A CMP (Consent Management Platform) is the software layer that collects, records and relays cookie and data processing consent on websites. Its core functions are displaying the banner, offering choices per category, blocking scripts and keeping consent logs. In the IAB TCF ecosystem it is the official consent-collecting role, and Google requires a certified CMP for its advertising products in the EEA, the UK and Switzerland.
A CMP is the layer that manages the entire cookie consent process and does four essential jobs: it shows the banner that presents choices to the visitor, blocks non-essential scripts until consent arrives, records every decision with a timestamp and choice details, and relays the consent state to connected systems, such as Google Consent Mode signals or on-site scripts. The banner the visitor sees is only the visible face of the CMP; the real value lies in the blocking, logging and signaling infrastructure behind it.
In the programmatic advertising ecosystem, the CMP is a defined role: within the IAB TCF framework, the CMP is the party that collects consent, generates the TC String and passes it into the advertising chain, and platforms taking on this role must be registered with IAB Europe. The current version of the framework is v2.3. Google also requires publishers using its advertising products, such as AdSense and Ad Manager, for users in the European Economic Area, the UK and Switzerland to use a certified CMP; without a valid consent signal, personalized ad serving is restricted. When choosing a CMP, check legal and language coverage, real script blocking, exportable consent logs, Consent Mode and TCF integration and page speed impact, and remember that a CMP manages and simplifies the compliance process, while the accuracy of your cookie inventory and texts depends on your configuration.
Frequently asked questions
Is using a CMP mandatory?
The law does not mandate a piece of software called a 'CMP'; what it mandates is obtaining valid consent, blocking non-essential cookies until consent arrives and being able to prove the consent given. Because managing these duties by hand is impractical, a CMP is the established tool. Programmatic advertising is different: Google requires, as a policy matter, that publishers showing ads to users in the EEA, the UK and Switzerland use a certified CMP.
Are a CMP and a cookie banner the same thing?
No. The banner is the interface the visitor sees: text, buttons and the preference screen. The CMP is the management layer behind it: it blocks scripts until consent arrives, records every decision, relays the consent state to systems such as Google Consent Mode and, where needed, generates the TC String for the TCF. A setup that only shows a banner without blocking in the background collects consent in appearance but does not honor the choice in practice.
This content is for information only and is not legal advice.