By Daniel de Almeida Afonso · Last updated: October 9, 2026
A consent management platform (CMP) is software that asks users for consent, records their choices, and passes those choices to your advertising and analytics partners. It is how a publisher shows that data was collected lawfully under the GDPR, the ePrivacy Directive, and the CCPA.
This guide explains what a CMP has to do for IAB TCF and for GDPR and CCPA consent. It also gives you a checklist for judging any tool, ours included. For a vendor-by-vendor ranking, see our comparison of 15 CMPs.
What is a CMP, and how is it different from a cookie banner?
A cookie banner is an interface. It lets a visitor accept or reject categories of cookies.
A CMP does more. It also does four other jobs:
- Records each consent decision with a timestamp, as evidence.
- Blocks or releases scripts according to the choice made.
- Passes the choice to downstream vendors, for example as a TC string.
- Lets the user change or withdraw consent later.
Many people link the term "CMP" to the IAB Europe Transparency and Consent Framework (TCF), because TCF registers CMPs. Technically, the concept is wider than TCF. A site with no programmatic ads can still need a CMP for GDPR or CCPA. Our guide to what a consent management platform is covers the fundamentals in more depth.
What does GDPR consent require?
The GDPR defines consent as a freely given, specific, informed, and unambiguous indication of the user's wishes. It must come from a statement or a clear affirmative action. The EDPB's Guidelines 05/2020 on consent explain how regulators read each word.
In practice, that means five tests:
- Freely given. Users must have a real choice. Bundling consent into non-negotiable terms, or punishing a refusal, makes it invalid.
- Specific. You collect consent for each purpose, not one blanket yes.
- Informed. Users see who processes data and why, before they decide.
- Unambiguous. Pre-ticked boxes and silence do not count.
- Easy to withdraw. Withdrawing must be as easy as giving consent.
For banner design detail, read our GDPR cookie consent guide.
GDPR vs CCPA: how the consent duties differ
The two laws share a goal but work differently. A CMP set up only for GDPR will not satisfy California, and the reverse is also true.
| Point | GDPR | CCPA (as amended by CPRA) |
|---|---|---|
| Who is protected | People in the EU, wherever the business is based | California residents |
| Who must comply | Any organization handling that data | For-profit businesses above set thresholds |
| Consent model | Opt-in before processing, with a legal basis | Opt-out of sale and sharing; opt-in only to sell data of consumers under 16 |
| Core rights | Access, erasure, objection, withdrawal of consent | Know, delete, correct, opt out of sale or sharing, limit sensitive data use |
| Maximum fines | Up to EUR 20 million or 4% of worldwide turnover, whichever is higher | $2,663 per violation, or $7,988 if intentional or involving a consumer under 16 |
Three details matter for a CMP:
- Thresholds. The CCPA covers businesses with annual gross revenue above $26,625,000. It also covers those that buy, sell, or share data of 100,000 or more consumers or households, or earn 50% or more of revenue from selling or sharing personal information. Older articles, including earlier versions of this one, quote the pre-CPRA figures of $25 million and 50,000 consumers.
- Fines. The GDPR ceiling comes from Article 83(5), which covers breaches of the consent rules. The CCPA amounts were adjusted for inflation on January 1, 2025, according to the CPPA's published table. Penalties apply per violation, so they add up quickly.
- Signals. California expects businesses to honor opt-out preference signals such as Global Privacy Control. A CMP should read them automatically.
Being GDPR compliant does not make you CCPA compliant. Our CCPA vs. GDPR breakdown goes through the differences in more detail.
Where TCF stands today
Much of what was written about TCF 2.0 in 2020 is out of date. The framework has changed twice since then.
- TCF v2.3 became mandatory for new TC strings after a transition that ended on February 28, 2026. IAB Europe's transition guidance says a TC string created under the new rules without the disclosedVendors segment is invalid.
- TCF v2.4 specifications were published on July 23, 2026. The web implementation deadline is October 23, 2026, and the mobile app and CTV deadline is February 23, 2027. We read these dates from current industry sources and from our own TCF v2.4 guide. Confirm them against IAB Europe before you plan a release.
Google adds a commercial reason to care. Publishers using AdSense, Ad Manager, or AdMob must use a Google-certified CMP that integrates with TCF to serve personalized ads in the EEA and UK, and in Switzerland. Google's help page says certified CMPs must recertify at least every twelve months. It also notes that Google certifies against TCF-focused criteria and does not check full legal compliance, so certification alone does not prove a tool is lawful.
