What is a consent management platform (and when do you need one)

The two jobs a CMP does at once

Most definitions stop at the first job and never mention the second, which is why so many teams buy a banner and wonder why their numbers still look wrong. A consent management platform does two things at the same time, and both matter.

The first job is compliance. The platform shows the banner, captures whether a visitor accepts or rejects, blocks non essential tags until there is a lawful basis to fire them, and writes every decision to an audit ready log you can produce if a regulator asks. This is the part every vendor glossary describes.

The second job is measurement, and it is the one that pays for itself. The same consent decision has to reach your analytics and advertising tags in a language they understand, or those tags either over collect and break the law or under collect and quietly lose data. A CMP wired to Consent Mode v2 translates each choice into the signals Google expects, so a rejected visitor still leaves a lawful, cookieless trace instead of vanishing from your reports entirely. Capture the choice, then carry it: a platform that only does the first half is a banner, not a CMP.

The banner is not the platform

It is worth being precise, because the two words get used as if they mean the same thing. The banner is the front end: the box a visitor sees, with an accept and a reject. The consent management platform is everything behind it. It categorises the cookies and tags on your site, stores each consent decision with a timestamp, re shows the choice when the law says consent has expired, and keeps the signal flowing to your measurement tools in the state the visitor chose.

A banner with no engine behind it collects a click and changes nothing. The tags fire the same way whether the visitor accepted or rejected, which is both a compliance risk and a measurement mess. When people say a CMP, this whole engine is what they mean, even if the only part they ever look at is the banner.

When do you actually need one

The honest answer is that it depends on where your visitors are and what you collect, not on a scare number. A few clear signals tell you whether a CMP is genuinely required rather than nice to have.

1. You have EU or UK visitors and you run any tags

   If people in the EU or UK reach your site and you load analytics or advertising tags, consent law effectively requires a way to ask first and to prove what was chosen. This is the most common trigger, and it applies even to a small site that only runs GA4.

2. You serve California or other US privacy states

   Several US states now give people the right to opt out of sale and sharing, and to send a Global Privacy Control signal your site must honour. You need something that can receive that signal and act on it, which a bare banner cannot do.

3. You depend on Google Ads or GA4 for decisions

   The moment your marketing spend is steered by conversion numbers, the measurement job stops being optional. Without consent wired to your tags the way Google expects, a large share of sessions drops out of your reports and you optimise against a distorted picture.

4. You run more than one site, or manage them for clients

   Consent quickly becomes a per domain tax. If you are an agency or a team with a portfolio, a platform that handles many sites from one place is the difference between consent being a background utility and a recurring chore on every property.

If none of these apply, a purely local site with nothing beyond strictly necessary cookies may not need a CMP at all. The point is to decide from your regions and your tags, not from a vendor's fear copy.

The part most definitions leave out

Vendor glossaries describe a CMP as a compliance tool and stop there. That framing hides the expensive half. When consent is not passed to your tags correctly, Google treats every visitor as if they declined, and your GA4 and conversion numbers undercount without a single error showing up. On a typical site around a third of sessions sit behind the banner, so a CMP that only does compliance still leaves a large slice of your measured traffic uncounted.

Done well, the measurement job recovers a meaningful part of that. Across Amplio Data client implementations, wiring consent the way Google expects typically recovers 20 to 40% of the conversions consent was costing, as a measured range rather than a guarantee. Recovery depends on your traffic mix, your regions and how your tags are configured, and some data does stay gone: modelling only fills part of the gap, and below Google's unpublished volume threshold none of it is modelled at all. An honest CMP definition names both the recovery and the floor.

This is a large part of why Velo exists. It ships the banner, the default denied signals, the Consent Mode v2 wiring and the audit log as one configured layer, so the compliance job and the measurement job stay in step instead of drifting apart. You get one place to see what every tag is actually being told, rather than a banner on the front and a guess about the rest. If you want to trace where the lost sessions go, the conversion recovery guide walks through it end to end.

Common questions