What is a consent management platform (CMP), and do you need one?

A consent management platform, or CMP, is the system that asks visitors for consent, records their answer, and makes sure your trackers actually respect it. If you have a website that serves users in the EU, the UK, or an increasing number of U.S. states, you have probably been told you need one. This post explains what a CMP does, the parts it is made of, and how to tell whether you need one.

What a CMP does

At its core, a CMP handles three jobs. It shows a consent banner that explains what trackers are present and asks for the visitor's choice. It stores that choice and applies it, blocking or releasing third-party scripts based on what the visitor agreed to. And it keeps a record so you can prove, later, what each visitor consented to.

The parts of a CMP

Do you need one?

If your site uses non-essential storage or access for EU or UK visitors, ePrivacy rules commonly require prior consent, separately from GDPR lawful-basis analysis. US state requirements depend on whether the law applies and may focus on notices and sale, sharing, targeted-advertising, or other opt-outs. The threshold is whether you place or read non-essential information on a visitor's device, and under the ePrivacy Directive that covers far more than classic cookies.

• You run Google Analytics 4 or Google Ads and have EU or UK traffic.
• You embed third-party widgets like YouTube, maps, or chat that set trackers.
• You qualify as a business under the CCPA/CPRA and need a do-not-sell-or-share path.
• You need exportable consent records for audits or customer trust.

The fixed consent categories

Most CMPs group trackers into a small set of fixed categories so visitors can choose at a meaningful level of detail without reading a wall of vendor names. The common four are necessary (always on), analytics, marketing, and preferences.

How to choose a CMP

• Pick one that enforces the choice, not just records it. Blocking by category is the whole point.
• Make sure it supports Google Consent Mode v2 and signals like GPC.
• Check it works with your stack, whether that is a script tag, a builder, or a framework.
• Confirm it exports consent records for audit and reporting.

A CMP is the connective tissue between what the law requires and what your website actually does. The banner asks, enforcement acts, and records prove. Get all three working together and consent stops being a checkbox and becomes something your visitors can trust.

Materially reviewed July 11, 2026. Regulatory and implementation guidance is general information, not legal advice.