- Your CMP is not just a compliance checkbox. It sits between your analytics stack and every user who visits your site, deciding which consent signals fire and which do not.
- Google Consent Mode v2 requires an IAB TCF 2.2-certified CMP or a direct API integration to pass consent signals to Google Ads and GA4. Without it, conversion modeling breaks.
- The nine platforms below cover the full range: enterprise orchestration (OneTrust, TrustArc), mid-market sweet spots (Usercentrics, Osano), developer-first options (Ketch, CookieYes), and lean SMB tools (Termly, Complianz, Cookielaw.org).
- The biggest marketing cost of a misconfigured CMP is not a fine. It is the collapse of your paid media attribution when Google cannot model conversions from users who declined cookies.
- Consent Mode v2 is not optional for advertisers running Google Ads in the EU or UK. It has been a hard requirement since March 2024.
The best consent management platform for most marketing teams depends on stack complexity and geography. For teams running Google Ads into the EU, any CMP that is IAB TCF 2.2-certified and passes ad_storage and ad_user_data signals via Google Consent Mode v2 will protect conversion modeling. For US-only companies, a lighter CCPA-focused tool handles the legal minimum. OneTrust and TrustArc suit complex enterprise stacks; Usercentrics and Osano suit mid-market teams who want a balance of compliance coverage and marketing visibility; CookieYes and Termly suit lean teams on tight budgets.
Why Your CMP Is a Marketing Infrastructure Decision, Not a Legal One
Most marketing teams treat the cookie banner as something legal owns. That framing is expensive. The CMP sits upstream of your tag manager, your analytics platform, and your ad pixels. What it blocks or allows directly determines what your measurement stack can see.
Consider a B2B SaaS company running Google Ads into Germany with 50,000 monthly visitors. If their CMP fires all tags by default and only suppresses them post-opt-out, they are likely violating GDPR and running afoul of Google’s EU User Consent Policy. But if their CMP blocks ad_storage and never passes a consent signal to Google Ads for users who decline, their conversion data goes dark. Google cannot model those conversions, cost-per-acquisition reporting inflates, and the media team cuts spend on campaigns that were actually working.
Google Consent Mode v2 was designed to solve exactly this. It allows a certified CMP to pass consent state signals even for users who decline, so Google’s models can fill in the gaps without using identifiable data. Without a properly integrated CMP, that modeling pipeline simply does not run. The result is a measurement gap that looks like underperformance.
This is why CMP selection belongs in the same conversation as your marketing attribution stack. The consent layer feeds everything downstream.
The AboutMartech Consent Signal Audit: Four Questions That Separate Compliant CMPs From Measurement-Ready Ones
Before comparing specific vendors, run what we call the AboutMartech Consent Signal Audit, a four-point check that distinguishes CMPs that generate a defensible compliance record from those that actively preserve your marketing measurement. Most CMP evaluations stop at the first two questions. The last two are where measurement quality is actually decided.
Signal coverage: Does the CMP natively support Google Consent Mode v2, passing all four consent signal types (ad_storage, ad_user_data, analytics_storage, ad_personalization)? A CMP that only sets a cookie without pushing these signals to the dataLayer is not Consent Mode v2 compliant, regardless of what the vendor’s marketing says. This is the most commonly failed check among tools marketed as “Consent Mode compatible.”
TCF 2.2 certification: Is the CMP listed on IAB Europe’s official vendor list as a certified CMP? This matters for programmatic advertising and for any publisher or advertiser using TCF-based consent for real-time bidding. It is a separate certification from Google Consent Mode compatibility, and you may need both. Conflating the two is the single most common source of compliance gaps in mid-market stacks.
Cookie scan accuracy: Does the CMP automatically scan your site to detect first- and third-party cookies, or do you maintain a manual list? Manual lists go stale the moment a new pixel fires. Automated scanning is the baseline for any team running multiple marketing technologies, and the gap between a fresh scan and a stale declaration is where undocumented data collection lives.
Preference center and re-consent logic: Can users granularly manage their consent preferences, and can the CMP trigger a re-consent prompt when your cookie declaration changes materially? This is the mechanism that keeps consent valid as your stack evolves. Without it, you may be operating on consent granted for a tag inventory that no longer matches your actual deployment.
The first two questions filter for legal adequacy. The third and fourth filter for operational integrity. A CMP can pass the first two and still silently drift out of compliance within sixty days of deployment if the last two are not addressed.
