A consent management platform (CMP) is the software behind a website’s cookie banner: it asks visitors which kinds of cookies and tracking they accept, stores the answer, and tells every analytics and advertising tag on the page whether it may run. The banner is only the visible part. The CMP is what makes the visitor’s answer change what the site actually does.
How a CMP works
A working set-up has four parts.
- A scan and a list. The CMP crawls your site, finds the cookies and similar technologies it uses, and sorts them into categories such as strictly necessary, functional, analytics and marketing. You need to check that list by hand, because automatic categorisation is often wrong.
- The banner and settings panel. Visitors see their options on the first page they land on, and can change their mind later through a link or icon that stays available on every page.
- Blocking. Non-essential scripts are held back until the visitor chooses. Either the CMP rewrites the script tags itself, or it passes the choice to Google Tag Manager, where each tag fires only once its category has been accepted. For Google’s own tags it also sets consent mode signals.
- A record. Each choice is stored with a timestamp and the version of the banner shown, in a consent log, so you can demonstrate what a visitor agreed to.
Widely used options include Cookiebot, OneTrust, CookieYes, Civic Cookie Control and, on WordPress, Complianz. At the time of writing (October 2026), several of them offer a free tier for small sites, with paid plans as page counts or traffic grow.
Why it matters
Under the Privacy and Electronic Communications Regulations (PECR), UK sites need consent before setting non-essential cookies, and that consent is judged to the UK GDPR standard. The Information Commissioner’s Office has been specific about what this means for banners: rejecting must be as easy as accepting, nothing non-essential may load before the visitor chooses, boxes must not be pre-ticked, and scrolling or carrying on browsing is not agreement. It has also been reviewing the cookie banners on popular UK websites and contacting organisations whose banners fall short.
There is a commercial reason as well. Google’s EU user consent policy covers visitors in the UK, so advertisers who use remarketing or audience features need to pass consent signals to Google. Without a CMP that supports consent mode, the advertising data Google can use for your UK visitors shrinks, and so do your audiences.
The Data (Use and Access) Act 2025 relaxes the consent rule for a few low-risk purposes, including some analytics used only to improve your own site. Check the ICO’s current guidance on which exemptions are in force, and on their conditions, before relying on one. Advertising and cross-site tracking still need consent.
Common mistakes
- A large “Accept all” button with “Reject” hidden behind a “Manage settings” link.
- Tracking scripts hard-coded into the theme or added by a plugin, so they fire before the CMP loads and ignore the visitor’s choice.
- Installing the CMP but never mapping tags to consent categories in Tag Manager, so everything still fires as before.
- Accepting the automatic scan without checking it, leaving marketing cookies filed as strictly necessary.
- No way to reopen the settings after the first visit, which makes withdrawing consent harder than giving it.
- A banner that covers most of a phone screen, hiding the page’s content and its call to action.
How to act on it
- Open your site in a private browser window with the developer tools open on the network and storage tabs. Load a page without touching the banner. If you see requests to Google Analytics, the Meta Pixel or other ad platforms, or their cookies appear, consent is not being respected.
- Click “Reject all” and browse a few pages. The same checks should stay clean.
- Accept, then confirm the tags now fire, using Tag Assistant or each platform’s own debugging tool.
- Read the banner as a visitor would. It should say plainly what each category is for and link to your cookie policy.
If Google Ads or Meta campaigns depend on this data, treat consent as part of the account set-up rather than an afterthought. Conversion counts, remarketing lists and automated bidding all rest on it, which is why it sits inside ongoing PPC management rather than alongside it.