A consent management platform is the software that asks a website or app visitor whether their data may be used for advertising and analytics, records the answer, and transmits that answer to every other system in the chain that needs it. The industry shortens it to CMP. The banner is the visible part, and the smaller one. Behind it sits the machinery that blocks scripts until permission arrives, encodes the decision into a format other companies can read, stores evidence that the decision was made, and resurfaces the choice when someone wants to change it. CMPs exist because European law treats consent as a precondition for most tracking, and because an ad request that resolves in under 200 milliseconds cannot pause to ask a lawyer.

Two legal instruments create the demand. Article 5(3) of the ePrivacy Directive, amended in 2009, requires consent before storing or reading information on a device, which covers cookies and most device identifiers. The General Data Protection Regulation, applicable since 25 May 2018, then governs whether the resulting processing is lawful, defines consent in Article 4(11) as freely given, specific, informed and unambiguous, and requires under Article 7(3) that withdrawal be as easy as granting.

How a CMP works

Deployment begins with a stub script loaded ahead of every other tag. Until a decision exists, the CMP holds back categorised scripts, which is the part publishers most often get wrong: a banner that collects choices but never blocks anything satisfies nobody.

Inside IAB Europe's Transparency and Consent Framework, the dominant standard in the European Economic Area, the CMP registers with IAB Europe and receives a numeric CMP ID. A valid non-zero ID is mandatory, and organisations that heavily customise a vendor's interface must register their own. The platform exposes a JavaScript function named __tcfapi on the page. Vendor scripts call it with commands including ping, getTCData and addEventListener. The event status returned tells the caller where the user stands: cmpuishown while the interface is displayed, useractioncomplete immediately after a choice, tcloaded when a stored decision was retrieved without showing anything. Advertising creatives running inside iframes reach the same API through a postMessage bridge to a frame named __tcfapiLocator.

The output is the TC String, a base64-encoded record. Its mandatory core segment carries the specification version, creation and last-updated timestamps in epoch format rounded to a full day, the CMP ID and CMP version, consent and legitimate interest bits for each purpose, vendor consent expressed as a bitfield or as ranges, and publisher restrictions that can force consent where a vendor registered flexibly. Optional segments for disclosed vendors and for publisher-specific legal bases are appended after the core using a dot delimiter.

Purposes are numbered. The Global Vendor List, republished weekly, defines eleven of them, from storing information on a device through to measuring content performance, alongside special purposes, features and special features. Each participating company holds a vendor ID: Google Advertising Products is 755, Amazon Ads is 793. Vendors register the purposes they pursue and the legal basis claimed for each.

Transport into the auction happens through OpenRTB. Under version 2.5 the applicability flag travelled as regs.ext.gdpr and the string as user.ext.consent. OpenRTB 2.6 promoted both to first-class fields, regs.gdpr and user.consent. The IAB Tech Lab's Global Privacy Platform moves through regs.gpp with an array of section identifiers in regs.gpp_sid, and Prebid Server unpacks that container back into the original locations. Google adds a proprietary layer: its Additional Consent specification carries permission for companies on its Ad Technology Providers list that never registered on the Global Vendor List, which as of April 2026 included AppLovin, Meta, Roku, Unity and Cloudflare among 199 providers. A CMP implementing only the standard string may pass nothing to them.

Origin and evolution

The category was created by a deadline. IAB Europe launched the Transparency and Consent Framework on 25 April 2018, one month before GDPR became applicable, after work involving more than 70 member companies that began in February 2017. Version 2.0 went to public comment in April 2019 and launched that August. Version 2.1 followed in August 2020, aligning the framework with the Court of Justice ruling in Planet49, which held that pre-ticked boxes cannot constitute consent.