If your CMP still generates v2.2-era strings, you are behind two mandatory upgrades. Ask your vendor for its v2.4 date in writing.
What a CMP must do for TCF and GDPR
TCF and the GDPR point at the same five duties. A CMP should handle each one without extra work from you.
- Notify. Users see what data is processed and for which purpose before they agree.
- Require real choice. Accept and reject carry equal weight. Nobody is pushed into accepting.
- Capture affirmative action. Consent comes from a click or a clear statement, never from scrolling or inactivity.
- Notify before processing begins. Nothing non-essential runs before the choice is made.
- Allow easy withdrawal. Users can reopen their preferences and change them as simply as they first consented.
TCF adds a technical layer. The CMP must generate a valid TC string, show vendors, purposes, and features in its interface, and expose the framework's JavaScript API so vendors can read the choice. In TCF v2 that API is __tcfapi. The older __cmp call from the TCF 1.x era no longer applies.
How to evaluate a CMP
Use this checklist with any vendor, including us.
- TCF status. Is the CMP listed in IAB Europe's registry, and does it generate v2.3 strings today? What is its v2.4 date?
- Google certification. Is it on Google's current certified list, and at what tier?
- Blocking. Does it stop non-consented scripts from loading, or only signal consent to vendors? TCF signals consent to vendors. Blocking enforces it on your own site. Under the GDPR, the publisher stays responsible for third-party tracking on its pages.
- Evidence. Can you export a dated consent log for a regulator?
- Regional rules. Does it show a GDPR opt-in flow in the EU and a CCPA opt-out flow in California, and read opt-out signals?
- Reach. Does it cover your web, app, and any CTV properties, plus several domains?
- Honest limits. Will the vendor tell you what it does not do?
Test your shortlist on your own site. Measure consent rates and confirm that scripts really stop before consent.
How Secure Privacy fits
Our existing product pages describe Secure Privacy as a CMP registered with IAB Europe's TCF and as a Google-certified CMP. Check the IAB Europe registry and Google's certified list for current status, as you should with any vendor.
Secure Privacy supports both approaches described above. It can block non-consented vendors and give control to the publisher. It can also run the IAB TCF interface and signal consent to vendors. When you enable the IAB option in the admin settings, it replaces the default banner and privacy center with a view of vendors, purposes, and features. Publishers who enable it agree to follow IAB policies.
Other documented capabilities include:
- A consent history and audit trail, hosted by you or by us.
- Passing the consent string to third parties.
- Cross-domain support and web and native app support.
- Region-aware notices, including California-only targeting.
Developers can read a user's choice through the TCF API (__tcfapi with getTCData). Book a call if you want to talk through your setup.
Which option should you choose?
- Choose a TCF-registered, Google-certified CMP if you run programmatic ads in the EEA or UK. Your ad partners may refuse to bid without it.
- Choose a CMP with strong regional logic and signal handling if your main risk is California or other US state laws. TCF matters less there.
- Choose a broader privacy platform if you also need data subject request handling or governance. A consent-only tool will not cover that. The 15-vendor comparison maps these cases to specific products.
- Choose a lightweight banner only if you have no ads, little tracking, and low risk. Even then, check that it blocks scripts before consent.
FAQ
Do I need a CMP for IAB TCF?
Yes, if you want to use the framework. TCF requires a CMP registered with IAB Europe that generates compliant TC strings.
Is TCF 2.0 still current?
No. TCF v2.3 has been mandatory for new TC strings since the transition ended on February 28, 2026. TCF v2.4 has a web deadline of October 23, 2026.
Does the CCPA require consent?
Mostly no. The CCPA works on an opt-out basis for the sale and sharing of data. It requires opt-in only to sell the data of consumers under 16.
What is the difference between a CMP and a cookie banner?
A banner is the visible prompt. A CMP also records evidence, blocks scripts, passes consent to vendors, and handles withdrawal.
Does Google require a certified CMP?
Yes, to serve personalized ads through AdSense, Ad Manager, or AdMob in the EEA, UK, and Switzerland, as Google's help page states.
If I am GDPR compliant, am I CCPA compliant?
Not automatically. The CCPA has its own disclosure, opt-out, and signal requirements.
Not sure what your site needs? Talk to a data privacy specialist about your consent setup.
