First of a new arc, sitting beside the record layer. The CRM arc asks who owns the truth about a customer. This one asks what the stack is allowed to do with it, starting with the acronym that was supposed to answer the question and mostly answers a smaller one.
Ask three people in the same company what their CMP does and you will usually get three answers that are all correct. The digital marketing team will describe the cookie banner, the thing that appears on the first page view, asks the visitor to accept or reject a set of purposes and then decides which tags may fire. The legal or privacy team will describe the evidence, the record that shows what notice a person saw, what they chose and when, which is what they will need when a complaint or an audit arrives. The CRM team running the CEP will describe a field, or more often a handful of fields, on the profile that say whether this person may receive email, SMS or push, and that arrive from somewhere upstream on a schedule nobody quite owns. All three are describing consent, all three call the source of it the CMP, and in most of the stacks I have looked at they are describing three different systems holding three copies of a permission that is supposed to be singular.
That confusion is the tension in this acronym, and it is sharper than in most of the others in this series because the cost of getting it wrong is not a duplicate profile or a slow journey. A customer who withdraws consent through one channel and keeps receiving messages through another has a legitimate complaint, and the stack that produced the message cannot usually explain which copy of their choice it read.
What the CMP gets confused with
The boundaries matter here because each neighbouring system holds a piece of the same problem. A preference centre is the page where a known customer manages topics, frequency and channels, and it overlaps with consent wherever a preference is also a legal permission, which is why vendors in this category increasingly sell both under one product name. Customer identity and access management owns the login and the account, and it is often where consent is first captured for registered users, at sign-up, long before any marketing system sees the person. The CDP holds consent as an attribute on the unified profile so that audiences can be filtered, which makes it the most common place where a copy of consent becomes the copy everyone uses without anyone having decided it should be. The CEP enforces it at the moment of sending, and enforcement is the only point at which a wrong value actually reaches a customer.
The CMP in its original sense sits at the very front of that chain, in the browser or the app, and its job ends when the choice has been captured and signalled to the tags and vendors that need it. Everything downstream of that moment belongs to other systems, and the acronym does not say which.
Where the CMP acronym came from: cookie law and the TCF
The origin is legal before it is technical. Directive 2009/136/EC amended Article 5(3) of the ePrivacy Directive and introduced a consent regime for storing or reading information on a user’s device, with member states required to transpose it by 25 May 2011. In practice that produced the first generation of cookie notices, mostly informational bars that told visitors cookies were in use and treated continued browsing as acceptance. Most were a script and a stylesheet that a developer could write in an afternoon, and many sites built their own.
The GDPR changed the standard of consent and the stakes together, and the advertising industry needed a way for a choice made on a publisher’s page to travel to hundreds of vendors in the programmatic supply chain. IAB Europe’s answer was the Transparency and Consent Framework, whose first version went live on 25 April 2018, a month before the GDPR applied. The framework defined a common format for encoding a user’s choices, the TC String, a common API through which vendors could read it, a registry of participating vendors and a role for the software that would show the notice and produce the signal. IAB Europe describes that role today in almost exactly the terms the market still uses, as software or solution providers that develop notices such as cookie banners to inform users and capture their preferences. That is where the acronym comes from, and it explains its shape. A CMP, in the sense that made the term common, is a registered participant in an adtech consent protocol whose output is a signal for vendors.
The case law then tightened what that signal had to mean. In Planet49, on 1 October 2019, the Court of Justice held that a pre-ticked box is not valid consent and that the consent standard for device storage is the GDPR standard, which made the informational bar of 2011 legally obsolete across the Union. The framework itself went through versions 2.0 in August 2019, 2.1 in 2020, 2.2 in May 2023 and 2.3 in 2025, mandatory from February 2026, each one narrowing what a vendor could claim and how. The commercial pressure came from Google, which from 16 January 2024 required publishers using AdSense, Ad Manager or AdMob to serve users in the EEA and the UK through a Google-certified CMP integrated with the TCF, followed by the Consent Mode v2 requirements for Google Ads and Analytics in March 2024. For a large share of European publishers, buying a certified CMP stopped being a privacy decision and became a condition of monetisation.