Version 2.2, released on 16 May 2023 with a final implementation deadline of 20 November 2023, was the consent-quality release. Legitimate interest was withdrawn as a legal basis for purposes 3 to 6, the profiling and personalisation purposes, leaving consent as the only option. Purpose names were rewritten, retention periods were added, a new purpose 11 appeared, and the first layer of the interface was required to state how many third-party vendors were seeking permission. IAB Europe shipped a CMP Validator browser extension to test live installations.

Google turned the framework into a revenue gate. From 16 January 2024, publishers serving Google ads in the EEA and the United Kingdom needed a Google-certified CMP, a requirement Usercentrics announced meeting that same month. Enforcement for search products began on 1 February 2024 and extended to Switzerland from 31 July 2024. New diagnostic codes appeared in the TCF error report that September.

Version 2.3, released on 19 June 2025, resolved vendor disclosure ambiguity by making the disclosed vendors segment mandatory. Google set the migration deadline at 28 February 2026, and confirmed enforcement on 2 March 2026, adding error code 1.4 for missing segments. Strings without a properly formatted disclosed vendors segment now trigger limited ads or a dropped request.

The market

At the end of 2025, IAB Europe counted 181 registered CMPs and 953 vendors inside the framework, with enforcement procedures against vendors rising 118 per cent to 587 during the year. The commercial tier is concentrated. Munich-based Usercentrics passed 100 million euros in annual recurring revenue on 15 October 2025, reporting more than seven billion consents processed monthly across over two million properties. Didomi raised 40 million dollars in 2021. LiveRamp bought the Dutch vendor Faktor and relaunched it as Privacy Manager. OneTrust, Sourcepoint, iubenda, Cookiebot and Osano occupy adjacent ground. Google, which recommended five external tools in 2018 while its own remained in beta, now ships a CMP that supports Consent Mode and syncs consent for AdMob apps.

Why it matters for the marketing community

Roughly 40 to 50 billion euros in annual European programmatic revenue flows through signals gathered under the framework. A misconfigured CMP is therefore a revenue event before it is a legal one. PPC Land documented an account whose Google Ads conversions collapsed 90 per cent after July 2025 enforcement, because the banner was capturing choices without transmitting them.

Signal quality is drifting too. Usercentrics research published in 2026 found 48 per cent of consumers accepting cookies less often than three years earlier, and a 31-point gap in accept-all rates between privacy-aware and privacy-unaware respondents.

Limitations and disputes

Academic measurement has been unkind. Nouwens and colleagues, publishing at CHI 2020, scraped the five most common CMPs across 680 of the top 10,000 UK sites and found only 11.8 per cent met minimal legal requirements. Matte, Bielova and Santos, presenting at IEEE Security and Privacy the same year, found 12.3 per cent of 1,426 framework sites emitting a consent signal before any user choice, and at least one violation on 54 per cent of 560 manually reviewed sites.

Regulators reached similar conclusions. Belgium's data protection authority ruled on 2 February 2022 that the framework breached Article 6 of the GDPR and fined IAB Europe 250,000 euros. The Belgian Market Court narrowed that in May 2025, confining joint controllership to TC String processing, then annulled the regulator's validation of the remediation plan on 7 January 2026. Interface design has drawn separate enforcement: CNIL issued formal notices over dark patterns in December 2024 and later fined the publisher of vanityfair.fr 750,000 euros.

Certification is not compliance. A webXray audit of 7,634 sites in March 2026 found all eleven Google-certified CMPs tested failed to block Google cookies after a Global Privacy Control opt-out. And the underlying premise is contested: noyb argues current banner design produces consent rates of up to 90 per cent while only 3 to 10 per cent of users actually want tracking, a gap it has attacked through hundreds of coordinated complaints.

Not the same as

Consent Mode is Google's proprietary API for relaying granted or denied states to Google tags. A CMP usually sets it, but the two are configured separately.

The Transparency and Consent Framework is policy and specification. A CMP is software implementing it. Registration in the framework and certification by Google are also distinct approvals.

The Global Privacy Platform is a transport container carrying encoded strings between vendors. Global Privacy Control is a browser signal originating a preference. CMPs read and forward both rather than producing them.

