How to choose the right Consent Management Platform (CMP)

You've decided you need a Consent Management Platform. Good — that means you're taking the June 2026 deadline seriously. But now you're staring at a dozen options, each claiming to be "the best CMP for GDPR compliance." How do you actually pick the right one?

This guide cuts through the noise. We'll cover the features that matter, the pricing models to watch for, the red flags that signal a bad investment, and the exact questions to ask vendors before you sign.

Why a CMP matters more than you think

A CMP isn't just a cookie banner. It's the bridge between your users' privacy choices and every measurement, advertising, and analytics tool you run. A bad CMP doesn't just look ugly — it leaks consent signals, breaks your data, and potentially puts you out of compliance despite your best efforts.

The stakes:

• Google Ads stops personalizing if consent signals don't arrive correctly. Your CPA goes up, your ROAS goes down.
• GA4 loses 50%+ of data without proper behavioral modeling, which requires advanced mode consent pings.
• GDPR fines for non-compliance can reach €20 million or 4% of annual turnover.
• Server-side tagging breaks if the consent state doesn't propagate to the server container.

The 7 features that actually matter

1. Google Consent Mode v2 support (mandatory)

This is non-negotiable. The CMP must:

• Declare all 7 parameters as denied by default, synchronously, before any Google tag runs.
• Update the state to granted in under 500 ms after the user decides.
• Include ad_user_data and ad_personalization — the two signals Google made mandatory in March 2024.
• Work in advanced mode (cookieless pings) by default, not basic mode.

Test it: Open Chrome DevTools, filter by g/collect, and check the gcd parameter. If it shows 11r1r1r1r5 after accepting all, the CMP is doing its job. We explain how to read it in our gcd parameter guide.

2. Cookie scanner and auto-classification

A CMP that doesn't scan your cookies is a banner without intelligence. Look for:

• Automatic scanning that detects all cookies, localStorage, and session storage on every page load.
• Classification by category (necessary, analytics, marketing, personalization) — ideally with AI-assisted categorization.
• Frequency — weekly scans minimum, daily preferred. Cookies change constantly.
• Third-party cookie detection — scripts that load other scripts, which is where most cookie sprawl happens.

3. Banner customization and WCAG 2.1 AA accessibility

The banner is the only part of your privacy stack that users actually see. It needs to:

• Match your brand (colors, fonts, layout) without compromising clarity.
• Be fully accessible: keyboard navigation, focus trap, screen reader support, sufficient color contrast.
• Work on mobile-first — most consent decisions happen on phones.
• Support granular choices — some users want analytics but not advertising. A binary "accept all / reject all" loses the middle ground.

Red flag: if the CMP's banner can't be customized beyond "top bar" or "bottom bar," you're stuck with a generic look that screams "we didn't invest in this."

4. Multi-language and multi-jurisdiction support

If you operate in the EEA, LATAM, or both, your CMP must:

• Support multiple languages with proper translations (not machine-translated legalese).
• Apply different rules by jurisdiction — GDPR in Europe, LGPD in Brazil, Law 1581 in Colombia, LSSI in Spain.
• Handle hreflang correctly so the right banner shows in the right language.

5. Audit trail and compliance certificates

When a regulator asks "prove you had consent," you need:

• A signed certificate for every consent decision, with timestamp, IP hash, and the exact consent state.
• 5-year retention minimum (GDPR requirement).
• Export capability — CSV, API, or dashboard download for legal teams.
• Tenant isolation — if you're a multi-tenant SaaS, each client's consent data must be logically separated.

6. GTM integration and server-side support

The CMP must work with your tag management setup:

• GTM Consent Initialization — the CMP's default state must fire before any tag, at the highest priority.
• Server-side tagging — consent state must propagate to server containers (sGTM, Cloudflare Workers, etc.).
• dataLayer events — the CMP should push consent updates to the dataLayer so custom tags can react.
• Custom tag gating — non-Google tags (Meta, TikTok, LinkedIn) need to respect consent via the CMP's API.

