Evaluating Consent Management Platforms
Overview
A Consent Management Platform (CMP) is the technology layer that handles cookie consent collection, preference management, consent record storage, and signal propagation to downstream systems. Selecting the right CMP is critical for compliance with GDPR, ePrivacy, CCPA/CPRA, LGPD, and other regulations. The IAB Transparency and Consent Framework (TCF) v2.2 certification is a key differentiator for CMPs operating in the EU advertising ecosystem.
Evaluation Criteria
Category 1: Regulatory Compliance (Weight: 30%)
| Criterion | Description | Scoring |
|---|---|---|
| TCF v2.2 Certification | CMP is registered with IAB Europe and passes compliance audits | Required for EU advertising |
| GDPR Compliance | Supports Art. 7 consent requirements, Art. 7(3) withdrawal, Art. 7(1) records | Mandatory for EU operations |
| CCPA/CPRA Support | Supports "Do Not Sell" opt-out, GPC signal detection, CPRA requirements | Required for US operations |
| LGPD Support | Brazilian data protection law consent requirements | Required for Brazil operations |
| GPC Support | Detects and honors Global Privacy Control (Sec-GPC: 1) signal | Required for CA, CO, CT, MT, TX, OR |
| CNIL Compliance | Equal prominence accept/reject, 6-month reconsent, no cookie walls | Required for French operations |
| Multi-Jurisdiction | Ability to apply different consent rules based on user location | Critical for global operations |
| Cookie Scanning | Automated scanning to detect and classify all cookies on the site | Important for completeness |
Category 2: Technical Capabilities (Weight: 25%)
| Criterion | Description | Scoring |
|---|---|---|
| API Integration | RESTful API for consent state queries from backend systems | Critical for server-side enforcement |
| Tag Manager Integration | Native integration with Google Tag Manager, Tealium, Segment | Reduces implementation effort |
| SDK Availability | Mobile SDKs (iOS, Android) and server-side SDKs | Required for mobile apps |
| Performance | Page load impact (target: <100ms additional latency) | Critical for UX |
| Customization | UI customization (colors, layout, language, button text) | Important for brand consistency |
| A/B Testing | Built-in consent banner experimentation (within compliance boundaries) | Important for optimization |
| Geolocation | Accurate user location detection for jurisdiction-specific rules | Critical for multi-region |
| TC String Generation | Generates IAB TC String for ad tech ecosystem integration | Required for advertising |
Category 3: Consent Record Management (Weight: 20%)
| Criterion | Description | Scoring |
|---|---|---|
| Consent Receipts | Generates audit-ready consent receipts per Art. 7(1) | Critical for compliance |
| Version Control | Tracks consent text versions with change history | Important for audit trail |
| Consent History | Full history per user (grants, withdrawals, re-consents) | Critical for DSAR support |
| Data Export | Export consent records in standard formats (JSON, CSV) | Important for portability |
| Retention Controls | Configurable consent record retention periods | Important for data minimization |
| Search and Query | Search consent records by user, purpose, date range | Important for DPA inquiries |
| Proof of Consent | Can generate evidence packages for regulatory inquiries | Critical for enforcement defense |
Category 4: Reporting and Analytics (Weight: 15%)
| Criterion | Description | Scoring |
|---|---|---|
| Consent Rate Dashboard | Real-time consent/opt-out rates by purpose and region | Important for monitoring |
| Trend Analysis | Historical consent rate trends over time | Important for strategy |
| Compliance Reporting | Pre-built reports aligned with GDPR, CCPA requirements | Important for DPO |
| Custom Reports | Ability to create custom reports and dashboards | Nice to have |
| Alerting | Alerts for anomalous consent patterns (sudden drops, spikes) | Important for incident detection |
| GPC Reporting | Reports on GPC signal detection rates and actions taken | Required for CPRA compliance |
Category 5: Vendor and Support (Weight: 10%)