Which CMPs Support Google Consent Mode v2 and IAB TCF 2.2?
| CMP | Google Consent Mode v2 | IAB TCF 2.2 | CCPA / CPRA | Auto Cookie Scan | Starting Price | Best For |
|---|---|---|---|---|---|---|
| OneTrust | Yes | Yes | Yes | Yes | Quote-based | Enterprise, complex multi-domain |
| TrustArc | Yes | Yes | Yes | Yes | Quote-based | Enterprise, legal-heavy orgs |
| Usercentrics | Yes | Yes | Yes | Yes | From $60/month (public pricing) | Mid-market, EU-first stacks |
| Osano | Yes | Yes | Yes | Yes | From $99/month (public pricing) | Mid-market, US companies with EU exposure |
| Ketch | Yes | Yes | Yes | Yes | Free tier; paid from $149/month (public pricing) | Developer-forward, data-stack teams |
| CookieYes | Yes | Yes | Yes | Yes | Free tier; paid from $10/month (public pricing) | SMB and early-stage with EU traffic |
| Termly | Yes | No (US-law focus) | Yes | Yes | Free tier; paid from $10/month (public pricing) | US-only, lean legal requirements |
| Complianz | Yes | Yes | Yes | Yes | From $79/year (public pricing) | WordPress-native teams |
| Cookielaw.org (iubenda) | Yes | Yes | Yes | Yes | From $27/year per site (public pricing) | Agencies, multi-site managers |
Pricing figures above are drawn from each vendor’s public pricing pages and are subject to change. Enterprise tiers at OneTrust and TrustArc are quote-only; neither publishes a floor price.
The 9 Best Consent Management Platforms for Marketing Teams
1. OneTrust
OneTrust is the market-share leader in enterprise CMP, and for complex organizations it is genuinely difficult to displace. Its consent orchestration covers web, mobile, and connected TV, and its integrations with Adobe Experience Platform, Salesforce, and major CDPs are mature. The platform supports IAB TCF 2.2, Google Consent Mode v2, CCPA, LGPD, PIPEDA, and a growing list of other frameworks through a rules-based policy engine rather than manual configuration per jurisdiction.
The trade-off is cost and implementation weight. OneTrust is not a tool a two-person marketing team deploys in an afternoon. It requires implementation support, and enterprise contracts are negotiated, not listed. Teams who have gone through a complex OneTrust deployment consistently report that the preference center and audit trail capabilities are among the most fully developed in the category, while the UI for non-technical admins is dense. If your organization has a data privacy function that owns the CMP, OneTrust earns its place. If marketing is expected to self-serve, look elsewhere.
2. TrustArc
TrustArc competes with OneTrust at the enterprise end and has historically been the choice for legal-heavy organizations because it bundles consent management with privacy program management, risk assessments, and vendor tracking. Its CMP layer supports TCF 2.2 and Consent Mode v2, and its consent records are designed to survive regulatory audits with detailed timestamps and version control.
For marketing teams, TrustArc’s strength is its cross-jurisdictional ruleset. A single configuration can handle different banner behaviors for users in California, the EU, Brazil, and Canada without requiring marketing to maintain separate implementations. The downside: TrustArc’s analytics reporting on consent rates and opt-in percentages is not as granular as some mid-market competitors, and the platform is priced similarly to OneTrust with no self-serve entry point.
3. Usercentrics
Usercentrics is the strongest mid-market CMP for teams where EU compliance is the primary driver. It was built with GDPR as the core use case, and its consent rate optimization tools are more developed than most competitors at this price point. The platform includes A/B testing for banner designs, multilingual support for over 40 languages, and a native integration with Google Tag Manager that makes Consent Mode v2 implementation straightforward.
Its data layer output is clean, which matters if you are feeding consent signals into a customer data platform or using server-side tagging to maintain measurement quality post-consent. Usercentrics publishes consent rate benchmarks by industry and banner design, which gives marketing teams actual data to evaluate opt-in performance rather than guessing. Pricing starts at $60 per month per domain based on their public pricing page, scaling with traffic.
4. Osano
Osano is the CMP that most clearly bridges legal compliance and marketing operations. Its dashboard surfaces consent rates, opt-in trends, and scanner results in a format a marketing manager can read without a compliance background. It supports Google Consent Mode v2 and IAB TCF 2.2, and its vendor monitoring feature continuously scans third-party scripts to flag new cookies or tracking technologies that appeared without consent declarations.
