Consent Management Platform (CMP) Guide: What It Is, How It Works, How to Choose One
What a consent management platform (CMP) is, how it works and how to choose one: scanning, categorisation, prior blocking, Consent Mode v2 and consent records.
What is a consent management platform (CMP)?
A CMP is software that detects which cookies and trackers exist on a website, collects informed consent from the visitor, passes that choice to analytics and advertising tools as a signal, and turns every decision into a consent record that can be shown during an audit. The banner is only its visible surface.
The legal basis: GDPR, ePrivacy, KVKK and beyond
Article 5(3) of the ePrivacy Directive together with the GDPR requires informed, freely given consent before non-essential cookies load. Turkiye's KVKK takes the same approach, the CCPA creates a privacy notice obligation, and in the Gulf the Saudi PDPL (SDAIA) and the UAE PDPL with DIFC and ADGM set comparable expectations.
- Consent must be prior to any non-essential tracker
- Accept and reject must be equally visible
- Choices must be granular, with no pre-ticked boxes
- Consent must be withdrawable
- Every decision must be provable with a timestamped record
How a CMP works: five stages
Scan, categorise, banner, signal, record. Each stage feeds the next so the visitor's decision is both enforced and provable.
- Scan with a real browser for cookies, localStorage, pixels and third-party scripts
- Categorise into necessary, preferences, analytics and marketing
- Show the banner in the visitor's language and region
- Signal the choice through Consent Mode v2 and IAB TCF v2.2
- Store a consent record with timestamp and integrity proof
Core capabilities to compare
A useful CMP automates the inventory and enforces the decision instead of merely displaying it.
- Automated, repeatable deep scanning
- Prior Blocking
- Consent Mode v2 and IAB TCF v2.2 support
- Multi-language, geo-targeted banners
- Exportable consent records kept at least 3 years
- A cookie policy that updates from the scan
- Audit log and reporting
Exactly what Cookietrace does
With Cookietrace's Prior Blocking setting enabled, non-essential cookies and trackers detected by the scan - whether loaded via GTM or embedded directly in the page - are not executed until the visitor makes a choice; if the visitor rejects, they never run, and if they accept, only the accepted categories load.
Consent Mode v2 does not replace blocking
Consent Mode v2 governs Google tags only. Scripts embedded directly in a theme or page, such as Meta Pixel or TikTok Pixel, need platform-level blocking; the two mechanisms are complementary.
How to choose one, and what it costs
Compare scan automation, prior blocking coverage, record export and retention, hosting region, domain and language coverage, and installation effort. Cookietrace pricing is public: Pro $39/month for 10 domains, Premium $79/month for 100 domains and Enterprise with custom pricing, plus a 14-day trial without a credit card; installation is a one-line script or GTM and hosting is in the EU by default with a Turkiye option.
The honest boundary
No software eliminates fine risk. A correctly configured CMP removes the most frequently penalised violation - loading analytics or marketing cookies before consent - and makes it provable with timestamped records; privacy notices, cookie policies and registration duties remain separate obligations.