Consent management platform
A consent management platform, CMP for short, is software that obtains, documents and manages users' consent to cookies and tracking on a website. It shows the familiar consent banner, stores each visitor's decision and steers which scripts load only after agreement. A CMP is thus the central component for GDPR-compliant tracking in Germany and the EU. Without one, legally sound marketing tracking is hardly possible.
Also known as: CMP, consent management platform, cookie consent tool, consent management
What is a consent management platform?
A consent management platform governs which data a visitor wants to allow and which not. On first visiting the site, a consent banner appears through which users Tracking, analytics and marketing cookies can be accepted or rejected. The CMP stores that decision and makes sure only the approved scripts are actually loaded.
Technically, a CMP works closely with the Google Tag Manager together. Tags for Google Analytics 4, advertising pixels or Heatmap tools only fire once the matching consent is in place. That keeps data collection lawful and traceable.
Besides the banner, a CMP also includes audit-proof documentation of consent. In an audit it can be shown who consented to which processing and when. In the German market especially, that is an important differentiator and a signal of trust.
Which CMP providers are there, compared?
Several providers have become established in German-speaking countries. Usercentrics is a German market leader with a strong focus on legal certainty and enterprise features. Cookiebot convinces through automatic scanning of the cookies in use and is quickly set up. Both support the Transparency and Consent Framework standard TCF 2.2 for the programmatic advertising ecosystem.
OneTrust is a comprehensive enterprise solution going far beyond cookie consent and covering data protection management as a whole. Borlabs Cookie, by contrast, is a lean solution developed in Germany specifically for WordPress, making many small and mid-sized sites GDPR-compliant at low cost.
The choice depends on project size and requirements. For WordPress sites Borlabs is often enough, while Usercentrics or OneTrust show their strengths on large sites with high legal demands and programmatic advertising.
| Tool | Strength | TCF 2.2 | Hosting / GDPR | Price range |
|---|---|---|---|---|
| Usercentrics | German market leader, legally sound | Yes | EU servers, GDPR-focused | from ~ a monthly price depending on scope |
| Cookiebot | Automatic cookie scan | Yes | EU hosting available | free to a small plan |
| OneTrust | Comprehensive privacy management | Yes | Configurable, global | Enterprise |
| Borlabs Cookie | Lean, ideal for WordPress | Limited | Self-hosted, close to GDPR | from ~ a one-off licence fee |
How do you set up a CMP correctly?
A CMP only shows its value when it is cleanly linked to the tracking. The first step is an inventory of every cookie and script in use. These are then sorted into categories such as necessary, statistics and marketing, so users can consent selectively.
Next the CMP is connected to Google Tag Manager, so tags fire only where consent exists. The Google Consent Mode makes sure Google Analytics 4 and ad accounts still receive anonymised, aggregated signals even when tracking is declined.
Finally the banner is tested and the documentation checked. At Elisabit we set up this interplay so your tracking stays legally sound while still capturing as much usable data as possible.
- 1Record and categorise all cookies and scripts.
- 2Install the CMP and design the consent banner.
- 3Connect the CMP to Google Tag Manager.
- 4Enable Google Consent Mode for Google Analytics 4.
- 5Test the banner and check the consent documentation.
CMPs and the GDPR in the German market
In Germany the GDPR and the Telecommunications Telemedia Data Protection Act mean tracking cookies generally require active consent. A CMP is therefore not optional but effectively mandatory as soon as you use analytics or marketing tracking. If it is missing or misconfigured, warning letters and fines loom.
Importantly, declining has to be just as easy as agreeing. Pre-ticked boxes or hidden reject buttons are not permitted. A correctly configured CMP makes sure these requirements are met and that consent is documented in a legally sound way.
In the German market especially, clean consent management is a genuine differentiator. Users and business partners look for serious data protection, so a professionally configured CMP creates trust while at the same time providing the legal basis for GDPR-compliant tracking forms.
How does consent affect your data?
Every CMP means some visitors decline tracking, which creates gaps in the analytics data. That gap is normal and part of a lawful setup. What matters is knowing about it and accounting for it when interpreting the figures, so no false conclusions are drawn.
Google Consent Mode helps close part of that gap by sending anonymised, modelled signals to Google Analytics 4 for visitors who declined. Also server-side tracking can improve data quality without leaving the legal framework.
An accompanying Performance audit checks whether the CMP works correctly and whether the consent rates are plausible. A well-designed banner interface can raise the opt-in rate noticeably without breaching the GDPR, and so secures a better data basis for your decisions.
Frequently asked questions
Is a consent management platform mandatory in Germany?
As soon as you use tracking cookies for analytics or marketing, users' active consent is required in Germany. A CMP is the tool for obtaining and documenting that consent in a legally sound way. Without one, GDPR-compliant tracking is practically impossible, which is why a CMP is in effect mandatory for most websites.
What does TCF 2.2 mean for a CMP?
TCF 2.2 is the current version of the Transparency and Consent Framework from the industry body IAB Europe. It standardises how consent is passed on in the programmatic advertising ecosystem. If you run advertising through providers using that standard, your CMP should support TCF 2.2 so consent is communicated correctly to every partner involved.
Which CMP suits WordPress?
For WordPress websites, Borlabs Cookie is a popular solution developed in Germany that integrates well with the system and is inexpensive. Cookiebot and Usercentrics can be integrated through plugins too. Which solution fits depends on how complex your tracking is and whether you need programmatic advertising with TCF support.
Does the consent banner cost me a lot of data?
Yes, some visitors refuse tracking, so a gap arises in the analytics data. That gap is part of a lawful setup. Google Consent Mode and server-side tracking can close it in part by delivering anonymised signals. A well-designed banner also raises the consent rate without breaching the GDPR.
How is the CMP connected to Google Consent Mode?
The CMP tells Google Consent Mode whether a visitor has agreed to tracking. On agreement, all tags fire normally. On refusal, Consent Mode ensures Google Analytics 4 and ad accounts receive only anonymised, modelled signals. Data collection thus stays lawful without giving up insight entirely.
What does a consent management platform cost?
Costs run from free entry-level plans to enterprise licences. Cookiebot offers a free variant for small sites, Borlabs works with a one-off licence, Usercentrics and OneTrust sit on monthly subscriptions and scale with the scope. What is decisive is not price alone but whether the solution covers your legal and technical requirements safely.
Related terms
Consent management organises how cookie consent is obtained, managed and documented in a legally sound way.
Google Consent Mode adjusts the behaviour of Google tags dynamically to the user's consent status, enabling GDPR-compliant tracking.
Tag management handles tracking codes centrally through a tag management system instead of in the source code.
Web tracking records and evaluates how visitors behave on websites — page views, conversions and more.
Collecting, measuring and analysing website data in order to improve content and conversions in a targeted way.
First-party data is data a company collects directly from its own users, with their consent.
Put AI to work for your business?
We help you integrate artificial intelligence into your processes, your marketing and your website — strategically and securely.
Your contact
Stefan
I look forward to hearing about your project and finding the best solution together.