That last feature is particularly valuable for marketing teams running agencies or multiple ad platforms, where new pixels appear between audits. Osano’s pricing starts at $99 per month as listed on their public pricing page. It is not the cheapest option, but for US companies that recently started selling into the EU and need visibility into their actual consent state without a full enterprise contract, Osano handles both the compliance and the reporting in one place.
5. Ketch
Ketch positions itself as the CMP for teams running modern data stacks. Its architecture separates the consent collection layer from enforcement, meaning consent signals can be passed programmatically to downstream systems rather than relying solely on tag blocking. This matters for teams using server-side GTM, warehouse-native pipelines, or event streaming architectures where client-side tag blocking does not cover all data flows.
Ketch describes its platform as powered by an AI Agent Network that can collect, enforce, and audit consent across devices and brands. That framing is marketing language, but the underlying architecture is genuinely more flexible than most CMPs. Its free tier covers basic consent collection; paid plans start at $149 per month per its public pricing page and include multi-domain management, the preference center, and advanced Consent Mode v2 signal routing. Teams building a first-party data stack will find Ketch’s API-first design fits the architecture better than banner-focused competitors.
6. CookieYes
CookieYes is the practical choice for growth-stage companies that need a fully compliant, Consent Mode v2-ready CMP without significant implementation overhead. Its setup process is tag-based, the scanner auto-categorizes cookies by purpose, and its Google Tag Manager template pushes the four required Consent Mode v2 signals correctly out of the box.
CookieYes supports IAB TCF 2.2, which is notable at this price point. Paid plans start at $10 per month per their public pricing page, with a free tier that covers a single domain under a monthly pageview cap. For companies generating under $10 million in revenue and running standard marketing stacks (Google Ads, GA4, Meta Pixel, HubSpot), CookieYes covers the compliance and the measurement preservation requirements without requiring a procurement process.
7. Termly
Termly targets US-based companies navigating CCPA, CPRA, and the growing list of state-level privacy laws without significant EU exposure. Its consent banner generator, privacy policy builder, and cookie scanner are integrated in one dashboard, which is useful for lean teams that want a single vendor for their legal document stack and consent layer.
Termly does not hold IAB TCF 2.2 certification, which makes it unsuitable for publishers running programmatic advertising or for companies with material EU traffic that needs TCF-based consent for their ad stack. It does support Google Consent Mode v2, so GA4 and Google Ads measurement works correctly for US-based implementations. Paid plans start at $10 per month per their public pricing page. For a US startup with no EU operations, Termly is a rational, low-cost starting point.
8. Complianz
Complianz is a WordPress-native CMP plugin with deeper integration into the WordPress stack than any other platform on this list. It automatically detects plugins that set cookies (WooCommerce, Elementor, MonsterInsights, and dozens of others), categorizes them, and builds the consent banner configuration from the plugin inventory rather than requiring manual entry.
Its Consent Mode v2 integration works through a native Google Tag Manager template or direct script output, and it holds IAB TCF 2.2 certification. For marketing teams running WordPress-based sites with a mix of WooCommerce, contact forms, live chat, and ad scripts, Complianz eliminates most of the cookie audit work that competing platforms require manually. Annual pricing starts at $79 per year per their public pricing page. It does not have a meaningful SaaS equivalent; it is built for WordPress and that specificity is its advantage.
9. Cookielaw.org (iubenda)
iubenda, which operates the Cookielaw.org property, serves agencies and multi-site operators who need to deploy compliant consent banners across a portfolio of domains at low per-site cost. Its platform supports Consent Mode v2, IAB TCF 2.2, CCPA, LGPD, and a broad set of international frameworks through a single configuration that adapts banner behavior by detected user geography.
The preference center and auto-blocking features work without requiring tag manager expertise, which makes it viable for agency clients who need a handoff-ready solution. Per-site pricing starts at $27 per year as listed on their public pricing page, making multi-site deployments economically manageable. The trade-off is customization depth: the banner designs are less configurable than Usercentrics or Osano, and the reporting on consent rates is simpler than what mid-market competitors provide. For volume deployment across standardized sites, that trade-off is acceptable.
How Does a CMP Actually Affect Your Analytics and Ad Data?
The mechanism is worth understanding precisely, because most marketing teams underestimate how much data they lose from a misconfigured consent layer.