| Criterion | Description | Scoring |
|---|---|---|
| Data Processing Agreement | GDPR-compliant DPA available | Mandatory |
| Data Residency | EU data hosting available (for consent records) | Required for EU operations |
| Sub-Processors | Transparent sub-processor list | Required per Art. 28 |
| SLA | Uptime SLA (target: 99.9%+) | Critical for availability |
| Support | Dedicated support, privacy expertise, implementation guidance | Important |
| Pricing Model | Transparent pricing (per pageview, per domain, flat rate) | Important for budgeting |
Vendor Comparison Matrix
| Feature | OneTrust | Cookiebot | Usercentrics | Didomi | Quantcast Choice |
|---|---|---|---|---|---|
| TCF v2.2 Certified | Yes | Yes | Yes | Yes | Yes |
| GDPR Compliance | Full | Full | Full | Full | Full |
| CCPA/CPRA Support | Yes | Yes | Yes | Yes | Yes |
| GPC Detection | Yes | Yes | Yes | Yes | Yes |
| LGPD Support | Yes | Limited | Yes | Yes | Limited |
| CNIL Compliance | Yes | Yes | Yes | Yes | Yes |
| Multi-Jurisdiction | 100+ countries | 50+ countries | 50+ countries | 40+ countries | 30+ countries |
| Cookie Scanner | Automated | Automated | Automated | Automated | Automated |
| API | REST + GraphQL | REST | REST | REST + GraphQL | REST |
| Mobile SDKs | iOS + Android | Limited | iOS + Android | iOS + Android | Limited |
| GTM Integration | Native | Native | Native | Native | Native |
| A/B Testing | Built-in | Via API | Built-in | Built-in | Limited |
| Performance | ~80ms | ~60ms | ~70ms | ~75ms | ~50ms |
| Consent Receipts | Kantara-aligned | Basic | Detailed | Detailed | Basic |
| Version Control | Yes | Yes | Yes | Yes | Yes |
| Data Export | JSON, CSV, API | CSV | JSON, CSV, API | JSON, CSV | CSV |
| Consent Dashboard | Advanced | Basic | Advanced | Advanced | Basic |
| EU Data Hosting | Yes (Frankfurt) | Yes (Copenhagen) | Yes (Munich) | Yes (Paris) | Yes (Amsterdam) |
| DPA Available | Standard | Standard | Standard | Standard | Standard |
| SLA | 99.99% | 99.9% | 99.95% | 99.9% | 99.9% |
| Pricing Model | Per session | Per domain | Per session | Per pageview | Free (basic) |
| Starting Price | ~EUR 300/month | ~EUR 9/month | ~EUR 50/month | ~EUR 50/month | Free tier |
Selection Process
Step 1: Requirements Gathering
Identify must-have requirements based on:
- Jurisdictions where your organization operates
- Number of domains and mobile apps
- Advertising ecosystem participation (need TCF v2.2?)
- Backend integration needs (API requirements)
- Budget constraints
Step 2: Shortlist (3-4 Vendors)
Apply mandatory criteria as filters:
- TCF v2.2 certification (if operating in EU ad tech)
- GPC support (if serving US consumers)
- EU data hosting (if required by data residency policy)
Step 3: Proof of Concept (2 Weeks per Vendor)
For each shortlisted vendor:
- Implement on a staging environment
- Test all consent flows (accept, refuse, manage, withdraw)
- Measure page load impact
- Test API integration with backend systems
- Verify consent records meet Art. 7(1) requirements
- Test multi-jurisdiction logic (EU vs US vs Brazil)
Step 4: Scoring and Selection
Score each vendor against the weighted criteria. Calculate weighted total score. Select the vendor with the highest score that meets all mandatory requirements.
CloudVault SaaS Inc. Selection
After evaluating five vendors, CloudVault SaaS Inc. selected Usercentrics based on:
- Full TCF v2.2 certification
- Native iOS and Android SDKs (critical for CloudVault mobile app)
- Built-in A/B testing within CNIL compliance boundaries
- Strong API for server-side consent state queries
- EU data hosting in Munich (same jurisdiction as key customers)
- Competitive pricing for the pageview volume
Key Regulatory References
- IAB TCF v2.2 Specification — CMP certification and requirements
- GDPR Article 7 — Conditions for consent (CMP must support)
- GDPR Article 28 — Processor requirements (CMP as processor)
- CPRA Section 1798.135(e) — GPC signal recognition
- CNIL Deliberation 2020-091 — Cookie consent technical requirements
- LGPD (Lei 13.709/2018) — Brazilian consent requirements
- ePrivacy Directive Article 5(3) — Cookie consent basis
