Also called: CMP, cookie banner, consent banner, cookie consent tool
A CMP does three jobs: display a compliant choice, store the decision with a timestamp and a record of what was shown, and broadcast the decision so tags can react. The third job is where implementations fail — a banner that saves a preference but never signals Google Consent Mode has satisfied nobody.
Google-certified CMPs integrate with Consent Mode v2 directly and are required for advertisers using Google's EEA advertising features. Custom or homegrown banners can work, but you own the correctness of the signal wiring.
The audit record matters as much as the banner. Under GDPR you must be able to demonstrate that consent was freely given and informed, which means retaining what the user was shown, not merely the yes or no.
A misconfigured CMP produces the worst of both outcomes: tags fire before consent (a compliance exposure) while consenting users are treated as refusals (a measurement loss). Both are invisible in analytics reports.
In the EEA and UK, yes — GA4 sets cookies and processes personal data, so it requires consent under the ePrivacy Directive and GDPR. Outside those regions the answer depends on your jurisdiction and, increasingly, on US state privacy laws.
Any Google-certified CMP with a native GTM template, which covers Cookiebot, OneTrust, Osano, and several others. The deciding factor is usually whether the CMP sets Consent Mode defaults before GTM loads, not the feature list.
TagEasy's free auditor checks any URL for Consent Mode v2 signals, PII in tracking, duplicate pixels, and 10 other tracking-quality faults. No signup.
