is common). The failure pattern is drift: marketing adds a pixel outside the CMP and pre-consent firing quietly returns. Automated scanning catches this faster than manual checks.

Regulatory Crosswalk

IAB TCF v2.2Google Consent ModeUS state opt-out signals

Organizations subject to this regulation often operate under these overlapping frameworks. BD Emerson maps controls across frameworks to reduce duplicated compliance effort.

Evaluate your compliance posture now

BD Emerson's automated scanner audits your public-facing properties against your applicable regulations in minutes, not weeks.