A Consent Management Platform, or CMP, is the software that asks a website's visitors for permission to use cookies and their personal data, records each answer as proof, and passes it on to the tags and tools that depend on it. In practice it is the banner, the preference screen behind it, the log of who agreed to what, and the signals other tools read. A CMP collects and broadcasts consent, it does not enforce it: whether a tag actually stops firing after a refusal depends on how the site is wired to those signals.
Why it matters for agencies
For an agency the CMP sits upstream of every number the client sees. Its design decides how many visitors agree, and its categories decide which consent signals reach the ad platforms, so two identical setups can report different volumes for reasons unrelated to the campaigns. It is also where agencies get handed a rule that does not apply to them: a Google-certified CMP integrated with the IAB Transparency and Consent Framework is required for partners using Google's publisher products, AdSense, Ad Manager and AdMob, to serve personalized ads in the EEA and the UK since 16 January 2024. On the advertiser side, Google's documentation allows "a consent banner or other custom consent solution" instead.
What teams get wrong
The most expensive misunderstanding is that installing a CMP makes a site respect consent. A CMP records and broadcasts a choice, something else has to act on it. Tags managed in Google Tag Manager can be held back, but a pixel pasted into the theme, a widget loaded by a plugin, or a tag firing on a server know nothing about the banner and carry on unchanged. Nothing errors: the banner renders, the accept rate looks healthy, and the refusals were never honoured.
Two more are worth naming. The certification badge is read as an audit of the setup, while Google states it "does not check CMPs for full compliance with the TCF or applicable privacy laws". And the scan report is filed as the compliance record, although the EDPB's cookie banner taskforce noted that the available tools "do not allow to check the nature of the cookies but only to list the cookies placed", leaving the site owner to demonstrate which are essential. At Archon Labs the wiring between the CMP and the tags is what we check first, the banner is rarely the problem.
