Privacy & regulation · also called Consent management platform, cookie banner
CMP (consent management platform)
A CMP (consent management platform) is software that shows users privacy choices, such as a cookie banner, records their consent or opt-outs, and passes them to the site's partners.
The banners asking you to accept or reject cookies are usually powered by a CMP. It explains what data the site and its partners want to use, collects the user's decision, stores it, and makes it available to every tag on the page so they behave accordingly.
In Europe, CMPs implement GDPR and ePrivacy consent, typically through the IAB IAB TCF, producing a consent string. In the US they handle opt-outs under laws like CCPA / CPRA, often via the IAB Global Privacy Platform, and should detect Global Privacy Control signals. Google requires publishers using its ad products in the EEA and UK to use a Google-certified CMP, and its consent mode adjusts tags according to the user's choice.
Design matters. Regulators, notably in France and elsewhere in the EU, have fined companies for banners that make rejecting harder than accepting, pre-ticked boxes or "dark patterns". A good CMP makes refusal as easy as acceptance, respects choices across the site and passes them reliably downstream.
Think of it like this
A CMP is like the receptionist who asks visitors which rooms they are happy to be filmed in, writes it down and tells every camera operator in the building.
An example
A news site in France uses a CMP with equal "Accept all" and "Refuse all" buttons; 55% of visitors accept, and the CMP's TC String tells ad partners not to personalise ads for the rest.
Related terms
Consent string
A consent string is a compact encoded value recording a user's privacy choices, such as the TCF TC String or a GPP string, that travels with ad requests to vendors.
IAB TCF (Transparency & Consent Framework)
The IAB TCF (Transparency & Consent Framework) is IAB Europe's standard for collecting users' GDPR consent and objections through CMPs and passing those choices to ad tech vendors in a consent string.
IAB Global Privacy Platform (GPP)
The IAB Global Privacy Platform (GPP) is an IAB Tech Lab standard that packages privacy and consent signals for many jurisdictions, like US states and the EU, into one string.
GDPR
The GDPR (General Data Protection Regulation) is the European Union's data protection law, applying since May 2018, which governs how organisations collect and use personal data about people in the EU.
Global Privacy Control (GPC)
Global Privacy Control (GPC) is a browser or extension setting that automatically tells every website a user visits that they do not want their personal data sold or shared.
Sources: IAB Europe Transparency & Consent Framework, Google Tag Platform: consent mode, GDPR Article 6: lawfulness of processing