Consent management platform (CMP) – a consent tool for cookies, GDPR and Google

Definition

A consent management platform (CMP) is a tool that shows the cookie banner, collects and documents the visitor's consent and passes the signals on to analytics and advertising tools – so that no tracking cookies are set without approval.

What is a consent management platform (CMP)?

A consent management platform (CMP) is a tool that manages visitors' choices about data collection on your website. It shows the cookie banner, collects and records their consent, and then tells your analytics and advertising tools what they are allowed to do. Until a visitor has given consent, the CMP blocks tracking cookies – and every choice is stored as a record in case a supervisory authority asks.

What does a CMP do in practice?

A CMP handles four basic tasks:

• Shows the consent banner and obtains an active choice – no pre-ticked boxes.
• Scans the website and categorises cookies and tracking scripts automatically.
• Stores and documents each visitor's choice with a timestamp – your evidence if you are audited.
• Passes the choice on to tools such as Google Tag Manager, GA4 and ad networks, so that no tracking is activated without approval.

CMPs and GDPR – the legal requirement

The GDPR governs how personal data may be handled; the EU ePrivacy Directive governs cookies and tracking in the visitor's browser. Together they require freely given, specific and informed consent from the visitor before any non-essential cookies are set. The GDPR does not formally require you to use a CMP as such – but in practice it is the only reasonable way to meet the requirement if your website uses tracking cookies, because documenting every visitor's choice by hand is not feasible. In Sweden, the Swedish Authority for Privacy Protection (IMY) has criticised Swedish companies whose cookie banners fall short of the requirements.

CMPs and Google – Consent Mode, Ads and GA4

This is where many Swedish websites go wrong: they fail to distinguish between advertisers and publishers. The distinction determines what you actually need:

• Advertisers (you run Google Ads or GA4 on EEA traffic): you need Google Consent Mode v2 implemented correctly. The CMP collects the consent and sends the signals. A Google-certified CMP is recommended but not a formal requirement – the signals just have to be sent correctly.
• Publishers (you show Google ads via AdSense or Ad Manager): since 16 January 2024, a Google-certified CMP that supports IAB TCF is required to show personalised ads to users in the EEA and the UK.

Source: Google AdSense Help.

IAB TCF – what it is

IAB TCF (Transparency and Consent Framework) is an industry-wide framework that lets a CMP communicate the visitor's consent to hundreds of ad networks in a standardised format known as a TC String. The current version is TCF v2.3, in force since March 2026. You mainly need TCF support if you are a publisher selling ad space – for most ordinary businesses, a CMP that supports Consent Mode is enough.

Do you need a CMP? Three cases

• Yes – if your website uses analytics tools such as GA4, Meta Pixel, ad networks or other tracking cookies. In that case you need a CMP, and the question is which one – not whether.
• Possibly not – if you replace GA4 with a cookieless analytics tool (for example Plausible or Umami) and have no other third-party tracking. The consent requirement for analytics then no longer applies, although you still need a privacy policy.
• No – if you only use strictly necessary first-party cookies (login, session) and no tracking at all.

Common CMP tools

Some established CMPs, in no particular order: Cookiebot (popular in the Nordics, strong GTM integration), Usercentrics, OneTrust (enterprise), CookieYes, Complianz (WordPress), Axeptio and Iubenda. If you build in Webflow, there is also Finsweet Cookie Consent, built specifically for the platform.