A Consent Management Platform is the technology that captures, records, and broadcasts your users' privacy preferences to your ad tech partners. It powers the cookie banner your users see, encodes their choices into a standardized string, and passes that signal downstream so buyers — including Sovrn — know what data they're allowed to use when bidding on your inventory.
This article explains how CMPs work, why they directly affect your revenue, and what to look for if you're choosing one.
This article is an educational overview. For legal compliance advice, consult a qualified privacy attorney.
Why do CMPs matter?
Modern programmatic advertising relies on personal data — browsing history, location, device identifiers — to serve relevant ads. Privacy regulations like the EU's GDPR and California's CCPA/CPRA require websites and apps to obtain clear, informed consent before collecting or processing that data.
Without a structured way to collect and record consent, you face two problems: significant legal risk, and ad inventory that's far less valuable to buyers.
What does a CMP actually do?
A CMP performs four jobs:
-
Presents the consent notice — typically a cookie banner — that explains what data is collected and why.
-
Records the user's choices — what they've consented to and what they've declined.
-
Broadcasts the consent signal to ad tech vendors, DSPs, and SSPs in a standardized format.
-
Maintains an audit log of consent in case of regulatory review.
Most CMPs operating in programmatic advertising implement the IAB Tech Lab's Transparency & Consent Framework (TCF), which defines a standard way to encode user consent into a string that travels with every bid request.
How does it work in practice?
When a user visits your site, your CMP checks whether it already has a valid consent record. If not, it surfaces the consent UI. Once the user chooses:
-
The CMP encodes the decision into a TC String (under GDPR/TCF) or a US Privacy String (under CCPA).
-
The string is stored in the user's browser and surfaced to your ad stack.
-
Sovrn reads the string and includes it in every bid request sent to demand partners.
-
Buyers use the consent signal to determine how much data they can use when bidding, which directly affects bid rates and CPMs.
Why does this affect my revenue?
A missing or malformed consent signal isn't only a compliance issue — it directly affects your ad revenue. Specifically:
-
Many DSPs won't bid, or will bid significantly less, on impressions without a valid consent signal.
-
Sophisticated buyers down-score inventory from publishers with inconsistent or absent consent signals.
-
Regulators can issue substantial fines for non-compliant data collection. GDPR penalties can reach 4% of global annual revenue.
-
Without consent, identity resolution is limited, reducing audience match rates and addressability.
Sovrn recommends implementing a properly configured CMP and actively encouraging consent — rather than using dark patterns that suppress it. Publishers who do this consistently tend to see stronger fill rates and higher eCPMs on consented traffic.
What signals should my CMP pass?
When auditing your CMP implementation, make sure the following signals are present and accurate in your bid requests:
|
Signal |
What it means |
|---|---|
|
gdpr |
Flag (0 or 1) indicating whether GDPR applies to this user. |
|
gdpr_consent |
The TC String encoding the user's specific consent choices. |
|
us_privacy |
CCPA compliance string for US traffic (e.g., 1YNN). |
|
consent_required |
Whether consent is required based on user geography. |
How do I choose a CMP?
Many CMP vendors are on the market. When evaluating one, look for:
-
IAB TCF certification — verify the vendor is on the IAB's official registered CMP list. Sovrn currently supports TCF v2.3; see What versions of TCF do you support? for details.
-
Support for your geographies — different rules apply in the EU, UK, California, and other US states.
-
Clear UI and neutral defaults — consent prompts that are easy for users to understand and that don't nudge users into accepting more than they want.
-
Integration with your ad stack — confirm your SSP can read the signals the CMP outputs.
-
Audit logging — you may need to demonstrate consent records in a regulatory review.
Questions? Concerns? Our team would be more than happy to help. Reach out to our Support Team here.