What is a Consent Management Platform (and what it is not)
A CMP is not a cookie banner. It is the system of record for what every person agreed to, when, and on what basis — and the difference shows up the moment a regulator asks.
Ask ten teams what a Consent Management Platform does and you will get ten answers about banners. The banner is the visible one percent. What actually determines whether your consent programme holds up is everything behind it: how choices are recorded, how they propagate, and whether you can reconstruct any single person’s consent state on a given date two years later.
The banner is an interface, not the product
A cookie banner collects an answer. A CMP is responsible for what happens to that answer for the rest of its life. Those are different problems, and conflating them is how organisations end up with a compliant-looking website and a non-compliant data estate.
- The banner asks the question and blocks or releases scripts accordingly.
- The consent record stores the answer with its context — purposes, legal basis, jurisdiction, banner version, timestamp.
- The synchronisation layer pushes that answer to every downstream system that acts on personal data.
- The evidence layer makes all of the above reproducible on demand.
The common failure
A visitor opts out of marketing on the website. The banner honours it. The CRM never hears about it, and the nightly campaign job sends the email anyway. Nothing about the banner was wrong — the system of record simply stopped at the browser.
What a real CMP is accountable for
Strip away the vendor language and a CMP has five jobs. If a platform cannot do all five, it is a banner tool with a dashboard attached.
| Job | What it means in practice |
|---|---|
| Discover | Continuously scan properties for cookies, pixels and SDKs — including the ones a marketing team added last Tuesday without telling anyone. |
| Ask | Present the right question, in the right language, under the right legal basis for the visitor’s jurisdiction. |
| Enforce | Prevent non-consented technologies from executing, rather than firing them and hoping nobody checks. |
| Propagate | Carry the choice into CRM, CDP, analytics, marketing automation and support tooling in near real time. |
| Prove | Produce a timestamped, immutable record of the choice and the exact experience that produced it. |
Why “prove” is the one that catches people out
Under GDPR Article 7(1), the controller must be able to demonstrate that the data subject consented. Demonstrate is a higher bar than store. A row in a database saying marketing = true is not a demonstration; it is an assertion. What makes it evidence is the surrounding context: which banner version was shown, what text it contained, which purposes were pre-selected, and what the visitor actually clicked.
If you cannot reproduce the screen the person saw, you cannot prove what they agreed to.
— The practical test for any consent record
This is why banner versioning matters. When you change your consent copy or add a new purpose, previously collected consent may no longer cover the new processing. A CMP that versions its experiences can tell you exactly which population needs to be re-asked. One that does not will force you to re-ask everyone — and you will lose consent rates you did not need to lose.
Consent is not the same as preference
Consent is a legal basis for a specific processing purpose. A preference is what someone would like — channel, frequency, topic. They travel together but they are governed differently, and collapsing them into one flag causes real damage.
- Withdrawing consent must stop the processing. Changing a preference should not automatically be treated as a withdrawal.
- Consent needs a legal basis and an audit trail. A preference needs a last-write-wins value and a sync target.
- Consent is jurisdiction-sensitive. A preference usually is not.
A platform that models both separately — and can still show a person one unified view of their choices — is what turns a compliance obligation into something users actually trust.
How to evaluate one
Skip the feature grid. Ask four questions and watch how quickly they can answer:
- 1Show me every consent event for one identity across every system, on one screen.
- 2Show me the exact banner a specific visitor saw on a specific date.
- 3A new tracker appeared on our checkout page yesterday. When would we have found out?
- 4Someone withdrew consent five minutes ago. Which systems know, and which do not yet?
Try it yourself
Our Cookie Banner Playground lets you configure a banner across regulations, layouts and consent granularity, and see exactly what a visitor in each jurisdiction would be shown.
Open the playgroundFrequently asked questions
What is a Consent Management Platform?
Is a cookie banner the same thing as a CMP?
Does GDPR require you to use a CMP?
What is the difference between consent and a preference?
Last updated .