Most consent management platforms (CMPs) pass the demo because the banner looks right, then fail in production because tags still fire before consent, a Global Privacy Control signal is ignored, or nobody can prove what a browser agreed to. A CMP runs on every page and in every app, usually before any other script, and decides which marketing and analytics vendors receive data. That makes it a compliance control, a performance cost and a third-party code dependency at once. This vendor-neutral buyer's guide is for privacy, marketing technology, web engineering and security teams writing requirements, running an RFP or replacing a CMP. Legal triggers, banner design rules and consent logging basics are covered in the Consent Management Guide: Cookies, CMPs and GPC; this page focuses on choosing and testing the product.
Key takeaways
- Test enforcement, not the banner. Score a CMP on what reaches the network before consent and after "Reject all", captured with a clean browser profile on your own journeys.
- Know which framework signals you need. Google requires a Google-certified CMP integrated with the IAB TCF for personalised ads in the EEA and UK (from 16 January 2024) and Switzerland (from 31 July 2024); TCF v2.3 is current, and its 28 February 2026 adoption deadline has passed.
- One CMP must run several legal models. Opt-in for EU ePrivacy and UK PECR, opt-out with Global Privacy Control for California, and UK exemptions where some purposes default on with a free route to object.
- Proof is a product feature. You need exportable, versioned consent records that answer "what did this browser agree to, on which banner, under which rule".
- The CMP is privileged third-party code. Its delivery, change control, admin access and own data processing deserve the scrutiny you give any critical supplier.
Define requirements
Start with an inventory, not a vendor list. Crawl your properties and record what you are actually governing.
- Properties and platforms: domains and subdomains, single-page applications, and iOS and Android apps. In apps, the IAB Tech Lab CMP API specification has the CMP SDK store the TC string in NSUserDefaults or SharedPreferences under keys such as
IABTCF_TCString,IABTCF_gdprAppliesandIABTCF_CmpSdkID, so app support is a separate capability to test. - Advertising model: selling programmatic advertising needs TCF and Google certification; only buying advertising usually makes Consent Mode v2 and platform signals the priority; no advertising may need only a simple first-party CMP.
- Tag estate: tag manager tags, hard-coded scripts, server-side tagging, session replay, chat widgets and embedded media. Hard-coded scripts are where most pre-consent leaks come from.
- Owners: who configures purposes and vendors (privacy), deploys the script (web engineering), owns tags (marketing) and approves changes.
- Constraints: page speed budgets, accessibility, languages, and where consent records may be stored.
Size changes the answer. A single-brand site without programmatic advertising mainly needs accurate scanning, reliable prior blocking, Consent Mode v2 and GPC. A publisher or multi-brand group also needs TCF, Google certification, the IAB Global Privacy Platform (GPP), consent sharing across domains, app SDKs and delegated administration per brand.
| Regime or signal | What the CMP must do | Check during evaluation |
|---|---|---|
| EU ePrivacy Art. 5(3) with GDPR consent | Block non-essential storage and access until opt-in; reject as easy as accept; withdrawal always reachable | Pre-consent and post-reject network captures |
| UK PECR reg. 6 as amended by the Data (Use and Access) Act 2025 | Support the ICO's five exceptions; statistical and appearance purposes need clear information and "a simple means of objecting, free of charge" | Can a purpose default on with a toggle to object? The ICO says you "must not solely rely on browser settings" |
| California CCPA regulations, 11 CCR 7025 | Process an opt-out preference signal (HTTP header or JavaScript object) as a valid opt-out of sale or sharing, without friction | Behaviour with Sec-GPC: 1; on-page confirmation that the signal was honoured, which Greenberg Traurig reports is mandatory from 1 January 2026 |
| IAB Europe TCF v2.3 | Valid TC strings with the now mandatory Disclosed Vendors segment; __tcfapi with ping, addEventListener, removeEventListener | CMP ID on the IAB Europe CMP list; decode sample strings |
| Google certified CMP | Certification for personalised Google ads in the EEA, UK and Switzerland, renewed at least every 12 months | Status today; Google says it "does not check CMPs for full compliance with the TCF or applicable privacy laws" |
| Google Consent Mode v2 | Defaults for ad_storage, analytics_storage, ad_user_data and ad_personalization before any measurement command, then an update on choice | Basic and advanced modes; per-region defaults; wait_for_update |
| IAB GPP for US states | Emit GPP strings; the US Privacy String was deprecated in January 2024 | US National and state sections supported |
This table translates regulatory requirements into product features and is not legal advice; confirm obligations for your jurisdictions with counsel.
Evaluation criteria
Weight criteria to your requirements. An illustrative split for an advertising-funded site is 30% enforcement and blocking, 20% framework signals, 15% records, 15% performance, 10% scanning and 10% platform security; without advertising, move weight from signals to performance and scanning.
