Consent Management Platform (CMP)

The IAB TCF is the industry-standard technical protocol for communicating user consent signals throughout the programmatic advertising supply chain. It defines a standardized Consent String—a compressed, base64-encoded data structure—that captures a user's specific purposes, vendor preferences, and legal bases. The framework operates via a centralized Global Vendor List (GVL) , which enumerates registered ad tech vendors and their declared processing purposes. CMPs integrate the TCF v2.2 API to surface the consent UI, capture choices, and encode them into a TC String that is transmitted via the OpenRTB bid request protocol. This ensures that downstream demand-side platforms (DSPs) and supply-side platforms (SSPs) can programmatically enforce user preferences without manual intervention.

OneTrust is the dominant enterprise-grade CMP, built on a modular privacy management platform. Its Universal Consent and Preference Management module uses a JavaScript tag-based deployment to inject consent banners across web properties. The platform's core technical differentiator is its Consent Rate Optimization engine, which uses A/B testing on banner layouts and button colors to maximize opt-in rates while maintaining compliance. It features a Policy-as-Code engine that dynamically adjusts the consent experience based on geo-IP detection of the user's jurisdiction. OneTrust integrates deeply with DSAR fulfillment workflows, linking consent records directly to data inventory maps for automated data subject request processing.

Cookiebot provides a fully automated consent solution centered on its deep-scanning crawler technology. The scanner simulates a browser session to index all cookies, trackers, and local storage objects set by a domain, classifying them by purpose and vendor. This generates a dynamic Cookie Declaration that is always synchronized with the actual tracking landscape. The CMP blocks all non-essential tags by default until explicit consent is received, implementing a true prior consent model. Its bulk consent feature allows organizations to propagate consent choices across multiple subdomains and group domains using a single configuration, simplifying management for large-scale web estates.

Didomi is a SaaS CMP that emphasizes developer experience through a robust set of REST APIs and SDKs for mobile, web, and connected TV. Its architecture is built around a Consent Gateway, a centralized API endpoint that acts as a single source of truth for user preferences across all platforms. The platform supports multi-regulation orchestration, allowing a single banner to collect consent for GDPR, CCPA opt-out signals, and specific IAB TCF purposes simultaneously. Didomi's Preference Center is highly customizable, enabling users to granularly toggle consent for specific vendors and purposes, with all changes logged in an immutable, time-stamped audit trail for compliance demonstration.

Sourcepoint provides a CMP designed for complex media and publishing environments, with a strong focus on privacy UX and messaging orchestration. Its platform decouples the consent collection layer from the enforcement layer using a tag management system (TMS) integration that fires tracking scripts only upon positive consent signals. A key feature is the Consent Rate Analytics dashboard, which provides granular funnel metrics on user interactions with consent dialogs. Sourcepoint also offers advanced alternative data strategies for cookieless environments, helping publishers build authenticated first-party data audiences when consent is declined, directly addressing the revenue impact of consent loss.

Google Consent Mode is a technical API that modifies the behavior of Google tags (Analytics, Ads, Floodlight) based on user consent state. Instead of blocking tags entirely, it sends cookieless pings that communicate consent status to Google services, enabling conversion modeling to recover lost attribution data. The latest v2 implementation requires explicit consent signals for ad_user_data and ad_personalization to be passed to Google. It operates in two modes: Basic, where tags are blocked until user interaction, and Advanced, where tags load but adjust their behavior based on the consent signal. This allows for a more nuanced data collection posture that balances compliance with measurement integrity.