7. Reporting and diagnostics

You can't fix what you can't measure. Good CMPs provide:

• Real-time consent dashboard — what percentage of users accept, reject, or customize.
• Consent rate trends — is your acceptance rate improving or declining?
• Integration with Google Ads diagnostics — verify that modeling is active and conversion tracking is healthy.
• Export for analysis — raw consent data for your analytics team.

Pricing models: what to expect

Model	How it works	Best for	Watch out for
Free tier	Limited pageviews, basic features	Small sites, testing	Usually lacks advanced mode, no audit trail
Pageview-based	Price scales with monthly pageviews	Most SaaS sites	Overage charges can spike during campaigns
Domain-based	Price per domain	Multi-brand companies	May not scale well with many micro-sites
Flat rate	Fixed monthly price	Enterprise, high-traffic	Rare, often requires annual commitment
Usage-based	Pay per consent record	High-traffic publishers	Hard to predict costs

Typical ranges (2026):

• Small sites (< 100K pageviews): $0–50/month
• Mid-market (100K–5M pageviews): $50–300/month
• Enterprise (5M+ pageviews): $300–1,000+/month

Hidden costs to ask about:

• Setup fees
• Custom design fees
• API call limits
• Audit trail storage
• Premium support

Red flags: walk away if you see these

1. No advanced mode support. If the CMP only works in basic mode (blocking tags until consent), you lose all behavioral modeling. This is a dealbreaker for any site that relies on Google Ads.

2. Missing ad_user_data and ad_personalization. These have been mandatory since March 2024. If the CMP doesn't send them, your Google Ads personalization is silently disabled.

3. No cookie scanner. A CMP without a scanner is just a banner. You need to know what cookies exist to classify them correctly.

4. Hardcoded in one language. If the CMP can't support multiple languages or jurisdictions, it won't scale with your business.

5. No audit trail. Without consent certificates, you have no proof of compliance. Regulators don't accept "trust us."

6. Slow consent update. If the CMP takes more than 500 ms to update the consent state after the user decides, tags may fire before the update arrives. This is a race condition that silently breaks your data.

Questions to ask vendors

Before signing, ask these exact questions:

Technical

• "Does your CMP support Google Consent Mode v2 in advanced mode?"
• "How quickly does the consent state update after the user decides?"
• "Do you send ad_user_data and ad_personalization signals?"
• "How does consent propagate to server-side tag managers?"
• "Can you show me the gcd parameter in a live test?"

Compliance

• "Do you provide signed consent certificates for each user decision?"
• "How long do you retain consent records?"
• "Can I export consent data for legal audits?"
• "How do you handle multi-jurisdiction consent (GDPR, LGPD, LSSI)?"

Business

• "What's included in the base price vs. add-ons?"
• "Is there a free trial or sandbox environment?"
• "What's your uptime SLA?"
• "Do you offer implementation support?"

How Conma checks every box

Conma was built from the ground up to solve these problems:

• Advanced mode by default. All 7 parameters declared as denied synchronously, before any Google tag runs. Consent updates arrive in under 500 ms.
• Automatic cookie scanner. Detects and classifies all cookies on every page load, with weekly re-scans.
• WCAG 2.1 AA accessible banner. Web Component architecture with Shadow DOM, keyboard navigation, screen reader support, and full brand customization.
• Signed consent certificates. Every decision is cryptographically signed with timestamp, IP hash, and consent state — stored for 5 years.
• Server-side ready. Consent state propagates to sGTM and custom server implementations via our API.
• Multi-tenant with RLS. PostgreSQL Row-Level Security ensures complete data isolation between clients.

If you're evaluating CMPs, start with our Consent Mode v2 implementation guide to understand what "good" looks like — then compare.

What to do next

1. Audit your current setup. Use our GCS codes guide to check if consent signals arrive correctly.
2. Run through the checklist. If your current CMP fails on any of the 7 features above, it's time to switch.
3. Try Conma. Start free — no credit card, full features, 14-day trial.