Take a hypothetical: a company with 100,000 monthly EU visitors, a 65% opt-in rate (within the range Usercentrics publishes in its industry benchmarks), and no Consent Mode v2 configured. The 35% who decline generate zero conversion signal in Google Ads. The platform sees a hole in the conversion funnel and, because machine-learning bidding models respond to conversion signal density, automated bidding degrades on campaigns that disproportionately reach privacy-conscious users. This is not a fringe case, it is the default outcome for any Google Ads account operating in the EU without Consent Mode v2 correctly wired to its CMP.
With Consent Mode v2 correctly configured, the CMP fires a consent signal for those 35,000 users with ad_storage set to denied. Google’s models use that signal, combined with anonymized behavioral patterns from consenting users, to model the conversions that would have been observed. The advertiser recovers a meaningful portion of that conversion signal without accessing individual user data. The bidding does not degrade.
This is why the measurement gap created by cookie deprecation is significantly narrower for teams running a properly integrated CMP than for those treating the banner as a legal formality. The CMP is part of the measurement stack.
Do You Need an IAB TCF 2.2-Certified CMP?
Not every company does, and conflating TCF certification with general GDPR compliance is a common mistake. IAB TCF 2.2 governs consent for real-time bidding and programmatic advertising. It requires that CMPs, publishers, and vendors register with IAB Europe and implement the TCF specification so that consent for specific purposes (data collection, ad personalization, measurement) can be passed through the ad-tech supply chain.
If your company runs paid search and paid social through direct platform interfaces (Google Ads, Meta Ads Manager, LinkedIn Campaign Manager) and does not participate in programmatic RTB, you do not technically need TCF 2.2 certification. You need a CMP that correctly implements Google Consent Mode v2 and documents consent per GDPR requirements. Termly covers this for US-focused teams. CookieYes and Complianz cover it for teams with EU exposure who run direct-buy only.
If you run display advertising through a DSP, operate as a publisher with ad inventory, or work with any demand-side partner that requires TCF signals, TCF 2.2 certification is non-negotiable. OneTrust, TrustArc, Usercentrics, Osano, Ketch, CookieYes, Complianz, and iubenda all carry it. Termly does not.
What Is the Cheapest GDPR Cookie Banner Tool That Is Actually Compliant?
CookieYes and iubenda are the two most cost-effective options that combine EU GDPR compliance, Google Consent Mode v2, and IAB TCF 2.2 certification. CookieYes starts at $10 per month. iubenda starts at $27 per year per site, which is the lower number for single-domain operators. Both auto-scan for cookies and generate documented consent records.
Free tiers exist at CookieYes, Ketch, and Termly, but they impose pageview limits or feature restrictions that typically make them unsuitable for any site with meaningful traffic or complex tag structures. The compliance risk of a misconfigured free-tier implementation, particularly one that fires pixels before consent is captured, outweighs the cost saving. For most real businesses, a paid entry-level plan is the appropriate starting point.
Best CMP for a US Company Selling Into the EU
This is the scenario where tool selection has the most marketing consequence. A US company that generates EU revenue must comply with GDPR for those users, and its Google Ads campaigns into EU markets need Consent Mode v2 to maintain conversion modeling. The right tool depends on the company’s size and technical resources.
For companies under 50 employees with a lean marketing stack, Osano is the strongest recommendation. It is the only platform in this range that continuously monitors third-party vendor compliance alongside its consent banner function, which matters when your ad tech vendors change their data practices without notifying you. The $99 per month entry price is real but justified by the monitoring capability.
For companies that already run server-side tagging or warehouse-based data pipelines, Ketch fits more naturally. Its consent signal architecture integrates with event streams rather than relying exclusively on client-side tag blocking, which means consent state propagates to your data warehouse rather than only to your tag manager. That architecture becomes relevant as teams build the kind of warehouse-native data stack where client-side consent enforcement is insufficient on its own.
Frequently Asked Questions About Consent Management Platforms
What is a consent management platform?
A consent management platform (CMP) is a software layer that intercepts website visitors before non-essential cookies fire, presents a consent interface that meets legal requirements (GDPR, CCPA, and others), records the user’s consent decision, and communicates that decision to your tag manager, analytics stack, and advertising platforms. A properly integrated CMP blocks cookies and tracking pixels until the user grants consent, and passes consent state signals to platforms like Google Ads that can use them for conversion modeling even when consent is denied.