Preference centres and customer data platforms manage marketing permissions and profiles after collection, without the device-storage gating a CMP performs.

Recent developments

IAB Europe and IAB Tech Lab opened a public comment period on 29 May 2026, running to 29 June, on amendments advancing TCF policy to version 5.0.b and the specification to v2.4, covering multi-device consent persistence, CMP interface requirements and a renamed special feature on fingerprinting.

The legislative picture darkened for anyone hoping banners would disappear. On 18 June 2026 the Council of the European Union removed Article 88b, the automated browser-level consent signal, from its ePrivacy position. Enforcement risk meanwhile persists: the European Data Protection Board ordered Belgium to reopen a dismissed cookie-banner complaint in a binding decision published on 14 July 2026. Vendors are extending sideways, with Usercentrics acquiring an AI data-governance startup on 14 January 2026.

Timeline

  • 2009: Amended ePrivacy Directive requires consent for storing or accessing information on a device
  • February 2017: IAB Europe begins work on the Transparency and Consent Framework with more than 70 companies
  • 25 April 2018: TCF v1.1 launches
  • 25 May 2018: GDPR becomes applicable
  • 1 October 2019: Court of Justice rules in Planet49 that pre-ticked boxes are not valid consent
  • 21 August 2019: TCF v2.0 launches
  • 19 August 2020: TCF v2.1 launches, aligning with Planet49
  • 2 February 2022: Belgian Data Protection Authority fines IAB Europe 250,000 euros
  • 16 May 2023: TCF v2.2 released; legitimate interest removed for purposes 3 to 6
  • 20 November 2023: TCF v2.2 implementation deadline
  • 16 January 2024: Google-certified CMP required for EEA and UK traffic
  • 31 July 2024: Requirement extended to Switzerland for search products
  • 12 December 2024: CNIL issues formal notices over dark patterns in banners
  • 14 May 2025: Belgian Market Court limits IAB Europe joint controllership to TC String processing
  • 19 June 2025: TCF v2.3 released with mandatory disclosed vendors segment
  • 15 October 2025: Usercentrics reports 100 million euros in annual recurring revenue
  • 19 November 2025: European Commission publishes the Digital Omnibus proposal
  • 7 January 2026: Belgian Market Court annuls validation of IAB Europe's action plan
  • 1 March 2026: TCF v2.3 becomes mandatory for new strings
  • 29 May 2026: TCF v2.4 and policy 5.0.b opened for public comment
  • 18 June 2026: EU Council removes the automated consent signal from its ePrivacy position
  • 14 July 2026: EDPB binding decision reopens a dismissed cookie-banner complaint

Summary

Who: Publishers, advertisers and app developers deploy CMPs. IAB Europe registers them and enforces framework policy. Google certifies a subset for use with its advertising products. Commercial vendors include Usercentrics, OneTrust, Didomi, Sourcepoint, iubenda, Cookiebot and LiveRamp, alongside Google's own tool.

What: Software that collects, stores and transmits user permission for data processing. It blocks scripts pending a decision, encodes the outcome into a TC String or Global Privacy Platform string, exposes that record through a JavaScript API, and passes it into the bid stream through OpenRTB fields.

When: The category formed around the GDPR's application date of 25 May 2018 and the launch of the Transparency and Consent Framework on 25 April 2018. Version 2.2 landed in 2023, version 2.3 became mandatory on 1 March 2026, and version 2.4 was in public comment as of June 2026.

Where: Primarily the European Economic Area, the United Kingdom and Switzerland, where consent gates ad serving. Equivalent tooling operates under United States state laws through the Global Privacy Platform, and comparable regimes are emerging in Brazil, India and Turkey.

Why: Consent must be obtained before device storage and must be provable afterwards, while a bid request cannot carry a legal argument. A CMP converts a human decision into a machine-readable signal that hundreds of downstream companies can act on within the time an auction allows.