Consent management (cookie consent)
Consent management denotes obtaining, managing and documenting consent for cookies and tracking technologies. A consent management platform, CMP for short, shows users a consent banner, stores their decision and steers which tags may be delivered. Under the GDPR and TDDDG, active consent is mandatory for cookies that are not necessary. Consent management thus joins legal requirements to the technical steering of tracking.
Also known as: cookie consent, consent management, CMP
What is consent management?
Consent management covers all the processes and tools with which a company obtains and manages its site visitors’ consent to data processing. At the centre stands the consent banner, through which users can actively agree, refuse or make a differentiated choice. The decision made is stored and then steers which cookies and Trackingtechnologies may be used.
This task is handled by a Consent management platform, or CMP for short. It forms the Interface between the legal requirements and the technical implementation of tracking. The CMP makes sure no consent-requiring tag loads before the user has agreed.
Consent management is therefore far more than a cookie banner: it is the central control system for lawful data collection on your website.
Why is consent management a legal obligation?
In Germany the legal basis is the General Data Protection Regulation (GDPR) and the Telecommunications Digital Services Data Protection Act (TDDDG, formerly TTDSG). Under these, cookies and comparable technologies that are not strictly necessary may only be set after the user's active, informed consent.
Consent has to be freely given, unambiguous and for a specific purpose. Valid consent requires that declining is just as easy as agreeing and that no tracking cookies load beforehand. Pre-ticked boxes or hidden reject options are not permitted.
Breaches of these requirements can draw warning letters and fines. Correct consent management is therefore not only a compliance matter but also protection against legal and financial risk.
How does a consent management platform work?
A CMP is integrated into the website and takes on several jobs. It shows the consent banner, categorises cookies and services by purpose such as statistics or marketing, and stores the user's decision. That consent information is passed to the tracking setup, which then fires the permitted tags.
In practice, the CMP is closely tied to the Tag management system interlocked. Through corresponding triggers and consent signals it makes sure that analytics or advertising tags, for instance, only load after agreement. If a user changes their consent, this is taken into account and documented.
Audit-proof documentation matters: the CMP logs who consented to which processing and when. These records are decisive for proving consent to supervisory authorities.
What role does Consent Mode play?
The Consent Mode is a mechanism tying tracking services’ behaviour to the user’s consent status. Instead of blocking tags entirely without consent, they adapt their behaviour. Certain services then send only anonymised or heavily reduced signals, where that is legally permitted.
That way part of the information gap created by refusals can be closed without circumventing the consent requirement. Ad platforms can model missing data to a limited extent, to report conversions approximately nonetheless.
How Consent Mode is set up in detail must be done carefully and in line with legal requirements. A faulty configuration can jeopardise both data quality and legal compliance.
How does consent management affect data quality?
Every refusal means the corresponding tracking data is not collected. Depending on industry and audience, a noticeable share of user activity can therefore be missing from the analysis. That affects metrics such as conversion counts, reach and Attribution and has to be taken into account when interpreting the data.
A well-designed consent prompt, transparent, understandable and user-friendly, can improve the opt-in rate without applying undue pressure. In addition, server-side tracking and privacy-friendly tools such as Matomo help obtain reliable data even under restrictive settings.
At Elisabit we help you implement consent management so that data protection and data quality go together. As part of a Performance audit we review the banner, the CMP configuration and how it meshes with your tracking, for a consistently GDPR-compliant tracking.
What matters when putting it into practice?
Legally sound consent management starts with a correctly designed banner: equally weighted options to accept and decline, clear statements of purpose and no tracking cookies set in advance. Granular control matters just as much, so users can consent to individual purposes separately.
On the technical side the CMP has to work reliably with the tag management system, so no consent-requiring tag actually loads before agreement. Complete documentation and regular review of the setup round off professional consent management and keep it compliant for good.
Frequently asked questions
Do I need consent management for every website?
As soon as you use cookies or technologies that are not strictly necessary, for statistics or marketing for instance, you need consent and therefore consent management. Strictly necessary cookies are exempt, but as soon as tracking is involved a CMP is practically indispensable.
What is the difference between a cookie banner and a CMP?
A cookie banner is the visible prompt. A consent management platform is the system behind it that stores and documents the consent and controls when tags fire. A banner alone without effective technical control usually does not meet the legal requirements.
What happens when users reject tracking?
On a refusal, the cookies and tags concerned may not load, so no corresponding data is collected. That reduces the amount of data in your analysis. Mechanisms such as Consent Mode or server-side tracking can ease part of that gap in a privacy-compliant way.
Is Consent Mode legally permissible?
Consent Mode can be used lawfully if it is configured correctly and does not circumvent the consent requirement. It adapts the services' behaviour to the consent status but does not replace consent where consent is required. A careful, legally reviewed configuration is decisive.
How does consent management affect my analytics data?
Because declined tracking is not recorded, your analysis covers only the consenting share of users. That has to be taken into account when interpreting it. A user-friendly banner and additional methods such as server-side tracking help secure data quality.
Related terms
Web tracking records and evaluates how visitors behave on websites — page views, conversions and more.
Cookieless tracking measures user behaviour without third-party cookies, for example through first-party data.
Server-side tracking processes data through your own server container rather than in the browser alone.
Tag management handles tracking codes centrally through a tag management system instead of in the source code.
First-party data is data a company collects directly from its own users, with their consent.
Put AI to work for your business?
We help you integrate artificial intelligence into your processes, your marketing and your website — strategically and securely.
Your contact
Stefan
I look forward to hearing about your project and finding the best solution together.