Is Google Consent Mode v2 mandatory?
Google made Consent Mode v2 a hard requirement for advertisers using Google Ads, Google Analytics 4, and Google Marketing Platform in the European Economic Area and the UK, effective March 2024. Advertisers who do not implement it lose access to audience features, remarketing lists, and conversion modeling for users who decline consent. It is not legally mandated by GDPR itself, but Google enforces it contractually through its EU User Consent Policy as a condition of using its advertising products in those markets.
Do I need an IAB TCF-certified CMP?
You need an IAB TCF 2.2-certified CMP if you run programmatic display advertising through a DSP, operate as a digital publisher with ad inventory, or work with demand partners who require TCF consent signals. If your paid media runs exclusively through direct-buy platforms like Google Ads and Meta Ads Manager, TCF certification is not technically required, though it does not hurt. TCF certification and Google Consent Mode v2 compatibility are separate certifications; confirm both with any vendor you evaluate.
How does a CMP affect my Google Analytics data?
A CMP that is correctly integrated with Google Consent Mode v2 passes an analytics_storage consent signal for every user, including those who decline. GA4 uses cookieless pings and behavioral modeling to estimate user behavior for the declined segment, reducing but not eliminating the data gap. A CMP that simply blocks the GA4 tag without passing a consent signal results in a complete data gap for declined users, which distorts session counts, conversion rates, and attribution paths in ways that are often invisible to analysts who are not looking for them.
Are consent management platforms free?
Several CMPs offer free tiers, including CookieYes, Ketch, and Termly. Free tiers typically impose pageview caps, limit the number of domains, or restrict features like the preference center, auto-scanning, or audit log retention. For any production site with meaningful traffic or a multi-technology marketing stack, a paid tier is the practical requirement. Paid entry-level plans range from $10 per month (CookieYes, Termly) to $27 per year per site (iubenda) to $99 per month (Osano), based on public pricing pages.
Can a CMP be set up without a developer?
For most mid-market CMPs, yes. CookieYes, Termly, Osano, and iubenda all offer tag-based or plugin-based deployment that a marketing operations manager can complete in Google Tag Manager without developer support. Consent Mode v2 integration through GTM uses published templates and requires no custom code. More complex deployments involving server-side tagging, multi-domain consent inheritance, or API-based consent signal propagation (as with Ketch) typically require engineering involvement, at least for the initial configuration.
How does my CMP choice affect paid media performance?
The CMP controls how much consent signal reaches your ad platforms. A CMP that fires pixels by default and only suppresses them post-opt-out creates legal exposure. A CMP that blocks all pixels and passes no consent signals to Google creates a measurement gap that degrades automated bidding. A correctly configured CMP with Consent Mode v2 passes signal state for all users and lets Google’s conversion modeling compensate for the declined segment, preserving bidding signal quality. The difference in campaign efficiency between misconfigured and correctly configured Consent Mode v2 implementations is measurable in cost-per-acquisition. For teams thinking carefully about post-cookie measurement models, the consent layer is the first thing to get right.
The CMP Decision Most Marketing Teams Get Wrong
The most common mistake is treating CMP selection as a one-time legal project rather than an ongoing marketing infrastructure choice. Teams pick a tool, get the banner live, and move on. Then their tag manager changes. A new ad platform gets added. A developer installs a third-party chat widget. None of these events trigger a consent re-audit, and the cookie declaration goes stale. The CMP is now documenting consent for technologies it does not know about.
Automated cookie scanning solves this, but only if someone is watching the scanner output. Every platform on this list includes scanning; only Osano includes continuous third-party vendor compliance monitoring that alerts you when a vendor in your stack changes its data practices. For teams running five or more ad tech and analytics tools, that distinction matters more than banner design options.
The second mistake is optimizing for legal defensibility at the expense of opt-in rate. A dark-pattern consent banner that buries the “Accept All” button and pre-selects “Reject All” generates a clean audit log but a low opt-in rate. Usercentrics publishes industry-level consent rate data showing that banner design and UX choices can shift opt-in rates by double-digit percentage points within the same legal framework. A higher opt-in rate means more signal for your analytics and ad platforms, which means better attribution and better bidding, entirely within the law. The CMP is a conversion rate optimization problem as much as a compliance one, and the vendors that provide consent rate analytics are the ones worth paying more for. Understanding where consent data flows is not separable from understanding your modern marketing data stack as a whole.
