What is a consent management platform (CMP)?

What a CMP does

A consent management platform handles the whole cookie-consent lifecycle so you do not have to build it yourself:

• Shows a consent banner that asks visitors which cookies they allow
• Blocks non-essential cookies and scripts until the visitor consents (prior consent)
• Lets visitors choose by category — necessary, preferences, statistics, marketing
• Records each choice as a consent log you can use as proof
• Signals consent to other tools via Google Consent Mode v2 and Global Privacy Control (GPC)
• Scans your site for cookies and lists them in a cookie declaration

Why websites use a CMP

A CMP is how most sites meet the EU GDPR, the ePrivacy Directive and laws like California's CCPA without hand-coding consent logic. It also keeps you aligned with ad-platform rules — Google, for example, expects EEA/UK traffic to pass a consent signal through Consent Mode v2.

Beyond compliance, a clear, honest consent experience builds visitor trust and avoids the dark patterns that regulators increasingly act against.

How a CMP works, step by step

• A visitor lands on your site and the CMP blocks non-essential cookies from loading.
• The CMP shows a consent banner with clear Accept and Reject options.
• The visitor makes a choice (all, none, or per category).
• The CMP records the choice and unblocks only the scripts the visitor allowed.
• It signals the consent state to Google Consent Mode v2 and honors GPC.
• The visitor can reopen the banner any time to change or withdraw consent.

What to look for in a CMP

• Prior-consent blocking — non-essential cookies must stay off until the visitor agrees
• An equally easy "Reject all" (required by the EDPB's Guidelines 05/2020)
• Granular, per-category choices and no pre-ticked boxes
• Consent records you can export as proof
• Google Consent Mode v2 and GPC support
• A cookie scanner, multiple languages, and a price that fits

CMP vs cookie banner vs tag manager

These three are often confused. A cookie banner is just the visible prompt — the box that asks visitors to accept or reject. A consent management platform is the whole system behind it: it shows the banner, but it also blocks non-essential cookies until consent, stores each choice as proof, signals consent to other tools, and usually scans your site for trackers.

A tag manager (such as Google Tag Manager) is a different tool again — it loads and organises your marketing and analytics tags. A tag manager does not, on its own, collect consent or block anything before consent; a CMP is what tells the tag manager which tags are allowed to fire. The two work together: the CMP captures the consent signal, and the tag manager — or the CMP’s own blocking — acts on it.

CMPs, IAB TCF and Google Consent Mode v2

Two standards shape how a CMP talks to the wider ad ecosystem. The IAB Europe Transparency & Consent Framework (TCF) is the industry standard for programmatic advertising: a registered, certified CMP encodes the visitor’s choices into a “TC string” that ad vendors read. If you serve programmatic IAB advertising, you generally need a registered CMP with an IAB CMP ID.

Google’s Consent Mode v2 is separate but just as important. Since 2024 Google has required EEA and UK traffic to pass a consent signal to Google Ads and Analytics, and to use a Google-certified CMP for AdSense and Ad Manager. A good CMP supports Consent Mode v2 out of the box, so your Google tools keep working compliantly.

KookiOk ships a TCF v2.2-compatible API and Google Consent Mode v2 with Global Privacy Control built in. For full programmatic serving as a registered IAB CMP you would register your own CMP ID; for most sites, Consent Mode v2 plus prior-consent blocking is exactly what you need.

KookiOk is a free CMP

KookiOk is a consent management platform you can use for free: a customizable banner, an automatic cookie scanner, prior-consent blocking, 5-year consent records, Google Consent Mode v2 and GPC — across unlimited sites and page-views, with no credit card.

Frequently asked questions