| Criterion | What good looks like | Weak signs |
|---|---|---|
| Scanning and categorisation | Logged-in and logged-out crawls of named journeys; detects cookies, local storage, pixels and third-party hosts; flags changes between scans; categories you can override with reasons recorded | Generic database that labels unknown items "functional"; home page scans only |
| Prior blocking | Blocks scripts, iframes and pixels before consent, including hard-coded tags; passes consent state to server-side tagging | Relies on vendors reading a flag; works only inside the tag manager |
| Framework signals | TCF v2.3, Google certification, Consent Mode v2, GPP, GPC read from the header and navigator.globalPrivacyControl | "Roadmap" for a signal you need today; GPC that only changes banner text |
| Regional rules | Rule sets by country and US state; opt-in, opt-out and object-mode purposes side by side; geolocation failure falls back to the strictest rule | One global banner; failure defaults to "granted" |
| Consent records and proof | Pseudonymous ID, timestamp, banner and policy version, choice per purpose, rule applied, GPC flag, TC or GPP string; append-only; API export; defined retention | Aggregate dashboards only; records not tied to a banner version |
| Banner design and testing | Equal-weight accept and reject, accessible markup, languages, persistent withdrawal link, A/B tests limited to compliant variants | Optimisation that rewards the highest accept rate with no guardrails |
| Performance | Small cacheable script, option to self-host, overlay or sticky footer with no layout shift | Long request chains; banner becomes the mobile LCP element |
| Multi-domain and apps | Consent sharing across domains where lawful, native iOS and Android SDKs, one record model across channels | Separate products and records per channel |
| Administration | SSO with enforced MFA, roles per brand, approval before publishing, versioned configuration with rollback, audit log | Shared logins; changes go live instantly with no history |
| Data processing and assurance | GDPR Art. 28 processor terms, named regions and sub-processors, no full IP addresses by default, current independent assurance | Consent data reused for the vendor's own purposes |
Performance, testing and the CMP's own security
- Performance: web.dev guidance says cookie notices are "a very common source of layout shifts", "can often be a cause for high INP" because accepting loads many scripts, and can be the LCP element on mobile. It recommends asynchronous loading where blocking allows, self-hosting, and
preconnectfor third-party origins. Measure Core Web Vitals with the CMP off, on before consent, and after accept. - A/B testing without dark patterns: the ICO and CMA joint paper on harmful design accepts that testing "can involve a variety of methods such as A/B tests", while stating users "must be able to refuse non-essential cookies with the same ease as they can accept them". The EDPB cookie banner taskforce rejects banners with no reject option on a layer with a consent button, pre-ticked boxes and unreadable contrast. Lock reject to the same layer and weight in every variant, and log which variant each user saw.
- Script supply chain: a CMP script runs first on every page, so a compromised release pipeline or CDN reaches every visitor, as the Lottie Player npm compromise showed for an embedded library. Ask about signed releases, version pinning, Subresource Integrity and self-hosting.
- Machine credentials: console API keys and tag manager or analytics integrations are non-human identities that need owners, minimal scopes and rotation. See the SaaS and OAuth App Governance Guide.
Questions to ask vendors
- On our checkout and login journeys in a clean profile, which requests leave the page before interaction and after "Reject all"?
- How do you block hard-coded scripts and iframes outside the tag manager, and what happens if your script fails to load?
- What is your IAB Europe CMP ID, and when did you ship TCF v2.3 with the mandatory Disclosed Vendors segment?
- Are you Google-certified today, when do you recertify, and do you support both basic and advanced Consent Mode?
- When a browser sends
Sec-GPC: 1, which tags stop, what GPP string do you emit, and how is the user shown it was honoured? - How do you implement the UK statistical and appearance exceptions with a free route to object?
- Show one visitor's consent record: fields, banner version, retention and API export.
- What does your script add to page weight and main-thread time, and can we self-host and pin it?
- Which personal data do you process as our processor, where and with which sub-processors, and do you use our consent data for anything of your own?
- What does pricing count (domains, sessions, page views or apps), and what happens when traffic spikes or we add a brand?
Red flags
- Auto-blocking demonstrated only on the vendor's own demo site.
- Dashboards celebrating consent rates far above peers, which usually signals a design problem.
- Defaults that grant consent when geolocation fails or the script times out.
- GPC treated as a preference rather than an opt-out that changes tag behaviour.
- "Fully compliant" claims based on Google certification or TCF registration, neither of which checks your configuration.
- Admin consoles without SSO, MFA, roles or an audit log.
- Pricing per domain or traffic band that discourages covering every property.
Proof of concept
- Baseline: before installing, crawl five journeys (home, product, checkout, login, account) on one EU or UK site and one US site with a clean profile, recording every cookie, storage key and third-party host.
- Install on staging with defaults denied: deny every Consent Mode parameter for EEA and UK regions, map each tag to a purpose and owner, and configure UK object-mode purposes separately.
- Capture four states per journey: pre-consent, after reject, after accept, and with
Sec-GPC: 1on the US site. Pass: nothing non-essential before consent or after reject, and sale or sharing tags suppressed under GPC. - Validate signals: decode TC and GPP strings, confirm Consent Mode command order, and test the SDK on one iOS and one Android build if apps are in scope.
- Measure performance: compare LCP, INP and CLS with the CMP off, on before consent and after accept.
- Test proof and administration: pull a record through the API, publish a banner change through approval, check the audit log, and confirm a new vendor triggers re-consent.
- Pilot and roll back: release to one locale or traffic percentage, then rehearse rollback by reverting the configuration version, never by letting tags fire before consent.
After go-live, track non-essential requests before consent and after reject (target zero), GPC honour rate, tags without a purpose and owner, time to classify a new tag, and consent rates by region and choice.
How NHI Mgmt Group can help
We provide independent requirements, RFP and evaluation support. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: Consent Management Guide: Cookies, CMPs and GPC · Identity Data Privacy and Consent Guide · Global Privacy Regulatory Map · Privacy Programme Guide for Security Teams