# What is a consent management platform (CMP), and do you need one?

> What a consent management platform is, the components that make it work, the fixed consent categories, and how to tell whether your site needs one.

Author: OptinStack Team  
Published: 2026-06-27  
Page: https://optinstack.com/blog/what-is-a-consent-management-platform-cmp  
Markdown: https://optinstack.com/llms.md/blog/what-is-a-consent-management-platform-cmp

A consent management platform, or CMP, is the system that asks visitors for consent, records their answer, and makes sure your trackers actually respect it\. If you have a website that serves users in the EU, the UK, or an increasing number of U\.S\. states, you have probably been told you need one\. This post explains what a CMP does, the parts it is made of, and how to tell whether you need one\.

## What a CMP does

At its core, a CMP handles three jobs\. It shows a consent banner that explains what trackers are present and asks for the visitor's choice\. It stores that choice and applies it, blocking or releasing third\-party scripts based on what the visitor agreed to\. And it keeps a record so you can prove, later, what each visitor consented to\.

## The parts of a CMP

*The main components of a consent management platform*

| Component | What it does | Why it matters |
| --- | --- | --- |
| Consent banner | First-layer notice that asks for consent | Meets the requirement that consent is informed and unambiguous |
| Preferences center | Granular category toggles | Lets visitors choose analytics vs marketing vs personalization |
| Enforcement | Blocks or releases scripts by category | Without it, the banner is decorative |
| Consent records | Stores who consented to what and when | Your evidence in an audit or complaint |
| Signals | Sends consent to ad platforms | Keeps Google Consent Mode v2 in sync. Native IAB TCF support is on the roadmap; until then, TCF and GPP strings are stored when present. |

> **Tip:** A banner alone is not a CMP. If it collects consent but your ad and analytics tags keep running regardless of the choice, the consent has no effect. Enforcement, turning the choice into blocked or released scripts, is what separates a notice from a platform.

## Do you need one?

If your site uses non\-essential storage or access for EU or UK visitors, ePrivacy rules commonly require prior consent, separately from GDPR lawful\-basis analysis\. US state requirements depend on whether the law applies and may focus on notices and sale, sharing, targeted\-advertising, or other opt\-outs\. The threshold is whether you place or read non\-essential information on a visitor's device, and under the ePrivacy Directive that covers far more than classic cookies\.

- You run Google Analytics 4 or Google Ads and have EU or UK traffic\.
- You embed third\-party widgets like YouTube, maps, or chat that set trackers\.
- You qualify as a business under the CCPA/CPRA and need a do\-not\-sell\-or\-share path\.
- You need exportable consent records for audits or customer trust\.

## The fixed consent categories

Most CMPs group trackers into a small set of fixed categories so visitors can choose at a meaningful level of detail without reading a wall of vendor names\. The common four are necessary \(always on\), analytics, marketing, and preferences\.

*The standard consent categories and what each covers*

| Category | What it covers | Default |
| --- | --- | --- |
| Necessary | Site function: cart, login, security | Always on |
| Analytics | Measurement and performance | Varies by mode |
| Marketing | Advertising and retargeting | Varies by mode |
| Preferences | Personalization and functionality | Varies by mode |

> **Warning:** Necessary must always be on. It is an invariant, not a preference, because turning it off breaks the site the visitor came to use.

## How to choose a CMP

- Pick one that enforces the choice, not just records it\. Blocking by category is the whole point\.
- Make sure it supports Google Consent Mode v2 and signals like GPC\.
- Check it works with your stack, whether that is a script tag, a builder, or a framework\.
- Confirm it exports consent records for audit and reporting\.

A CMP is the connective tissue between what the law requires and what your website actually does\. The banner asks, enforcement acts, and records prove\. Get all three working together and consent stops being a checkbox and becomes something your visitors can trust\.