The analyst gap: Gartner never called it a CMP
Every acronym in this series has a gap between the popular name and the analyst category, and the CMP gap runs in a direction that explains a great deal. Gartner’s coverage of this space uses the phrase consent and preference management, and the clearest signal of how it was framed is the title of its 2022 report, the Market Guide for Consent and Preference Management for Marketers, a framing the 2024 edition dropped together with “for Marketers” in the title. That is a marketing document about a marketing problem, the management of permissions and preferences across a customer relationship, and the cookie banner is one capture surface within it. Today Gartner Peer Insights files the same capability inside a broader market it calls Privacy UX, where consent and preference management is a mandatory feature described as core services that work in concert to maintain and enforce a unified view of user choices. Since October 2026 Gartner also covers that market with a Magic Quadrant for Privacy UX. The vendors listed there include OneTrust, Didomi (which acquired Sourcepoint in 2025), Syrenis, Ketch, TrustArc, Transcend and DataGrail, alongside Tealium’s customer data hub, and several of them sell data subject request automation in the same category.
Read the Gartner wording next to the IAB wording and the gap becomes the argument of this article. The protocol defines a CMP by its notice and its signal. The analyst defines the category by a unified view of user choices that is maintained and enforced, which is a statement about state and about the systems that act on it. The popular acronym kept the first meaning because the first meaning is what the market was forced to buy in 2018 and 2024, while the second meaning is what an enterprise with a CRM, a CDP and several engagement channels actually needs and usually does not have.
The courts, meanwhile, made the gap expensive. On 2 February 2022 the Belgian data protection authority found that the TC String is personal data, that IAB Europe acted as a joint controller for it and that the framework’s security measures were insufficient, and it fined IAB Europe 250,000 euros. The Court of Justice, ruling on a preliminary reference on 7 March 2024 in case C-604/22, held that the string can be personal data where it can be linked to an identifier and that IAB Europe could be a joint controller of that processing, while declining to extend the controllership to everything vendors later did with the signal. On 14 May 2025 the Belgian Market Court upheld the fine, ruling on version 2.0 and declining jurisdiction over 2.2, since superseded by 2.3. The banner’s output is therefore personal data in its own right, which means the evidence of consent is now subject to the same obligations as the data it governs.
What consent management means architecturally today
Once you stop looking at the banner, consent management turns out to have four distinct jobs, and the usual problem is that each one has landed in a different system without anyone deciding that it should. The first is capture, which happens wherever the customer is when they make a choice: the cookie notice, the app’s first-run screen, the account sign-up form, the checkout, the store’s loyalty enrolment and the preference centre. The second is evidence, the record of what notice text and version the person saw, what they chose, through which surface and when, kept in a form an auditor can read. The third is current state, the answer to the question of what this person currently permits, by purpose and by channel, after every capture event and every withdrawal has been applied in order. The fourth is enforcement, the check that runs before a system acts on the person, whether that action is a tag firing, an audience export to an advertising platform or a message leaving a CEP.
A CMP chosen in the 2018 sense does the first job for one surface, the browser, and produces a reasonable version of the second for that surface. The third job usually sits in the CRM or the CDP as profile attributes, and the fourth is implemented separately by every tool that sends anything, each reading its own copy. The consequences follow directly. A withdrawal captured in the preference centre has to travel to every copy before the next send, and the journey through ingestion, identity resolution and outbound synchronisation is measured in hours in many stacks, which is the window in which a customer who has said no keeps hearing from the brand. The argument for evaluating consent at the moment of dispatch, through a short-lived policy check, is made in detail in Who Owns the Consent Token?, and it is the logical end point of taking the third job seriously.
The four jobs of consent management, and the systems that usually end up holding them without anyone deciding that they should.
