How a CMP works
A consent management platform does four jobs. It shows the choice to the visitor. It stops non-essential scripts running until that choice is made. It stores the answer, with a timestamp and the wording that was shown. And it passes the result on to everything downstream, so your tag manager, analytics and advertising tags know what they are allowed to do.
The third and fourth jobs are the ones that matter and the ones most often missing. A banner that appears but does not actually gate anything is decoration. Behind a working CMP sits a categorised list of every cookie and script the site loads — strictly necessary, analytics, advertising, preferences — and rules that hold each category back until it is permitted.
Most CMPs also handle the housekeeping: remembering the answer for a set period, re-asking when your cookie list changes materially, offering a way to reopen the choice, and producing an export of consent records if a regulator or a client ever asks.
Why a CMP matters
It is the piece that turns a policy statement into something that actually happens. You can write an excellent privacy page and still be setting advertising cookies on the first page view; only the gating mechanism changes that.
It also has a direct commercial edge. Google requires advertisers and publishers reaching people in the EEA and the UK to collect consent properly and pass the signal through, and for some of its products the platform used must be one Google has certified. Getting that wrong can restrict audience features rather than merely creating legal risk, so it is worth confirming the current requirement for the specific product you run. The consent signal also feeds Consent Mode v2, which is how Google tags adjust their own behaviour.
Where CMPs go wrong
The most common problem is a CMP installed after the tags rather than before them. If the consent script loads late, analytics and pixels have already fired and the visitor’s answer arrives too late to matter. Order on the page is not a detail here.
The second is a banner nudging people towards accepting: a prominent accept button next to a faint text link, or a reject option that takes an extra click. Regulators have called this out, and it weakens the consent you are relying on.
The third is drift. Someone adds a chat widget, a heatmap or a new pixel months later, nobody adds it to the CMP’s category list, and it runs unconditionally while the cookie table still says otherwise. The fourth is choosing on price alone and ending up with something that cannot gate a script it does not recognise.
Getting it right
Test rather than trust. Open your site in a clean browser window, refuse everything, and look at the storage and network panels in the browser’s developer tools. If an analytics or advertising cookie is set anyway, the CMP is not doing the job you bought it for, whatever the dashboard reports. Repeat the test after accepting, and after every change to your tag setup.
Then keep the pieces aligned: the categories in the CMP, the cookie table on your privacy page, and the tags in your tag manager setup should all describe the same site. When they do, consent stops being a compliance chore and becomes a number you can actually read alongside your traffic.