What is a consent management platform (and when do you need one)

All posts

A consent management platform, or CMP, is the software that asks your visitors what data collection they allow and records each answer as proof. It then passes that choice to your analytics and advertising tags, so they collect only what was permitted. The cookie banner is the part visitors see; the CMP is the whole engine behind it.

What does a consent management platform do?

Most definitions stop at the first job and never mention the second, which is why so many teams buy a banner and wonder why their numbers still look wrong. A consent management platform does two things at the same time, and both matter.

The first job is compliance. The platform shows the banner and captures whether a visitor accepts or rejects. It blocks non essential tags until there is a lawful basis to fire them, and it writes every decision to an audit ready log you can produce if a regulator asks. This is the part every vendor glossary describes.

The second job is measurement. The same consent decision has to reach your analytics and advertising tags in a language they understand, or those tags either over collect and break the law or under collect and quietly lose data. A CMP wired to Consent Mode v2 translates each choice into the signals Google expects, so Google's tags know what each visitor chose. Under Advanced Consent Mode, a rejected visit can still send a cookieless ping instead of leaving no trace at all. Capture the choice, then carry it: a platform that only does the first half is a banner, not a CMP.

Is a cookie banner the same as a CMP?

It is worth being precise, because the two words get used as if they mean the same thing. The banner is the front end: the box a visitor sees, with an accept and a reject. The consent management platform is everything behind it. It categorises the cookies and tags on your site and stores each consent decision with a timestamp. It asks again when consent has expired, and it keeps the signal flowing to your measurement tools in the state the visitor chose.

A banner with no engine behind it collects a click and changes nothing. The tags fire the same way whether the visitor accepted or rejected, which is both a compliance risk and a measurement mess. When people say a CMP, this whole engine is what they mean, even if the only part they ever look at is the banner.

When do you actually need one?

The honest answer is that it depends on where your visitors are and what you collect, not on a scare number. A few clear signals tell you whether a CMP is genuinely required rather than nice to have.

1. You have EU or UK visitors and you run any tags

   If people in the EU or UK reach your site and you load analytics or advertising tags, you need a way to ask first and to prove what was chosen. Article 5(3) of the ePrivacy Directive requires consent before storing or reading anything on a visitor's device that is not strictly necessary. This is the most common trigger, and it applies even to a small site that only runs GA4.

2. You serve California or other US privacy states

   Several US states now give people the right to opt out of sale and sharing, and some require sites to honour a Global Privacy Control signal sent by the browser. You need something that can receive that signal and act on it, which a bare banner cannot do.

3. You depend on Google Ads or GA4 for decisions

   The moment your marketing spend is steered by conversion numbers, the measurement job stops being optional. Without consent wired to your tags the way Google expects, the sessions behind the banner drop out of your reports and you optimise against a distorted picture.

4. You run more than one site, or manage them for clients

   Consent quickly becomes a per domain tax, and per domain billing is one of the two shapes consent platforms actually price on. If you are an agency or a team with a portfolio, look for a platform that handles many sites from one place. Otherwise consent becomes a recurring chore on every property instead of a background utility.

If none of these apply, a purely local site with nothing beyond strictly necessary cookies may not need a CMP at all. The point is to decide from your regions and your tags, not from a vendor's fear copy; the same test tells you whether you need a cookie banner in the first place.

What does a CMP change in your analytics?

Vendor glossaries describe a CMP as a compliance tool and stop there. That framing hides the expensive half. When the consent update never reaches your tags, Google keeps every visitor at the denied default, and your GA4 and conversion numbers undercount without a single error showing up. With no consent state at all, the opposite happens: tags fire as if everyone accepted. How much traffic sits behind the banner varies with region, audience and banner design. Measure your own: read the accept rate in your CMP, or compare GA4 sessions with the requests your server or CDN logged over the same days. Whatever the share, a CMP that only does compliance leaves that slice of your measured traffic uncounted.

Done well, the measurement job gives Google a consent signal on every visit, including the rejected ones. That is what makes modelling possible, and it has limits. Modelling only fills part of the gap, and only when a property meets Google’s published eligibility thresholds. Below them nothing is modelled at all, and modelled data never reaches the BigQuery export or your audiences. An honest CMP definition names both what the signal makes possible and where it stops.

This is a large part of why Velo exists. It ships the banner, the default denied signals, the Consent Mode v2 wiring and the audit log as one configured layer. The compliance job and the measurement job stay in step instead of drifting apart. You get one place to see what every tag is actually being told, rather than a banner on the front and a guess about the rest. If you want to trace where the lost sessions go, the guide to conversions and consent walks through it end to end.

Your next step in website privacy.

Velo sets your consent defaults, passes the four signals to Google’s tags and keeps a record of every choice your visitors make.