CMP

A consent management platform (CMP) is software that shows a site's or app's privacy choices, records what each user picks, and passes those choices to vendors as signals such as a TCF or GPP string.

The CMP sits between the user and every tag on the page. It shows the banner and the more detailed settings, stores the choice, usually in a cookie or local storage, and exposes it through a standard API so other scripts can read it. In the IAB Europe Transparency and Consent Framework (TCF), CMPs register with IAB Europe, receive a CMP ID and write the TC String (IAB Europe, accessed 9 November 2026). For US states, CMPs write GPP sections.

Ad platforms set their own rules. Google requires publishers that use AdSense, Ad Manager or AdMob to use a Google-certified CMP integrated with the TCF when they serve personalised ads. The rule has applied in the EEA and the UK since 16 January 2024, and in Switzerland since 31 July 2024 (Google AdSense Help, accessed 9 November 2026).

The CMP's design also affects whether consent is valid in law. Under GDPR Article 7(3), withdrawing consent must be as easy as giving it (GDPR, EUR-Lex), so a hidden "reject" button is a legal risk, not only a design choice.

Example: A German publisher installs a certified CMP. When a reader rejects personalised ads, the CMP writes a TC String without consent for purposes 3 and 4. The publisher's SSP passes the string in the bid request, and DSPs can bid only with contextual targeting.

Related terms: TCF, consent string, GPP, consent mode, legitimate interest.

Authoritative source: IAB Europe, "Transparency and Consent Framework" (TCF v2.3; accessed 9 November 2026).