There is also an identity problem that the banner hides. A choice captured on an anonymous browser is attached to a device and a cookie, while a choice captured at sign-up is attached to a known person, and identity resolution is the process that decides whether those two belong together. Merging profiles merges permissions, and a stack that lifts a device-level acceptance onto a known profile, or lets a profile-level withdrawal fail to reach the device, has made a legal decision through a matching rule that was configured for personalisation. The data model has to hold consent with enough context to resolve those cases: purpose, legal basis, channel, the scope it applies to (brand, legal entity, market), the capture point, the notice version, the timestamp and, where the law or the policy sets one, the expiry. A boolean called email_opt_in cannot hold any of that, and in most of the CEP implementations I have seen it is still the field the journeys actually read.
The vendors have noticed. The category leaders now sell universal consent stores, preference centres and APIs that let downstream systems query current state, and Gartner’s choice to file the capability inside a Privacy UX market reflects the same shift away from advertising. What no vendor can sell is the decision about which system holds the authoritative current state and which systems are only allowed to read it, because that decision depends on where the customer relationship lives in a particular company, and it is the same governance question the CRM article ended on.
Does the CMP still matter?
The acronym matters less every year, because the job it names has become the easy part. Capturing a valid choice on a web page is a solved problem with dozens of certified vendors, a published standard and a body of case law that tells you what a valid notice looks like. The difficult part is everything after the capture, holding one current state of a customer’s permissions across channels, entities and identifiers, and making every system that acts on the customer check it at the moment of action, and that part does not have a popular acronym at all. The analysts call it consent and preference management, which is accurate and which nobody says out loud in a project meeting.
My test for any consent architecture is a single question, asked at the CEP and not at the banner: if a customer withdrew consent for marketing email ten minutes ago, through any channel, which system would stop the next send, and how would it know? If the answer names a field on a profile that is refreshed overnight, the stack has a CMP and does not yet have consent management.
The CMP is the part of consent management that the regulation forced everyone to buy first, and the architecture that matters is the part nobody was forced to build: one current state of permission, enforced at the moment of action, wherever the customer said yes or no.
Sources
Regulation and case law
- Cleary Gottlieb, New Consent Regime for Cookies to Enter Force in the UK. Directive 2009/136/EC and the 25 May 2011 transposition deadline.
- Court of Justice of the EU, Judgment in Case C-673/17, Planet49. Case C-673/17, judgment of 1 October 2019 on pre-ticked boxes and the consent standard.
- Hunton Andrews Kurth, CJEU Rules on IAB Europe’s Transparency and Consent Framework. Case C-604/22, judgment of 7 March 2024.
- Lewis Silkin, Belgian Market Court upholds €250,000 fine against IAB for GDPR violations. Market Court decision of 14 May 2025 and its scope.
IAB Europe and the TCF
- IAB Europe, Transparency & Consent Framework. Version history from v1.1 (25 April 2018) to v2.3, and the definition of a CMP.
- Didomi, IAB Europe’s TCF and the Belgian APD decision. The 2 February 2022 decision and its findings.
Gartner
- Gartner Peer Insights, Consent and Preference Management. The capability definition and its placement inside the Privacy UX market; vendor list as shown in October 2026.
- Syrenis, Gartner Market Guide for Consent and Preference Management for Marketers. Vendor landing page for the 2022 edition; the report itself is paywalled.
- PossibleNOW, Gartner Market Guide for Consent & Preference Management (August 2024). Vendor landing page for the 2024 edition, whose title no longer says “for Marketers”; the report itself is paywalled.
- Gartner, Market Guide for Privacy UX, 2 February 2026, and Magic Quadrant for Privacy UX, 6 October 2026. Paywalled; titles and dates from the document pages.
- Didomi, Didomi and Sourcepoint join forces to build the future of privacy technology, 8 July 2025. The acquisition of Sourcepoint.
Platform requirements
- Cookiebot, Google certified CMP requirement. The 16 January 2024 EEA and UK requirement for AdSense, Ad Manager and AdMob, and the March 2024 Consent Mode v2 deadline.
